Security-Constrained Graph Neural Clustering for Industrial Manufacturing Systems under OT and Hardware Constraints

Abstract

Industrial manufacturing systems increasingly rely on tightly coupled operational technology (OT) networks and heterogeneous hardware platforms, which exposes them to sophisticated multi-stage cyber attacks that propagate across devices, control logic, and production processes. Existing graph-based security analytics often overlook OT process semantics and hardware constraints, resulting in unstable clustering results and limited practical deployability. This paper proposes a Security-Constrained Graph Neural Clustering framework for industrial manufacturing systems that explicitly incorporates OT semantics and hardware constraints into attack-chain analysis. The manufacturing environment is modeled as a heterogeneous graph integrating OT assets, communication and control relationships, process-stage dependencies, and device-level resource limitations. A security-oriented clustering objective is designed to aggregate related assets into attack-chain communities while enforcing OT-consistent propagation and hardware-feasible inference. The proposed framework further enhances robustness under incomplete or noisy telemetry and provides interpretable community-level risk indicators to support security operations. Experimental results on industrial manufacturing datasets demonstrate that the proposed approach achieves more coherent and stable attack-chain communities than representative baselines, while maintaining computational efficiency suitable for deployment in resource-constrained OT environments.