Cyber risk at the edge: current and future trends on cyber risk analytics and artificial intelligence in the industrial internet of things and industry 4.0 supply chains

Abstract

Digital technologies have changed the way supply chain operations are structured. In this article, we conduct systematic syntheses of literature on the impact of new technologies on supply chains and the related cyber risks. A taxonomic/cladistic approach is used for the evaluations of progress in the area of supply chain integration in the Industrial Internet of Things and Industry 4.0, with a specific focus on the mitigation of cyber risks. An analytical framework is presented, based on a critical assessment with respect to issues related to new types of cyber risk and the integration of supply chains with new technologies. This paper identifies a dynamic and self-adapting supply chain system supported with Artificial Intelligence and Machine Learning (AI/ML) and real-time intelligence for predictive cyber risk analytics. The system is integrated into a cognition engine that enables predictive cyber risk analytics with real-time intelligence from IoT networks at the edge. This enhances capacities and assist in the creation of a comprehensive understanding of the opportunities and threats that arise when edge computing nodes are deployed, and when AI/ML technologies are migrated to the periphery of IoT networks.

Introduction

There are many businesses opportunities in networking supply chains within the new digital economy (Bauer et al. 2015). Smart manufacturing is set to create large resource savings (G. Anderson 2016), and enable economies of scale (Brettel et al. 2016). The new paradigm of Industry 4.0 (I4.0) will enable organisations to meet individual customer requirements and create value opportunities (Lee et al. 2019b), increase resource productivity, and provide flexibility in businesses processes (Hussain 2017). To allow for this however, it requires integration of the Industrial-Internet-of Things (IIoT) theories, control of physical systems, and modelling interaction between humans and Cyber Physical Systems (CPS) (Marwedel and Engel 2016, Wang et al, 2015). Business and supply chain models need to embrace the opportunities from I4.0 (Jazdi 2014; Wahlster et al. 2013), for enhancing and automating their businesses process decomposition and real-world visibility. Real-time enabled CPS and IIoT platforms should represent the foundation for I4.0 businesses and respective supply chain models (Marwedel and Engel 2016). The idea of I4.0 was introduced with the development of IIoT and CPS (Ashton 2011; Gershenfeld 1999). The IIoT and CPS have sought to integrate the real and virtual worlds together (Tan et al. 2008), promoting automation with real-time enabled platforms (Ringert et al. 2015).

Although there is a consensus on the value from embracing the I4.0 (Shafiq et al. 2015), the impact of cyber risk remains to be determined (Okutan et al. 2018). There has been some advancements however with automation of vulnerability discovery (Y. Wang et al. 2019), and ensuring data confidentiality and secure deletion (Zhang et al. 2018). The IIoT and Supply Chain Management in I4.0 need to prepare for high-grade digitisation of processes, smart manufacturing, and inter-company connectivity (Müller et al. 2018). This requires understanding of the relationship between technological entrepreneurship and socio-economic changes (L. Li 2017).

A key novelty of this study is the process of using IoT design principles, presented as a step-by-step transformational roadmap. Technology road-mapping of information and communication technologies (ICT) is present in literature (Bloem da Silveira Junior et al. 2018). The findings from this study are building upon previous work on understanding the I4.0 trends for key smart manufacturing technologies (Lu and Weng 2018), and contribute for policy development.

The article builds upon existing studies on attack synthesis and towards predictive cyber defence (Okutan and Yang 2019) and graph-based visual analytics for cyber threat intelligence (Böhm et al. 2018), but distinguishes between ICT and IIoT. This is considered as fundamental distinction for narrowing the research efforts on understanding how modern IIoT technological concepts can be integrated in I4.0 supply chains.

We review how artificial intelligence and IoT introduce new challenges to privacy, security and resilience of connected supply chain environments. This study builds upon the FAIR institute (FAIR 2020) methodology by redefining the FAIR institute definition on ‘explicit’ risk management. The research focuses on how AI methods can be used to increase or decrease the precision and scale of attacks, by automating aspects such as intelligence gathering, target selection, and attack execution. The IoT devices built into digital supply chains greatly increase the amount of data captured. This could result in data leaks and significant privacy risks. While this topic is widely debated, less research has been conducted on how AI techniques and IoT devices could strengthen and improve privacy and security of individual users.

The study explores this angle, with a ‘red team’ approach, where a group of experts proactively identifies strengths and weaknesses in systems and organisations. We design AI/ML enabled methods to test and improve the resilience of IoT smart supply chains. We look at the challenges and potential for the use of privacy preserving AI/ML methods in regulatory red teams, such towards enabling data protection compliance. The paper builds upon the foundation of existing knowledge developed from three PETRAS projects (CRACS 2018; IAM 2018; Radanliev et al. 2019b), but with a specific focus on Artificial Intelligence and Machine Learning (AI/ML) in IoT risk analytics. It benefits from the already established strong transformative and impactful research knowledge, but with a focus on the topic of securing the edge through AI/ML real time analytics. To avoid overlapping with earlier work, this article avoids many relevant areas that have been addressed in the working papers and project reports that can be found in pre-prints online (Radanliev et al. 2019a; Radanliev et al. 2019c; Radanliev et al. 2019a, 2019b, 2019c; Radanliev et al. 2019d; Radanliev et al. 2019a, 2019b, 2019c, 2019d, 2019e, 2019f, 2019g, 2019h, 2019i, 2019j, 2019k, 2019l, 2019m, 2019n; Radanliev et al. 2019b, 2019c; Radanliev et al. 2019j; Radanliev et al. 2019a, Radanliev et al. 2019c; Radanliev et al. 2019b). This working papers and project reports work enabled the cognition engine to be developed, tested and verified, though the active engagement with the user community and through responding to the new Internet of Things (IoT) risk and security developments as they emerged during the research. The novelty of this article is the relationship of this work to AI/ML and predictive analytics.

Motivation and methodology

A taxonomic approach is used for the evaluations of progress in the area of supply chain integration in the Industrial Internet of Things and the Industry 4.0, with a specific focus on the mitigation of cyber risks. An analytical framework is presented, based on a critical assessment with respect to issues related to new types of cyber risk and the integration of supply chains in new technologies. The approach is used to develop a transformational roadmap for the Industrial Internet of Things in Industry 4.0 supply chains of Small and Medium Enterprises (SMEs). The literature review includes 173 academic and industry papers and compares the academic literature with the established supply chain models. Taxonomic review is used to synthesise existing academic and practical research. Subsequently, case study research is applied to design a transformational roadmap. This is followed by the grounded theory methodology, to compound and generalise the findings into analytical framework. This results in a new analytical framework based, whereby articles are grouped followed by a series of case studies and vignettes and a grounded theory analysis.

The analytical framework drives the process of compounding knowledge from existing supply chain models and adapting the cumulative findings to the concept of supply chains in Industry 4.0. The findings from this study present a new approach for Small and Medium Sized companies to transform their operations in the Industrial Internet of Things and Industry 4.0. A supply chain is a system for moving products from supplier to customer and supply chain operational changes from digital technologies would specifically affect the small and medium sized companies (SMEs) because they lack the expertise, know-how, experiences and technological recourses of large enterprises (Petar Radanliev 2014). A new approach for businesses and supply chain strategies is needed for the SME’s to adapt to a changing environment. To build such approach, designing cases studies (Blatter and Haverland 2012), with the ethnographic and discourse approaches to technology use and technology development is applied to the theory construction (David 2005).

Our methodology

Methodologically, the article draws on a number of different sources and research methods, including a taxonomic review as a discourse of literature (Paltridge 2017), case study research (Blatter and Haverland 2012) including open and categorical coding, with discourse analysis and grounded theory. These methods are used in combination for conducting a systematic literature review. The data and the findings are synthesised using the grounded theory approach of categorising the emerging concepts (Glaser and Strauss 1967). The case study research was performed on five I4.0 national initiatives and their technological trends in relation to IIoT product and services for a diverse set of industries. The diversity of the study participants represented in the sample population, is analysed with reference to the ‘Industry Classification Benchmark’ (FTSE Russell 2018) to determine the industry representativeness in the selected I4.0 national initiatives and their technological trends.

To ensure validity of the conceptual system, the study applied qualitative research techniques (Easterby-Smith et al. 2002; Eriksson and Kovalainen 2008; Gummesson 2000), complimenting method for grounded theory (Charmaz 2006), with open and categorical coding subsequently (Goulding 2002). Discourse analysis is applied to evaluate and interpret the connotation behind the explicitly stated approaches (Eriksson and Kovalainen 2008), along with tables of evidence (Eisenhardt 1989) and conceptual maps (Miles et al. 1983).

Article roadmap

The sub-chapter 2.1 defines how SME’s can integrate existing supply chain models; 2.2 defined the supply chain technical challenges from modern technological concepts; 2.3 defines how SME’s can integrate cloud technologies into their supply chain management; 2.4 defines how SME’s can integrate real-time IIoT technologies into their supply chain management; and 2.5 how SME can integrate cyber recovery planning into their supply chain management. Chapter 3 applies case study and grounded theory to categorise the I4.0 design principles. Chapter 4 presents the analytical framework and a transformational roadmap for integrating SMEs supply chains in the IIoT and I4.0.

Taxonomic review

The literature review covers a vast area of internet-of-things, cyber physical systems, industry 4.0, cyber security, and supply chain topics, e.g. digitisation, automation and autonomy. The literature review applies a taxonomic approach and follows the process of synthesising the most prominent categories, emerging from the reviewed literature. This follows the grounded theory approach of categorising emerging concepts (Glaser and Strauss 1967). The emerging categories from the review are classified with open and categorical coding (Goulding 2002) in the theory development chapter.

The taxonomic review of early supply chain models represents the foundation for our work on building the theoretical approach for integrating SME’s in the Internet-of-Things and Industry 4.0. The focus of this review and the proposed approach is the Internet-of-Things approach within Supply Chain Management. Considering the vast literature on Supply Chain Management from decades of research, the review is focused on the key areas instead of covering too many topics. The review does not address the related areas of vertical and horizontal integration, smart supply chains, and supply chain visibility because that would represent too many topics and thereby lead to losing focus. Instead, the review applied presents an up-to-date literature review and categorises the best practices, design principles, common approaches, and standards affecting SME’s supply chains in I4.0. This was considered as a relevant factor as many published models might rather apply to big corporations.

How to integrate existing supply chain models

Complexities remain in prioritising collective, as opposed to individual, performance improvement (Melnyk et al. 2014), and strategies commonly apply limited measurements (Van der Vaart and van Donk 2008). Holistic design visualising how different types of integration creates different effects is proposed (Rosenzweig et al. 2003). Thus, a hierarchical method can be applied for network design for deconstructing a complete supply chain that separates between the businesses and supply chain themes (Perez-Franco 2016). This approach has never been applied for SME’s designing I4.0 supply chains and its parameters will require altering to anticipate the similar and distinct features.

Following the taxonomic review method, the discourse of literature with open and categorical coding for discourse analysis and grounded theory, short summary of the areas is presented in the Table 1 outlining the design process on how SME’s can integrate existing supply chain models. Along with the underlying factors driving the design (B. Lee et al. 2019b) in the digital age including aligning strategy with digital technology; implementations of Internet-enabled collaborative e-supply-chains; and integration of electronic supply chains. Table 1 details how to align and integrate existing supply chain models.

Table 1 How to integrate existing supply chain models

How to integrate modern technological concepts in supply chain management – technical challenges

The technical challenges for SME’s integrating modern technological concepts, such as the I4.0 mostly evolve around the design challenges and the potential economic impact (loss) from cyber-attacks. But I4.0 also presents technical challenges in supply chains design and requires: software defined networks; software defined storage; protocols and enterprise grade cloud hosting; AI, machine learning, and data analytics; and mesh networks and peer-to-peer connectivity. The integration of such technologies in supply chains creates cyber security risk, for example from integrating less secured systems. Integrating the cyber element in manufacturing, also bring an inherent cyber risk. There are multiple attempts in literature where existing models are applied understand the economic impact of cyber risk. But there is no direct correlation between the higher cyber ranking and the industry application of digital infrastructure (Allen and Hamilton 2014), thus challenges could be more related to performance metrics for security operations (Agyepong et al. 2019).

Building upon the taxonomic review method, the discourse of literature with open and categorical coding for discourse analysis and grounded theory, short summary is presented in the Table 2 outlining the technical challenges in the process of how to integrate modern technological concepts in supply chain management.

Table 2 How to integrate modern technological concepts in supply chain management – technical challenges

How to integrate cloud technologies in supply chain management

To reduce costs and cyber risk, cloud technologies could enable value creation and value capture, through machine decision making (De Roure et al. 2019a, 2019b). This would create service oriented planning (Akinrolabu et al. 2019). The social machines (De Roure et al. 2019a, 2019b) should be seen as the connection between physical and human networks (Shadbolt et al. 2019), operating as systems of systems (Boyes et al. 2018), representing mechanisms for real-time feedback (De Roure et al. 2015) from users and markets (Marwedel and Engel 2016).

Building upon the taxonomic review and the analytical framework based on taxonomic format, the Table 3 outlines a short summary of the design process for integrating cloud technologies into supply chain management.

Table 3 How to integrate cloud technologies in supply chain management

How to integrate modern technological concepts into supply chain management - real-time IIoT technologies

Digital supply chains should counteract components modified to enable a disruption. This could be supported by standardisation of design (Nurse et al. 2017) but risk assessing is still a key problem (Petar Radanliev et al. 2020). The reason for this is that digital cyber supply chain networks need to be: secure, vigilant, resilient and fully integrated (Craggs and Rashid 2017) and encompass the security and privacy (Anthonysamy et al. 2017).

The taxonomic review and the analytical framework in Table 4 outlines a short summary of the design process on how to integrate real-time IIoT technologies in supply chain management.

Table 4 How to integrate real-time IIoT technologies in supply chain management

How to integrate cyber recovery planning into supply chain management

The I4.0 brings inherent cyber risks and digital supply chains require cyber recovery plans supported with machine learning, enabling machines to perform autonomous decisions (Tanczer et al. 2018) and a design support system (Lee et al. 2019a). To improve the response and recovery planning, digital supply chains need to be supported by feedback and control mechanisms, supervisory control of actions (Safa et al. 2018). Most of these recommendations also apply to large enterprises. However, large enterprises have the recourses to control the entire supply chain, while SME’s frequently have to integrate their supply chain operations (Petar Radanliev 2015a, 2016). Integrating multiple SME’s in the supply chain requires higher visibility and coordination between participants (Petar Radanliev 2015b, 2015c).

Finally, the taxonomic review of literature and the analytical framework in Table 5 outlines a short summary of the design process on how SME’s can integrate cyber recovery planning into their supply chain management.

Table 5 How to integrate cyber recovery planning in supply chain management

The key gaps in the literature emerging from the taxonomic review of literature and the analytical framework

This review of technological trends on supply chain adoption confirms that SME’s would benefit from a standardisation references for managing I4.0 complexities and IIoT resources efficiently. The key gaps in the literature which confirm that SMEs would benefit from standardisation reference are:

• Existing I4.0 architectures, lack clarification on designing individual components of I4.0 supply chains.

• The SME’s need to integrate cloud technologies in their supply chains.

• The SME’s digital supply chains need to encompass the security and privacy, along with electronic and physical security of real-time data.

• In the I4.0 supply chains, machines should connect and exchange information through cyber network and be capable of autonomous cognitive decisions.

• The SMEs need security measures to protect themselves from a range of attacks in their supply chains, while cyber attackers only need to identify the weakest links.

• The weakness of existing cyber risk impact assessment models is that the economic impact is calculated on organisations stand-alone risk, ignoring the impacts of sharing supply chain infrastructure.

The literature reviewed lacks clarification on the required design principles to address these gaps in individual levels of the I4.0 supply chains. Without such clarification, it is challenging to build a standardisation reference. In addition, supply chains design is still dominated by separation between established supply chain models, and the evolution of the IIoT. This separation is likely caused by the development of many established businesses and supply chain models before the rapid emergence of the IIoT.

Case study of five leading I4.0 technological trends

The gaps and key factors in current technological trends for I4.0 supply chain design integrating IIoT principles were derived from the taxonomic review. These are analysed through a case study of I4.0 frameworks in the current chapter. The case study specifically addresses the SME’s needs for I4.0 know-how and develops a transformational roadmap of tasks and activities to reach a specific target state for the SME’s supply chains. We have chosen to use a case study research-based methodology because it is recommended in recent literature for addressing the gaps in knowledge and for advancing the methodological rigour; this is done specifically by studying platforms on different architectural levels and in different industry settings (de Reuver et al. 2017).

The case study design compares individual problems derived from the literature with the technological trends in industry today. Comparative analysis is applied which involves the five leading I4.0 initiatives and technological trends. The comparative analysis is building upon previous work on a comparison of ‘Made in China 2025’ and ‘Industry 4.0’ (Li 2017), with an extended list of I4.0 initiatives. The justification for selecting the specific I4.0 initiatives was their richness in detail and explicitly stated strategies. The case study research initially reviewed 15 initiatives, worth mentioning, some countries have multiple I4.0 initiatives (e.g. USA, UK, Japan). But not all initiatives are discussed in great detail, as they lacked explicit details on I4.0 supply chains. The initial list of 15 initiatives reviewed are included in Table 6.

Table 6 I4.0 frameworks reviewed

The initiatives and their technological trends reviewed, embed the I4.0 and present a quick overview of the current state of the I4.0 supply chain adoption. The case study starts with the Industrial Internet Consortium (IIC 2016), as the leading and most recent initiative, and follows with a case study of additional four I4.0 world leading initiatives.

The Industrial Internet Consortium (IIC) (IIC 2016, 2017) promotes a fully connected and automated production line that brings the customer into the production process as a decision-maker. IIC supports highly automated (rules engines, protective overrides) and human operated (visualisation, intervention controls) usage environments.

The UK I4.0 report (DCMS 2017) focuses extensively on the cloud integration in I4.0. While some initiatives are supported with direct examples of how the strategy can be executed (e.g. cloud data centres: Amazon, IBM, and Microsoft; or the cloud skills initiative to train public service in digital skills for development of cloud technology skills), other initiatives are not well defined. For example, the cloud-based software initiative states continuation towards common technology and lack a concrete action. This could in some instances be beneficial, as loosely defined standards provide flexibility in evolving as requirements change. Nevertheless, a concrete area of focus is required for the integration of SME’s supply chains in I4.0. Another review report from the UK (Siemens 2017) is focussed on industry rather than commerce. The report estimates a £185 billion value in the next 10 years from four sectors construction, food and drink, pharmaceutical and aerospace sectors. The review makes three main recommendations for I4.0: adoption, innovation and leadership. While the value of this review cannot be denied, the claim of focus on industry can rather be described as the areas where government funding can help the industry. By reviewing the recommendations, it becomes clear that in each recommended area, public funding is required for achieving the goals. For example, the main areas (1) investing in a ‘National Adoption Program’; (2) launching new innovation centres across the UK; (3) implementing large-scale digital transformational demonstrator programs and (4) pushing research and development in the identified areas; are all points that require public funding. Or the recommendation to up-skill a million industrial workers, again requires government funding. Even the seemingly leadership area of promoting the UK as a global pioneer in industrial digital technologies, which would fit in the government policy focus, is again confused with government subsidies as it calls for setting up a ‘campaign’, and setting up ‘support implementation groups’. The objective of this article is to identify and categorise such policies and to present as industry led (and market focused) and not government led options for the UK and any other government that is aiming on developing their digital economies.

The most peculiar report is the Industrial Value Chain Initiative (IVI) (IVI 2017). This I4.0 initiative, does not report any plans for real-time embedded systems or recovery plans. It is difficult to accept that Japan would miss out on these crucial principles for integrating IIoT in I4.0. It seems more likely that this initiative does not state such principles clearly in their reports. Nevertheless, a detailed review of all reports on the IVI (IVI 2017) failed to identify any mentioning of real-time CPS or recovery plans.

The German initiative, Industrie 4.0 (GTAI 2014; Industrie 4.0 2017; Wahlster et al. 2013), covers the CPS and IIoT principles for cognitive evolution in I4.0. The German I.40 initiative promotes cloud computing integration with the Internet of Services, and proposes cloud-based security networks. The initiative states that automated real-time production is pioneered in Germany, but it does not specify with specific examples how real-time can be integrated in I4.0 and cognition is only mentioned, but not applied. The main criticism for Industrie 4.0 is that it does not state recovery plans.

In the case study, despite the lack of detail in the required categories, we include the Russian National Technology Initiative (NIT) (ASI 2016) because of its significates in futuristic projections for I4.0 adoption. NIT represents more of a long-term forecasting for I4.0. The focus is on market network creations, and contributes with new insights to I4.0 by arguing that market creation for new technologies is the key to the future businesses and supply chain integration in I4.0. Similar argument that value capture processes should be focused on the ecosystem, is also present in literature (Metallo et al. 2018). But the forecasting does not address the issues of real-time cloud networks, and critically, does not provide recovery planning.

Categorising the I4.0 design principles emerging from the case study

These initiatives and their technological trends are applicable to SME’s and to large enterprises. To identify the most prominent categories that apply to SME’s supply chains, the comparative analysis applied the grounded theory approach to study and analyse the emerging trends and to organise into related categories and sub-categories. Through comparative analysis, a number of shortcomings in individual initiatives are identified. These shortcomings are addressed with the grounded theory design process of sub-categorising to the complimenting categories from the emerging I4.0 principles from the pre-selected 5 technological trends. More complicated problems emerge when the comparative analysis in Table 7 identifies that some of the national strategies propose very different approaches. The comparative analysis in Table 7 also identifies a number of gaps in national initiatives. By gaps, we refer to topics or a technological trends not incorporated in the associated national initiative.

Table 7 Design principles emerging from the case study

To resolve these gaps, individual areas are used as reference categories for building the analytical framework (which is presented later in Fig. 3) that relates various areas and eliminates conflicts in different and sometimes contrasting I4.0 approaches. Following the grounded theory approach (Glaser and Strauss 1967), the main categories of each individual initiative are separated into subcategories in Table 2 according to the gaps in their design principles.

Analytical framework and a transformational roadmap

The analytical framework development builds upon the taxonomic review of literature and starts with organising the most prominent categories of emerging approaches in literature. This process of organising concepts into categories, follows the grounded theory approach (Glaser and Strauss 1967) and the open and categorical coding approach (Goulding 2002). Discourse analysis is applied to evaluate and interpret the meanings behind the categories (Eriksson and Kovalainen 2008), supported with tables of evidence (Eisenhardt 1989) and conceptual diagrams (Miles et al. 1983) to present graphical analysis. The methodological approach is described in more details in Chapter 3 and in this chapter is focused on enabling SME’s practitioners to identify the value of the proposed theoretical concept. The process of interpreting the connotation behind the categories, the tables of evidence and the conceptual diagrams are aimed specifically to present methodological approach with graphical analysis for SME’s practitioners, as they normally need rather hands-on recommendations.

Pursuit of theoretical validity through case study research

In pursuit of theoretical validity, the methodological approach with graphical analysis was presented on the case study group discussions with experts from industry. The case study design primarily contributed to the process of identifying a hierarchical organisation of the methodological approach.

The graphical analysis was used as a tool during the group discussions to verify the themes, categories and subcategories and their hierarchical relationships. The group discussions included two different centres from Fujitsu: Artificial Intelligence and Coelition; and four different Cisco research centres: First Centre: Security and Trust Organisation, Second Centre: Advanced Services, Third Centre: Security Business Group, Fourth Centre: Cisco Research Centre. For the group discussion, the study recruited 20 experts and distinguished engineers. This approach to pursuing validity follows recommendation from existing literature on this topics (Axon et al. 2018; Eggenschwiler et al. 2016; Müller et al. 2018). The methodological approach advances conceptual clarity and provides clear definitions that specify the unit of analysis for digital platforms. These are identified as recommended areas for further research in recent literature (de Reuver et al. 2017).

Design principles for I4.0 supply chains

We place an emphasis on a cognitive I4.0 analytical framework. A cognitive I4.0 framework refers to the trend of automation, introduced by computing devices that are reasoning and making supply chain decisions for humans. The emerging applications and technologies are presented in the form of a grouping diagram (Fig. 1) to visualise the required concepts for the integration of SME’s supply chains in I4.0.

Fig. 1

Iterative learning and improvement in design principles – synthesised from the taxonomic review

The grouping of concepts starts with the most prominent categories emerging from the taxonomy of literature: (1) self-maintaining machine connection for acquiring data and selecting sensors; (2) self-awareness algorithms for conversion of data into information (Ghirardello et al. 2018); (3) connecting machines to create self-comparing cyber network that can predict future machine behaviour (Anthi et al. 2018); (4) generates cognitive knowledge of the system to self-predict and self-optimise, before transferring knowledge to the user (Madaan et al. 2018, 5) configuration feedback and supervisory control from cyber space to physical space, allowing machines to self-configure, self-organise and be self-adaptive (J. Lee et al. 2015).

Following the methodology for reliable representation of the data collected, open coding is applied (Goulding 2002) to the emerging categories for recovery planning in Fig. 1. The conceptual diagram in Fig. 1 present graphical analysis of the emerging design principles for cognition in IIoT digital supply chains. The emerging design principles in the conceptual diagram, also address the recommended gaps in recent literature on advancing methodological rigour by employing design research and visualisation techniques (de Reuver et al. 2017), such as the graphical analysis in the figure. The elements in the diagram emerge from the reviewed I4.0 technological trends, national initiatives and frameworks reviewed (Table 1) and the links between the elements emerge from the design principles identified in the case study (Table 2) for SME’s supply chains in I4.0.

The findings in Fig. 1 present the first stage of designing a dynamic and self-adapting system supported with artificial intelligence and Machine Learning (AI/ML) and real-time intelligence for predictive cyber risk analytics (PETRAS 2020).

The described principles represent the beginning of a cognitive architecture for I4.0 supply chains. Such cognitive architecture allows for learning algorithms and technologies to be changed quickly and re-used on different platforms (Brettel et al. 2016; Niggemann et al. 2015), for creating multi-vendor production systems (Weyer et al. 2015) which is necessary for the I4.0 supply chains. A cognitive production systems would provide real-time synchronised coexistence of the virtual and physical dimensions (Shafiq et al. 2015).

The emergence of cognition, confirms that I4.0 supply chain design requires multi-discipline testing and verification (Balaji et al. 2015), including understanding of system sociology (Dombrowski and Wagner 2014), because it operates in a similar method with social networks (Bauer et al. 2015; Wan et al. 2015). In the I4.0 supply chains, machines should connect and exchange information through networks (Toro et al. 2015) providing optimised production and inventory management (Lee et al. 2015; Wan et al. 2015; Weyer et al. 2015), and CPS lean production (Kolberg and Zühlke 2015).

Cognitive architecture principles for recovery planning in I4.0 supply chains

I4.0 is expected to evolve from the traditional supply chain network into digital supply chain networks (Taylor et al. 2018). For digital supply chains to be considered secure and to ensure digital recovery planning is adequate, the supply chains need to be self-aware (Radanliev et al. 2019a, 2019b, 2019c, 2019d, 2019e, 2019f, 2019g, 2019h, 2019i, 2019j, 2019k, 2019l, 2019m, 2019n), because a single failure could trigger a complex cascading effect, creating wide-spread failure (Breza et al. 2018).

Adding to this, distributed energy resource technologies such as wind power, create additional stress and vulnerabilities (Ahmed et al. 2013; Marwedel and Engel 2016). To ensure supply chains to be considered secure and to ensure digital recovery planning is adequate, advanced power electronics and energy storage are required for coordination and interactions (Leitão et al. 2016; Marwedel and Engel 2016; Rajkumar et al. 2010), as well as physical critical infrastructure with preventive and self-correcting maintenance (Brettel et al. 2016; Leitão et al. 2016; Zhu et al. 2011).

Following the methodology for recognising the profounder concepts in the data (Goulding 2002), categorical coding is applied as a complimenting method for grounded theory (Charmaz 2006) to compare the emerging categories for recovery planning with the categories in the taxonomic review. In this process, discourse analysis is applied to interpret the data (Eriksson and Kovalainen 2008), behind the explicitly stated categories in the taxonomic review, resulting in explicitly stated categories for recovery planning in Fig. 2. The links between the elements in Fig. 2 emerge from applying the grounded theory approach to relate the findings from the literature with the reviewed I4.0 technological trends, national initiatives and frameworks reviewed (Table 1) and the links between the elements as confirmed in the design principles (Table 7) and presented in Fig. 1.

Fig. 2

I4.0 target state for integrating IIoT in digital supply chains

The conceptual diagram in Fig. 2 provides SME’s with a bird’s eye view of an I4.0 target state for integrating IIoT in SME’s digital supply chains. The target state diagram advances an earlier approaches (Shaw et al. 2004) and presents the smart capability functions at a strategic, business process and technical level. This presents the second stage of designing a dynamic and self-adapting system supported with artificial intelligence and Machine Learning (AI/ML) and real-time intelligence for predictive cyber risk analytics (PETRAS 2020). This will enhance capacities and assist in the creation of a comprehensive and systematic understanding of the opportunities and threats that arise when edge computing nodes are deployed, and when AI/ML technologies are migrated to the periphery of the internet and into local IoT networks.

Challenges for IIoT integration in industry 4.0 supply chains

Apart from recovery planning, other challenges found in literature for SME’s integration in Industry 4.0 supply chains are:

• a) robustness, safety, and security (Akinrolabu et al. 2019; Brass et al. 2018; Brass et al. 2019; Hahn et al. 2013; Nicolescu et al. 2018a; Zhu et al. 2011);

• b) control and hybrid systems (Agyepong et al. 2019; Leitão et al. 2016; Nurse et al. 2018; Shi et al. 2011);

• c) computational abstractions (Ani et al. 2019; Madakam et al. 2015; Radanliev et al. 2018b; Rajkumar et al. 2010; Wahlster et al. 2013);

• d) real-time embedded systems abstractions (Ghirardello et al. 2018; Kang et al. 2012; Leitão et al. 2016; Marwedel and Engel 2016; PETRAS 2020; Shi et al. 2011; Tan et al. 2008);

• e) model-based development (Bhave et al. 2011; Jensen et al. 2011; Rajkumar et al. 2010; Shi et al. 2011; Taylor et al. 2018; Wahlster et al. 2013); and

• f) education and training (Faller and Feldmüller 2015; Nicolescu et al. 2018b; Petar Radanliev et al. 2020; Rajkumar et al. 2010; Wahlster et al. 2013).

These challenges present the difficulties SME’s face. SME’s need protection across a range of new technologies, while attackers only need to identify the weak links (Anthi et al. 2019; Van Kleek et al. 2018). This reemphasises the need for recovery plans, which is not explicitly covered in the I4.0 initiates from the case study.

Future technologies for SME’s integration in industry 4.0 supply chains

Finally, the SME’s need to plan for the adoption of future technologies, to reduce cost and ensure compliance with technological updates in their supply chain. Future technologies include the deployment of self-sustaining networked sensors (Rajkumar et al. 2010) and Cloud centric supply chains (Gubbi et al. 2013), symbiotic with the physical environment (Pan et al. 2015), creating eco-industrial by-product synergies (Pan et al. 2015; Stock and Seliger 2016). Such supply chains would be supported with self-adapting distributed integrated-decentralised architecture (Stojmenovic 2014; Wan et al. 2015), enabling applications to self-adjust and self-optimise own performance (Brettel et al. 2016; Shafiq et al. 2015). Where individual contract-based design is applied before platform-based design (Sangiovanni-Vincentelli et al. 2012), enabling multiple models of computation to act as a single system (Benveniste et al. 2010; Bhave et al. 2011).

Transformational roadmap for SME’s supply chain design in I4.0

Here, we propose a transformational roadmap (Fig. 3), where individual concepts describe larger blocks of the I4.0 supply chains. The design initiates with applying the categories and sub-categories from the taxonomy and the emerging standards from the case study that are affecting SMEs supply chains in the I4.0 (Table 2). Then applying the grounded theory approach and following the recommendations from the literature reviewed, to relate the most prominent categories and its related subcategories into conceptual diagrams. This design processes integrates the categories and captures the best practices in industry. This methodological design process follows recommendations from literature (Strader et al. 1999), and shows how individual components can be integrated into an information infrastructure, with the technologies that can fit within the proposed transformational roadmap.

Fig. 3

Analytical framework based on taxonomic/cladistic format: transformational roadmap for supply chain integration in I4.0

The synthesised categories and sub-categories in the transformational roadmap are related to the gaps from the taxonomic review. For instance, the categories emerging from the taxonomic review, and compounded to address the identified gap, before being hierarchically structured and organised in a step by step method. The transformational roadmap embodies a process of supply chain design decomposition, starting with a bird eye view of the synthesised models on businesses and supply chain design. Followed by the synthesised knowledge from the taxonomic review and the case study, embodied to SMEs supply chains in the I4.0. The transformational roadmap design in Fig. 3 embodies a process of ideas and concepts conceived as an interrelated, interworking set of objectives and applies directive, conventional and summative analysis to relate the recovery planning with the design categories. The transformational roadmap design integrates the findings from literature review on recovery planning, with the findings from the case study and relates recovery planning with principles represented in the categories for SME’s supply chain networks in I4.0.

The principles for SME’s supply chain networks in I4.0 supply chains are related to the findings and the gaps identified in the taxonomic review of the earlier supply chain integration models before I4.0. The findings are specifically related to advancing and generalising the previous case specific work on the implementations of Internet-enabled collaborative e-supply-chain initiatives (Pramatari et al. 2009) and integrated electronic supply chains (Yen et al. 2004). Then the findings and the gaps identified in the case study of the I4.0 initiatives and their technological trends (e.g. that recovery plans are not explicitly provided in such initiatives) are addressed with specific action objectives from the taxonomic review.

The logic behind the steps in Fig. 3 represents the current understanding of the academic and industry papers and publications reviewed in this article. The choice and sequence of steps is supported by the taxonomic review in chapter 3 and the analysis of the I4.0 technological trends, national initiatives and frameworks in chapter 4. The rationale as to why the particular steps and their proposed sequence are chosen derive from the design principles in Fig. 1 and the target state in Fig. 2. In addition, the transformational roadmap in Fig. 3 encompasses material and understanding derived from review and analysis of 173 academic and industry papers, analysed with the grounded theory approach to ensure the work is repeatable and is verified with the rigour of a time tested and established method for conducting a systematic review of literature.

The transformational roadmap in Fig. 3 evaluates the relationship between the IIoT technological trends and derives with a process of digitalising SME’s supply chain. The transformational roadmap recommends the development of cognitive supply chain principles that enable storing and sharing knowledge. This is of specific relevance to SME’s because SMEs and large enterprises do not have the same recourse and using existing knowledge enhances the I4.0 adaptation process in SME’s. Figure 3 presents the final stage of the conceptual designing a dynamic and self-adapting system supported with artificial intelligence and Machine Learning (AI/ML) and real-time intelligence for predictive cyber risk analytics (PETRAS 2020). By integrating AI/ML in the risk analytics, we devise a new approach for cognitive data analytics, creating a stronger resilience of systems through cognition in their physical, digital and social dimensions. It is expected that Web Science will be increasingly more present in the physical world because of smart and connected devices (De Roure et al. 2019a, 2019b). Our approach resolves around understanding how and when such connections causes compromises to happen, and to enable systems to adapt and continue to operate safely and securely when they have been compromised. Cognition through AI/ML is the key topic of this research and cognitive real time intelligence would enable systems to recover and become more robust.

The transformational roadmap structures the principles for recovery planning in SME’s digital supply chains. The principles present the explicit relationships derived from the taxonomies and the case study. The explicit relationships between the principles for recovery planning in cognitive IIoT supply chain networks, enables the assessment of individual technical risk for a given vulnerability. Through a visualisation of the explicit relationships in digital SME’s supply chains, the technical risk for a given vulnerability can be better assessed, e.g. by applying the Common Vulnerability Scoring System (CVSS) (CVSS 2019).

The analytical framework also considers the issues with adoption, as it seems that in most of the reviewed literature everyone tries to create their own model. The taxonomic review and the case study identified the gaps in existing models, and the transformational roadmap made the solutions visible in an explicit format. The transformational roadmap in this paper, however, is dependent on given vulnerability being assessed by existing cyber risk assessment models (e.g. CVSS, 3.1) and analysed with existing cyber risk analysis models (e.g. FAIR-U tool). Hence, the analytical framework is promoting the development of a generally accepted cyber security framework; this is also called for in current research work (FAIR 2020). The analytical framework represents a generic reusable approach, to be used by SME’s for supply chain strategy development for I4.0 by supply chain stakeholders and practitioners.

The analytical framework in Fig. 3 connects the supply chains and the impact of cyber risk to human-computer interactions in different supply chain management systems with artificial intelligence. This can provide supply chain predictive feedback sensors. These feedback sensors would represent dynamic real time data mechanisms that assist and enable better understanding of the problem - prior to cyber-attacks. The reliability of cyber risk impact assessments could increase significantly if decisionmakers have a dynamic and self-adopting AI enhanced feedback sensors to assess, predict, analyse and address the risks of cyber-attacks in the supply chain.

The analytical framework in Fig. 3 firstly identifies and articulates some of the possible supply chain solutions for the role of machine learning (ML) in designing dynamic automated predictive feedback cognitive system, supported with real-time intelligence. Secondly, the analytical framework in Fig. 3 identifies cyber risk analytic approaches with dynamic real-time and ML self-adapting enhanced technologies that enable predictive risk analytics.

In doing this work we are acutely aware that adding automation and further coupling to a distributed system also brings new opportunities for cascading effects and exposing new attack surfaces. These concerns are fundamental to the cognition engine design, especially in the areas with increased automation of processes which have classically required human interaction.

Furthermore, in terms of the (un) availability of data, lessons can be learned from previous research on data strategies (Radanliev et al. 2019b). The volume of data generated creates diverse challenges for developing data strategies in a variety of verticals (ex. AI/ML, ethics, business requirements). Simultaneously, designing a supply chain cyber security architecture for complex coupled systems, while understanding the impact, demands data strategy optimisation and decision making on collecting and assessment of probabilistic data when edge computing nodes are deployed, presents a socio-technical research problem. The research is also strongly related to personal perceptions of risk because of collecting probabilistic data at the edge interact with data regulations, standards and policies. These data perceptions, regulations and policies are strongly considered in our approach for integrating ML in supply chain cyber risk data analytics. A cybersecurity architecture for impact assessment with ML cyber risk analytics must meet public acceptability, security standards, and legal scrutiny. With consideration of the above, the research integrated areas such as impact, policy and governance recommendations, while continuously anticipating aspects of computer science to develop and design architectures for ML in supply chain cyber risk data analytics. The research contributes to knowledge by integrating supply chain management with ML and cyber risk analytics that have not been previously integrated in a research on securing supply chains, and thus promote the field of developing a dynamic and self-adopting methodology to assess, predict, analyse and address the risks of cyber-attacks in the supply chains.

Discussion and main findings

The study applies taxonomic review and case study research to derive with the design principles for a analytical framework with a transformational roadmap that enables the process of integrating SME’s business and supply chains in the I4.0 network. The analytical framework captures the best practices in industry, and defines the differences and similarities between I4.0 technological trends. Major projects on I4.0 are reviewed to present the landscape for cutting edge developments in IIoT, offering us a comprehensive picture of the current state of supply chain adoption.

The analytical framework and the transformational roadmap do not address the aspect of people but instead the focus is on the process aspects of Industry 4.0. While the people aspects are important given the general shortage of individuals with appropriate digital skills, this problem has been addressed by some countries e.g. Australia with a points-based system for attracting people with appropriate digital skills. The process aspects were determined as more important because Industry 4.0 is going to require changes in business practices (and hence processes), and there are multiple approaches to structuring such processes as identified in the case study of I4.0 initiatives. Creating a unified approach to process, with a step-by-step transformational roadmap was missing in academic and industry literature. The design principles in Fig. 1, the target state in Fig. 2 and the transformational roadmap in Fig. 3 derive from the analysis of the state-of-the-art literature and the leading I4.0 initiatives, presenting a unified approach to process development.

Main findings pertaining to the analytical framework

Standardisation reference for I4.0 supply chains

The I4.0 adoption pertains:

• a) Standardisation reference architecture (Ahmed et al. 2013; Petar Radanliev et al. 2020; Stock and Seliger 2016; Wahlster et al. 2013; Weyer et al. 2015).

• b) Existing I4.0 architectures (Giordano et al. 2016; Hermann et al. 2016; Lee et al. 2015), lack clarification on designing individual components of I4.0 supply chains.

• c) Despite the strong interest in literature and industry for designing I4.0 and cyber risk standardisation reference architectures, this is the first attempt to integrate various academic models with industry and government initiatives.

The design principles of the analytical framework demystify this, by comparing models from academic literature with major projects from industry/governments and clarify individual levels of I4.0 supply chain design.

Cloud integration of CPS and IIoT of SME’s in the I4.0 supply chains

The SME’s need to:

• d) Integrate cloud technologies in their supply chains (Giordano et al. 2016; Ribeiro et al. 2010; Shafiq et al. 2015; Thramboulidis 2015; Wahlster et al. 2013).

This study derives with the determining factors for an IIoT approach within Supply Chain Management in I4.0, with the focus on SME’s cloud technologies. Some of the direct recommendations in the design principals include the deployment of self-sustaining networked sensors and Cloud centric supply chains, symbiotic with the physical environment.

Real-time CPS and IIoT in I4.0

The SME’s digital supply chains need to:

• e) Encompass the security and privacy (Anthonysamy et al. 2017), along with electronic and physical security of real-time data (Agyepong et al. 2019).

The findings from this study enable SMEs to integrate IIoT in their I4.0 businesses and supply chains with a step-by-step transformational roadmap. The transformational roadmap includes the design principles and outlines the process for integrating SME’s with real-time enabled IIoT in the I4.0 supply chains.

Autonomous cognitive decisions for CPS and IIoT in I4.0

In the I4.0 supply chains, machines should:

• f) Connect and exchange information through cyber network and be capable of autonomous cognitive decisions (Kolberg and Zühlke 2015; J. Lee et al. 2015; Toro et al. 2015; Wan et al. 2015; Weyer et al. 2015).

Existing literature lacks clarification on how such automation can be designed in the context of I4.0 supply chains. The study derives with design principles for cognition in digital IIoT supply chains and an I4.0 target state for integrating IIoT in digital supply chains.

Cyber risk concerns

The SMEs need security measures to protect themselves from a range of attacks in their supply chains, while cyber attackers only need to identify the weakest links. Hence, the cyber risk creates a disadvantage for SMEs as they need to invest a great deal of resources into cyber protection and recovery planning. The transformational roadmap enables SME’s to visualise and charts them on the path to beginning to address the cyber risk. While SMEs need to embrace the I4.0 in their supply chains, but SMEs also need to be aware of the inherent cyber risks. The taxonomic review and the case study in this study, emphasised the vast areas of cyber risk and brought the attention on cyber recovery.

Cyber risk assessment problems

The weakness of existing cyber risk impact assessment models is that the economic impact is calculated on organisations stand-alone risk, ignoring the impacts of sharing supply chain infrastructure (J. Nurse et al. 2017; Radanliev et al. 2018a, 2018b, 2018c; Petar Radanliev, De Roure, Nurse et al. 2018). In addition, there is an inconsistency in measuring supply chain cyber risks, which is caused by the lack of understanding of supply chain operations in I4.0. This study enables the process of visualising the shared risk in supply chains. The visualisation of such risks is vital for calculating and planning for the impact to the SMEs operating in the I4.0.

Recovery plans for CPS and IIoT in I4.0

Clarity on disaster recovery plans is missing in all of the I4.0 technological trends analysed in the case study, with no explanation on details or on how recovery planning would be executed. This is of concern as in the literature the recovery planning is strongly emphasised. The analytical framework derives with direct recommendations that would improve the response and recovery planning in the SME’s supply chains. Some of the recommendations include the need for feedback and control mechanisms, supervisory control of actions, and dynamics anti-malicious and anti-tamper control.

Conclusion

By integrating AI/ML in the risk analytics, in this article we devise a new approach for cognitive data analytics, creating a stronger resilience of systems in their physical, digital and social dimensions. Our approach resolves around understanding how and when compromises happen, to enable systems to adapt and continue to operate safely and securely when they have been compromised. Cognition through AI/ML is the key topic of this research and cognitive real time intelligence would enable systems to recover and become more robust.

This paper identifies a dynamic and self-adapting system supported with AI/ML and real-time intelligence for predictive cyber risk analytics. This will enhance national capacities and assist in the creation of a comprehensive and systematic understanding of the opportunities and threats that arise when edge computing nodes are deployed, and when AI/ML technologies are migrated to the periphery of the internet and into local IoT networks.

We used a series of new design principles to derive a transformational roadmap and a new analytical framework for the SME’s supply chains integration in I4.0. Despite the strong interest in the value for SME’s supply chain from IIoT and I4.0, this research represents the first attempt to synthesise and compare knowledge from literature with expert’s opinions. This knowledge was applied to design a step by step approach for the SME’s supply chains integration with IIoT technologies in the I4.0. In the design process, the SME’s supply chain networks are related to the I4.0 initiatives and their technological trends.

The research discovered that successful adaptation of IIoT technologies, depends largely on the cyber recourses. This specifically concerns SME’s as they do not have the same supply chain recourses as large enterprises. The new design enables SME’s to visualise the required cyber resources and the integration process and the transformational roadmap the integration process of IIoT technologies consolidated in the cyber themes of the future makeup of supply chains. The analytical framework can also be applied to visualise and assess their exposure to cyber risk and to design cyber recovery. This visualisation also supports policy development by decomposing operational system with concrete and workable action plans, that would transition the economic and social systems towards new cyber capabilities.

At a higher analytical level, the article presents new design principles, a transformational roadmap and a new analytical framework, for small and medium enterprises to approach the new supply chains technological challenges in industry 4.0. The research’s insights are based on a literature analysis, case study research and a grounded theory methodology. The validation of these research results was checked with experts from two corporations, Cisco Systems and Fujitsu. The case study is also informed by the sustained engagement of the UK EPSRC IIoT Research Hub PETRAS¹ with a broad set of user partners for a wide range of private sectors, government agencies, and charities at international scale.