bilevel network interdiction

BILEVEL NETWORK INTERDICTIONMODELS: FORMULATIONS ANDSOLUTIONS

R. KEVIN WOODDepartment of Operations Research,

Naval Postgraduate School,Monterey, California

INTRODUCTION

A dictionary definition of interdict, in themilitary sense, is

to destroy, cut or damage by ground or aerialfirepower (enemy lines of reinforcement,supply, or communication) in order to stop orhamper enemy movement and to destroy orlimit enemy effectiveness [1].

This definition is unnecessarily restrictivefor instance, it should also include ship-basedfirepowerbut the essence is reasonable:interdiction connotes preemptive attacksthat limit an enemys subsequent abilityto wage war, or carry out other nefariousactivities. The mathematical study of inter-diction has focused primarily on networkinterdiction, in which an enemys activitiesare modeled using the constructs of networkoptimization (e.g., maximum flows, multi-commodity flows, and shortest paths), and inwhich attacks target the networks compo-nents to disrupt the networks functionality.Depending on the type of network, tar-geted components can include bridges, roadsegments or interchanges, communicationslinks or switches, and so on. This articlefocuses on the bilevel network interdictionproblem (BNI), but the reader should notethat much of the presentation extends tointerdiction of more general systems.

Examples of what we now call networkinterdiction date from antiquity. Herodotus[[2] 9.4950] describes how the Persian cav-alry (in 479 BC) cut Greek supply lines androutes to water sources in a battle near the

Wiley Encyclopedia of Operations Research and Management Science, edited by James J. CochranCopyright 2010 John Wiley & Sons, Inc.

Greek city of Plataea; Livy [3, 22.8] reportsthat (in 218 BC) the Roman Senate orderedbridges near Rome to be destroyed to slow theadvance of Hannibal and his troops; Polybius[4, 9.7] gives a different chronology for thelatter incident, but the interpretation as net-work interdiction remains. Two millennialater, the American Civil War is replete withexamples of both Confederate and Unionforces attacking roads, bridges, rail lines,and telegraph lines to hamper the enemysresupply, movement, and communications [5,Chapter 4]. In World War II, German sub-marines interdicted, that is, sank, hundredsof Allied petroleum tankers that were travel-ing the sea lanes of the Atlantic Ocean andelsewhere [6, Appendix 17].

Allied bombing attacks during World WarII on German-controlled oil refineries andsynthetic-fuel plants exemplify a more gen-eral type of system interdiction or economicwarfare. The German military was crippledby the lack of fuel and lubricants caused bythe Oil Plan, as the attack strategy wascalled. Interestingly, an acrimonious debatewas waged between the proponents of the OilPlan (system interdiction) and proponentsof the Rail Plan (network interdiction).The Rail Plan sought to destroy rail linesand other transportation assets in Europeto restrict the movement of the Germantroops and equipment that would counter theAllied D-Day offensive. Ultimately, parts ofboth plans were implemented [7, pp. 7578,174175].

Network interdiction is an important partof modern warfare where attacks on keycivilian and military infrastructure can helpreduce an enemys fighting effectiveness,while incurring only limited casualties tofriendly forces [8,9]. When planning forsuch attacks, the interdictor is typicallyfaced with this question: Given limited attackresources and possibly other restrictions(e.g., political considerations), which networkcomponents should be attacked to reducethe enemys war-fighting capabilities mosteffectively? BNI addresses this question.

1

2 BILEVEL NETWORK INTERDICTION MODELS: FORMULATIONS AND SOLUTIONS

To provide background on the modern,mathematical study of network interdiction,we first make the following definitions andassumptions [10]:

1. The interdictor, called attacker here-after, acts first by using limited inter-diction resources to attack componentsof his enemys network.

2. The enemy, or defender, observes thedamage caused by the attack(s) andthen operates the damaged network soas to maximize his own, well-definedobjective-function value.

3. The attacker understands the defen-ders capabilities and goals, and choosesattacks that minimize the defendersmaximum achievable objective-func-tion value.

These standard assumptions lead to the for-mulation of BNI and more general system-interdiction models as a type of Stackelberggame: a two-person, zero-sum, sequential-play game with two stages [11,12].

Wollmer [13] studies the problem of find-ing the single most vital link in a capaci-tated flow network, in his case, the arc whosedeletion minimizes the maximum s-t flow inthe network. (The reader who is unfamil-iar with the terminology of network flows,e.g., s-t flows, may wish to consult a stan-dard text such as Ahuja et al. [14].) Here, theattacker has enough interdiction resource toattack and destroy exactly one arc, and thedefenders objective is to maximize s-t flow.Wollmers work may represent the earliestmathematical investigation of an instance ofBNI, although as early as 1955 researcherswere investigating a simpler single-levelnetwork interdiction problem that seeks toeliminate all s-t flow efficiently [15].

Danskin [16] presents some of thefundamental theory of maxmin models,which may be viewed as a generalizationof BNI to system interdiction. (His minand max are reversed compared to ourconvention). Confusingly, maxmin andsimilar terms are also used in the contextof the more common two-person, zero-sum,simultaneous-play games [17, pp. 143165].For example, von Neumann [18] proves thefamous minimax theorem for such games.

Mathematical studies of BNI began inearnest during the Vietnam War, withmodels applied to disrupt the flow of enemytroops and materiel [19,20]. Fulkerson andHarding [21] and Golden [22] investigatethe problem of maximizing the length ofthe shortest path in a networkto slowenemy reinforcements, sayusing modelsin which the length of each network arc canbe increased linearly, within limits, based onthe amount of interdiction resource appliedto it. (This is a maxmin variant of BNI.)These models are solved as parametric linearprograms (LPs). The k-most-vital-arcs prob-lem [23,24] is similar, but at most k arcs maybe interdicted and interdiction decisions arediscrete. In particular, an arc is attacked anddestroyed and its length becomes infinite,or it is left untouched and keeps its nominallength. Ball et al. [25] show that problem to beNP-complete. Israeli and Wood [26] extendthe k-most-vital-arcs problem to generalresource constraints: their study of the theshortest-path network interdiction problem(or maximizing the shortest path), makesimportant theoretical and computational con-tributions to the solution of BNI, in general.

Ratliff et al. [27] extend Wollmers [13]model to the problem of finding a set of narcs in a capacitated network whose deletionminimizes the maximum s-t flow. Whileinvestigating problems of drug interdiction,Wood [28] generalizes that model to allowgeneral interdiction resource constraints.(Phillips [29] considers a similar model, butallows some continuous interdiction effort;see also Steinrauf [30].) Wood shows that thismaximum-flow interdiction problem is NP-complete, even when attacks are constrainedonly in cardinality. Thus, even the simplermodel of Ratliff et al. appears to be difficult.

More general system-interdiction issuesarise in the work of Grotschel et al. [31] andMedhi [32] who seek to evaluate the vulnera-bility of information networks to interdiction.Chern and Lin [33] study the interdictionof a system represented as a minimum-costnetwork-flow model.

Similar to the BNI studied by Wood[28], the network interdiction model ofWashburn and Wood [34] aims at disruptingdrug smuggling, and its efficient solution

BILEVEL NETWORK INTERDICTION MODELS: FORMULATIONS AND SOLUTIONS 3

involves maximum flows. But this is atwo-person, zero-sum, simultaneous-play(Cournot) game, and its purpose is quitedifferent from BNI. Specifically, an interdic-tor controls one or more inspectors whomust be placed strategically on the arcs ofa transportation network to maximize theprobability of detecting a drug smuggler mov-ing surreptitiously through that network.(If the smuggler traverses arc k when aninspector is present, the smuggler is detectedwith known probability pk; otherwise he goesundetected.) In a simultaneous-play model,neither player can observe the others actionsbefore acting himself and, consequently, solu-tions define probabilistic (mixed) strategiesfor both players. In this case, the interdictorsstrategy defines a probability distributionover the inspectors locations, and thesmugglers strategy defines a probability dis-tribution over paths through the network. Incontrast, a solution to BNI prescribes deter-ministic (pure) strategies for both players.

Deterministic strategies do not implythat BNI cannot incorporate uncer-tainty and probability, however. Cormicanet al. [35] develop stochastic-programmingversions of the maximum-flow interdictionmodel to handle uncertain interdictionsuccesses and uncertain arc capacities.Whiteman [36], studying interdiction prob-lems faced by the US Strategic Command,addresses uncertainty through Monte Carlosimulations of maximum-flow interdic-tion models. Pan et al. [37] maximize theexpected probability of detecting a smugglertrying to transport stolen nuclear materialsout of a country: nominal probabilities ofdetection can be improved by installing alimited number of radiation detectors atborder crossings. Maximizing probability ofdetection is related, through a logarithmictransformation in the objective function, toshortest-path interdiction, and in that sensethe model is deterministic. The model isstochastic, however, in that a probabilitydistribution describes the smugglers originin the network [38].

Brown et al. [39,10] develop a taxon-omy for bilevel system-interdiction andsystem-defense models, as well as for trilevelsystem-defense models. The bilevel and

trilevel models are two-stage and three-stageStackelberg games, respectively. BNI is aninstance of a two-stage attackerdefendermodel; the trilevel defense models aredefenderattackerdefender models. Inthe latter case, a defender wishes to employhis limited defensive resources as efficientlyas possible to interdict the interdictor,with effectiveness being evaluated by solv-ing a bilevel interdiction model. Bilevelsystem-defense models can be constructed,also: these are defenderattacker models;they apply when the value of attackinga system component is a fixed or easilycomputed value; they can be solved using thetechniques described in this article; but willnot be discussed further. We note that Brownet al. [10,40] also discuss solution techniquesfor all these model types and describe anumber of applications to infrastructureprotection. Indeed, vulnerability analysisfor infrastructure is an important newapplication area for BNI.

Most recently, bilevel interdiction anddefense models have been developed for anumber of interesting applications: theaterballistic missile defense [41], planningattacks on multicommodity flow networks[42], planning attacks on communicationsnetworks [43], delaying the nuclear-weaponsproject of a rogue state [44], and attackingand defending electric-power grids [45]. Thetheory of global Benders decompositiondeveloped in the last paper promises to bea useful computational technique for BNI(and other optimization problems), and isdiscussed later in this article.

The goal of the rest of this article isto describe basic theoretical models andsolution techniques for BNI. A lack of spaceprohibits further detailed discussion ofapplications. More information on advancedcomputational techniques can be foundin Magnanti and Wong [46], Israeli andWood [26], Salmeron et al. [45], and Smithet al. [47].

A BASIC, BILEVEL, INTERDICTION MODEL

In abstract form, BNI may be stated as thefollowing attackerdefender model:


[AD0] minxX

z0(x), where

z0(x) maxyY(x)

f (x,y), (1)

and where (i) x X denotes a binary vector ofattack decisions that is limited by resourcesand perhaps logical restrictions (e.g., targetsk and k both cannot be attacked); (ii)y Y(x) denotes the activities that thedefender will carry on after the attack,typically restricted by effects of the attackx; and (iii) the objective function f (x,y)measures the functionality of the defendersnetwork after the attack. Thus, the attackerseeks to minimize the functionality of thenetwork which the defender is assumed tomaximize. Of course, by switching the minand the max, we can model an attacker whoseeks to maximize the cost of the defendersoperations.

[AD0] is a special case of a Stackelberggame in which a leader (attacker) takes someaction, and a follower (defender) observesthat action and its effects, and then respondsoptimally given that information (12). [AD0]is a two-stage game and is finished after thefollower responds; more general Stackelberggames may have many stages and/or players.

For the sake of concreteness and simplic-ity, further development of [AD0] assumesthat

1. The defenders activities take place onnetwork arcs, which are indexed by k,and there is a one-to-one correspon-dence with the attackers potentialtargets.

2. The defender nominally optimizes net-work operation by solving the followingLP which is feasible for any u 0

maxy

cTy (2)

s.t. Ay b (3)0 y u, (4)

3. Restrictions on the attacker assumex = 0 is feasible, and are representedby

X = {x {0, 1}n | Hx h} , and (5)

4. xk = 1 implies that activity k is attac-ked, its level forced to 0, that is, yk = 0.

Then, defining U = diag(u), [AD0] takeson the following specific form

[ADLP1] z1 = minxX z1(x), where (6)

z1(x) maxy

cTy (7)

s.t. Ay b (8)0 y U(1 x).

(9)

The inner LP in [ADLP1] might repre-sent a simplemaximum-flow problem [27,28],the optimal deployment of the defenderssarmed forces [48], or the production anddistribution of oil or natural gas in a bel-ligerent country [49]. [ADLP1] extends easilyto attacks on nodes, attacks on groups of arcsand/or nodes, attacks that reduce capacityonly partially, and so on, but such exten-sions are straightforward and not consideredhere.

A Stackelberg game with mixed-integervariables and having just two levels of deci-sion making is called a bilevel mixed-integerprogram (BLMIP) [50]. However, the leadersand followers objective functions in a BLMIPare not usually diametrically opposed asthey are in [AD0]; for example, see Bardand Moore [51], Wen and Yang [52], andHansen et al. [53]. In fact, most algorithmsdeveloped for BLMIPs assume a strongpositive correlation between the leadersand followers objective functions. Thus,the theory and algorithms for BLMIPs donot seem well-suited for handling [ADLP1],while the special-purpose methods describedin this article have had demonstratedsuccesses.

Standard LP theory tells us that z1(x) isa concave function in (continuous) x. Thus,[ADLP1] is a difficult, nonconvex minimiza-tion problem. The problem can be convexi-fied, however, by moving x into the objectiveof the inner maximization.

Proposition 1 [54]. Let rk be an upperbound on the optimal dual variable for the


constraint yk uk(1 xk) in [ADLP1] takenover all x X. Let r = (r1 . . . rn)T and R =diag(r), and define

[ADLP2] z2 = minxX z2(x), where (10)

z2(x) maxy

(cT xTR

)y (11)

s.t. Ay b [q] (12)0 y u. [r].

(13)

(The vectors q and r, used later, denote dualvariables for their respective constraint setswhen x is fixed.) Then, [ADLP1] and [ADLP2]are equivalent in the sense that z1 = z2, andx solves [ADLP2] if and only if it also solves[ADLP1].

Note also that z2(x) is a convex function incontinuous x.

That [ADLP2] is equivalent to [ADLP1]is intuitively clear, at least when the rkare strict upper bounds: (x,y) solves[ADLP1] if and only if it also solves [ADLP2].Nonstrict bounds can lead to cases where(x,y) is optimal [ADLP2] but infeasible to[ADLP1]. In this case, however, there mustexist some y such that (x,y) is optimalto [ADLP1].

To solve [ADLP2], (i) temporarily fix thevariables x in [ADLP2] (i.e., treat x as data);(ii) take the dual of the resulting LP; and(iii) then release x. The following, equivalentmixed-integer program (MIP) results:[ADMIP2

]min

xX, q, rbTq+ uTr (14)

s.t. ATq+ Ir+ Rx c(15)

q 0, r 0 (16)

A standard LP-based branch-and-bound algo-rithmwill solve [ADMIP2] if thatmodel is nottoo large.

Good dual bounds r are important forsolving [ADMIP2] directly, but are not easyto come by except in a few instances. Forinstance, if the inner LP in [ADLP] corre-sponds to a maximum-flow model with inte-gral capacity vector u , then rk = 1 is valid

and tight because the value of an extra unitof arc capacity in a maximum-flow problemis 0 or 1 [35]. Theoretically, we could also userk = 100 in this case, but the resulting LPrelaxation of [ADMIP2] would be weak andsolution times would suffer.

The decomposition solution method for[ADLP2] described next does not eliminatethe need for good bounds on dual variables,but ancillary techniques can alleviate someof the difficulties caused by weak bounds,and decomposition has some key advan-tages over a branch-and-bound solution of[ADMIP2].

1. In the context of network interdiction,various studies [55,26], have demon-strated that decomposition typicallysolves [ADMIP2] much faster thandoes branch-and-bound,

2. As we shall see, decomposition can beextended to solve BNI even when thedefenders optimization model is moregeneral than an LP, and

3. Decomposition methods typically solvea sequence of defender subproblemsin a familiar, user-friendly form,which obviates the complicated, unfa-miliar dual constructs of [ADMIP2].For instance, Salmeron et al. [45]evaluate the effects of an attack plan xon a large, regional electric-power gridusing a standard electric-power model.In contrast, a MIP formulation for BNIin this case becomes unwieldy (and canonly be solved for small, unrealistictest problems) [56].

BENDERS DECOMPOSITION

The decomposition algorithm described heremay be viewed as solving [ADLP2] by apply-ing Benders decomposition to [ADMIP2][57]. The Benders methodology for solvinga minimizing MIP first converts the MIPinto a minmax problem by reversing thesteps that we used to create [ADMIP2] from[ADLP2]: (i) temporarily fix the integervariables, (ii) take the dual of the resultingLP, and (iii) release the integer variables [58,pp. 135143]. In the case of [ADMIP2], this


conversion returns us to the more naturalstarting point of [ADLP2].

An optimal solution in y to [ADLP1] occursat an extreme point of the (bounded) feasibleregion of that problems inner LP. Becauseof the essential equivalence of the problems,the same holds true for solutions in y to[ADLP2]. Let Y denote the full, finite set ofextreme points for the latter problem. Then,[ADLP2] may be expressed as this equivalentmaster problem

z2(Y) = minxX z2(x,Y), where

z2(x,Y) maxyY

(cT xTR

)y. (17)

That model has this formulation as a MIP

[ADMP2(Y)]

z2(Y) = minx, z z (18)

s.t. z + yTRx cTy y Y (19)x X. (20)

Benders decomposition dynamically gen-erates constraints (19) called Benders cuts.It solves or approximately solves the originalproblem by finding Y Y, with |Y| then go to Step 1;

Step 3: Print Approximate solution is, x, with objective value,z;Print Provable optimality gap is, z z;Stop;

End of Algorithm A-1.

Algorithm A-1, or simply A-1, is actu-ally a special case of Benders decompositionthat does not require feasibility cuts [59].Such cuts are needed if the subproblems canbecome infeasible for certain x X, whichours cannot by assumption. The correctnessof the algorithm is easy to see: (i) The upperbound z is valid because it corresponds tosome feasible solution of [ADLP2] for theminimizing attacker; (ii) the lower bound z isvalid because it corresponds to a relaxation ofthe equivalent master problem [ADMP2(Y)];(iii) if a solution x ever repeats, it follows thatz = z and the algorithm must terminate; and(iv) the termination criterion is satisfied withz = z or a solution repeats in a finite numberof steps because X is a discrete, finite set.

The following section describes someenhancements to A-1 that may improve

solution speeds, and shows how globalBenders decomposition can actually solvemore general problems than [ADLP2].

IMPROVING AND GENERALIZING BENDERSDECOMPOSITION

Faster Solutions with Super-Valid Inequalities

The (relaxed) master problem [ADMP1(Y)]can be strengthened in some instances byadding super-valid inequalities (SVIs). Intu-itively, this strengthening can help alleviatesome of the difficulties caused by weak dualbounds r. SVIs are similar to valid inequal-ities of integer-programming theory [60, pp.205295] except that they may, and typi-cally do, eliminate feasible solutions from the


master problem. We define SVIs with respectto general MIPs.

Definition. Let x and y denote the vectorsof integer and continuous variables, respec-tively, in aMIP. The inequalitywT1x+wT2y w0 is super-valid for this MIP if (i) addingthat inequality to the MIP does not eliminateall optimal solutions, or (ii) an incumbentsolution (x, y) is (already) optimal for theMIP.

With proper precautions, SVIs may beused within a branch-and-bound algorithmfor [ADMIP2] as well as within Bendersdecomposition for solving [ADLP2]. Suppose,for instance, that we add a single SVI in thecourse of solving a MIP by either technique.If case (i) is true for that SVI, then an optimalsolution will still be found via enumerationbecause (a) some optimal solution is still fea-sible, and (b) any lower bound obtained froma relaxation of the SVI-modified MIP is stilla valid lower bound on z2. Thus, standardfathoming tests within a branch-and-boundalgorithm and the convergence tests in A-1are valid. If case (ii) is true when we addthe SVI, we simply want our algorithm tohalt with a message that the incumbent x

is optimal, and this is easy to arrange. Afteradding the SVI

1. If the MIP is found to be infeasible,or z> z(x), we declare the incumbentoptimal, which it is, or

2. If z z occurs, we declare theincumbent to be -optimal, which itis. (As often happens, our incumbentis optimal, but we only prove it to be-optimal.)

By induction, it follows that an enumera-tion algorithm incorporating a finite numberof SVIs will also terminate correctly andfinitely.

One type of SVI for our enhanced versionof A-1 applied to [ADLP2] is easy to derive.

Proposition 2 [26]. Let z+ yTRx cTydenote a Benders cut from Algorithm A-1being used to solve [ADLP2].

Ik(y) ={1 if yk >00 otherwise. (21)

Then, the following inequality is super-valid:

I(y)Tx 1. (22)

Suppose that R derives from strict dualbounds and that y is the response to thefeasible interdiction plan x. It follows thatyTRx = I(y)Tx = 0, and that x is madeinfeasible by the SVI I(y)Tx 1. That is,the inequality I(y)Tx 1 is not valid in thestandard sense. Note also that x could bean optimal solution which is made infeasibleby the inequality, but if we already havean optimal solution in hand, we have freereign to restrict the solution in any waywe like.

A simple extension of Proposition 2leads to

Corollary 1. For every Benders cut z +yTRx cTy, the SVI of Proposition 2can be tightened to I(y)Tx 2 if cTymaxj rkyk > z, can be tightened to I(y)Tx 3if cTymaxk=k {rkyk + rk yk }> z, and so on.

Of course, as z changes during the course ofA-1, it may be possible to tighten previouslygenerated SVIs.

Modifications of A-1 to incorporate SVIsare straightforward, and SVIs may improvesolution times substantially. Israeli andWood [26] demonstrate this and show howto (i) add heuristically generated SVIs to aninstance of [ADMIP2] to improve branch-and-bound solution times, (ii) generalizeSVIs to -SVIs that guarantee not to elim-inate all -optimal solutions, and (iii) solve[ADLP1] and [ADLP2] in a decompositionalgorithm whose master problem constraintsconsist solely of SVIs. The covering algo-rithm alluded to in (iii) uses no dual boundsr at all, and converts Benders decompositioninto a purely combinatorial procedure.

Standard Computational Enhancements forBenders Decomposition

In addition to employing SVIs, Algorithm A-1can benefit from more standard techniques


used to improve solution speeds for Bendersdecomposition [46]. Some of these techniquesare discussed briefly below.

1. For fixed x, [ADLP2] may havemultiple extreme-point solutions yand a different Benders cut can begenerated for each. Adding too manysuch cuts can slow down solutions of[ADMP2], but adding them judiciouslycan improve solution times greatly.Israeli and Wood [26] use this tech-nique in the shortest-path interdictionproblem, where they enumerate multi-ple shortest paths for a single attackplan x and generate cuts for each.

2. The master problem need not be solvedto optimality if sufficient progress ismade after each cut is added [61].

3. Cuts derived from interior-point sub-problem solutions y may prove betterthan those derived from extreme-pointsolutions. For instance, an arc k with alarge flow yk on it appears as an attrac-tive candidate for interdiction in thesolution of the maximum-flow interdic-tion problem. That is, it generates a cutwith a large-magnitude entry in posi-tion k. But yk may be large primarilybecause the solution is an extreme-point solution, not because it must belarge to achieve amaximum s-t flow. So,A-1 may waste time exploring solutionswith xk = 1. In contrast, an interior-point solution spreads flow aroundthe network, and yk will tend to be largeonly if it needs to be in order to achievea maximum s-t flow. Consequently, bet-ter guidance and better cuts may bederived from such solutions.

4. Some Benders cuts can be dominated(implied) by others, and the nondom-inated ones ought to be used for thesake of efficiency. Magnanti and Wong[46] provide guidance on this topic. Therelated work of Smith et al. [47] mayalso prove useful: that paper showshow a polynomial-sized reformulationof the master problem in an interdic-tion model can yield cuts that dominatean exponential number of cuts from theoriginal formulation.

Global Benders Decomposition

Algorithm A-1 can be extended to solveinstances of [AD0], in which the defendersoperational model is more complicated thanan LP. For example, let [ADIP2] denotea model identical to [ADLP2] except that yis required to be integral. A-1 clearly solvesthis problem because we can replace thefinite set of extreme points Y used to definethe equivalent master problem [ADMP2]with the finite set of integer solutions for[ADIP2]. Geoffrion [62] coins the phrasegeneralized Benders decomposition todescribe extensions of Benders decompo-sition to nonlinear models analogous to[ADLP2] with convex objective functionsz2(x); Salmeron et al. [45] therefore use thephrase global Benders decomposition todescribe the solution of other models like[ADIP2], in which the issues of convexitymay even be irrelevant.

In [ADIP2], rk no longer corresponds toa bound on a dual variable. Rather, thatdatum must comprise an integral part of theoriginal formulation. For instance, [ADIP2]might correspond to a maxmin instance ofBNI in which an attacker seeks to delaycompletion of a defenders project, which ismodeled through the constructs of a resource-constrained PERT network. (Davis [63] dis-cusses such PERT networks, and Brown et al.[40,44] discuss interdicting them.) If xk = 1,task k in the project is attacked and delayedby a fixed amount: that is what rk wouldrepresent in [ADIP2]; otherwise xk = 0 andtask k requires some nominal time to com-plete, corresponding to ck in that model.

We can generalize further.

Proposition 3 [45]. Suppose that BNI hasthe following form:

[AD3] minxX

z3(x), where

z3(x) maxyY

f (x,y), (23)

and where X is defined as in Equation (5),y Y can be discrete and/or continuous, andf (x,y) has a general form. Furthermore, sup-pose that penalty vectors v(x) can be definedso that


z3(x) z3(x) + vT(x)(x x) x, x X.(24)

Then, the following master problem is equiv-alent to [AD3]:

[ADMP3]

minxX, z

z (25)

s.t. z v(x)Tx z3(x) vT(x)x x X

Given the existence of an equivalent mas-ter problem, [AD3] may be solved via a mod-ified version of A-1. We may assume that theattacker has an efficient method for comput-ing z3(x), that is, for evaluating the effects ofan attack plan x through the solution of thedefenders subproblem. For instance, to eval-uate the effects of attack plan x on an electric-power transmission grid, the attacker cansolve a nonlinear AC optimal power-flowmodel or a standard, faster, LP approxima-tion, a DC optimal power-flow model [64].Thus, the difficult part here will be definingand computing appropriate penalty vectorsv(x). That task will be problem-dependent,so we expand upon the power-grid exampleto illustrate.

An attacker wishes to maximize theshort-term, unserved demand for power in adefenders transmission grid. Thus, [ADMP3]must be converted to a maximization prob-lem, and the inequality in Equation (26)reversed. When xk = 0, vk(x) should boundthe amount of unserved demand that willaccrue if the status of grid component k ischanged from unattacked and functionalto attacked and nonfunctional. The power-handling capability of the component pro-vides a simple boundwhich is usually valid. Ifxk = 1, vk(x) must reflect howmuch unserveddemand will be eliminated if component ksstatus is changed in the opposite direction.Because of the existence of series compo-nents, vk(x) = 0 is a reasonable, albeit crude,approximation. (Actually, unserved demandcan increase after repairing a component, butthis does not normally cause difficulties [45]).

The subproblem in this example is merelya LP, and an attack on component k doesforce its capacity to 0 as in [ADLP1]. A

complication arises, however, because thedestruction of a component can also improvepower flow by eliminating one or more sus-ceptance constraints between power lineshaving common end points [64]. Thus, z0(x)is neither concave nor convex in this applica-tion. However, this function tends to be well-behaved in practice, and the correspondingpenalty vector v(x) is easily computed. Thedefinition of that vector may seem simplistic,but Salmeron et al. [45] use it within globalBenders decomposition to solve interdictionmodels on full-scale, regional transmissiongrids. An added benefit of the global Bendersapproach is that it extends to the trilevelnetwork-defense problem for a power grid.

CONCLUSIONS

This article has described mathematicaltechniques for modeling and solving a BNI.BNI is a two-person, zero-sum, two-stage,sequential-play (Stackelberg) game whosesolution prescribes an optimal applicationof limited resources to attack componentsof an enemys network, and thereby limitthat networks usefulness to the enemy.When a LP suffices to model optimal net-work operation, we show that BNI can beconverted to and solved as a MIP. But, wedescribe special decomposition techniquesthat typically solve these problems moreefficiently and, importantly, can solve moregeneral problems.

REFERENCES

1. Webster. Websters third new interna-tional dictionary. Springfield (MA): Merriam-Webster, Inc.; 1993.

2. Herodotus. Translated byGrene D, editor. Thehistory. Chicago: University of Chicago Press;1987.

3. Livy (Titus Livius). Translated by deSelincourt A, editor. The war with Hannibal.Middlesex, England: Penguin Books; 1965.

4. Polybius. Translated by Scott-Kilvert I, edi-tor. The rise of the Roman Empire. London:Penguin Books; 1979.

5. Foote S. The civil war. New York: RandomHouse; 1974.


6. Blair C. Hitlers U-Boat war. New York: Ran-dom House; 1996.

7. MacIsaac D. Strategic bombing in world wartwo. New York: Garland Publishing, Inc.;1976.

8. Joint Chiefs of Staff. Doctrine for jointoperations. Joint Pub 3-0; Available at http://www.dtic.mil/doctrine/jel/new_pubs/jp3_0.pdf. Accessed 1995.

9. Joint Chiefs of Staff. Doctrine for jointinterdiction operations. Joint Pub 3-03;Available at http://www.dtic.mil/doctrine/jel/new_pubs/jp3_03.pdf. Accessed 1997.

10. Brown G, Carlyle M, Salmeron J, et al.Defending critical infrastructure. Interfaces2006;36:530544.

11. von Stackelberg H. The theory of the marketeconomy. London: German, William Hodge &Co.; 1952.

12. Simaan M, Cruz JB. On the stackelberg strat-egy in nonzero-sum games. J Optim TheorAppl 1973;11:533555.

13. Wollmer R. Removing arcs from a network.Oper Res 1964;12:934940.

14. Ahuja RK, Magnanti TL, Orlin JB. Networkflows: theory, algorithms, and applications.Upper Saddle River (NJ): Prentice-Hall; 1993.

15. Harris TE, Ross FS. Fundamentals of amethod for evaluating rail net capaci-ties. Research Memorandum RM-1573, SantaMonica (CA): The RAND Corporation; 1955.

16. Danskin JM. The theory of max-min, withapplications. SIAM J Appl Math 1966;14:641664.

17. von Neumann J, Morgenstern O. Theory ofgames and economic behavior. Princeton (NJ):Princeton University Press; 1953.

18. (a) von Neumann J. Zur theories dergesellschaftsspiele. Math Ann 1928;100:295320; (b) translated by Bergmann S, Luce RD,Tucker AW, editors. Contributions to the the-ory of games IV. Princeton (NJ): PrincetonUniversity Press; 1959. pp. 1342.

19. McMasters AW, Mustin TM. Optimal inter-diction of a supply network. Naval Res LogistQ 1970;17:261268.

20. Ghare PM,Montgomery DC, Turner TM.Opti-mal interdiction policy for a flow network.Naval Res Logist Q 1971;18:3745.

21. Fulkerson DR, Harding GC. Maximizing theminimum source-sink path subject to a budgetconstraint. Math Program 1977;13:116118.

22. Golden B. A problem in network interdiction.Naval Res Logist Q 1978;25:711713.

23. Corley HW, Shaw DY. Most vital links andnodes in weighted networks. Oper Res Lett1982;1:157160.

24. Malik K, Mittal AK, Gupta SK. The k-mostvital arcs in the shortest path problem. OperRes Lett 1989;8:223227.

25. Ball MO, Golden BL, Vohra RV. Finding themost vital arcs in a network. Oper Res Lett1989;8:7376. (NP-completeness of BSI).

26. Israeli E, Wood RK. Shortest-path networkinterdiction. Networks 2002;40:97111.

27. Ratliff HD, Sicilia GT, Lubore SH. Finding then most vital links in flow networks. ManageSci 1975;21:531539.

28. Wood RK. Deterministic network interdiction.Math Comput Model 1993;17:118.

29. Phillips CA. The network inhibition problem.STOC 93: Proceedings of the Twenty-fifthAnnual ACM Symposium on Theory of Com-puting. New York: ACM Press; 1993. pp.776785.

30. Steinrauf R. A network interdiction model[Masters Thesis]. Monterey (CA): OperationsResearch Department, Naval PostgraduateSchool; 1991.

31. Grotschel M, Monma C, Stoer M. Compu-tational results with a cutting plane algo-rithm for designing communication networkswith low-connectivity constraints. Oper Res1992;40:309330.

32. Medhi D. A unified approach to networksurvivability for teletraffic networks: models,algorithms and analysis. IEEE Trans Com-mun 1994;42:534548.

33. Chern MS, Lin KC. Interdicting the activitiesof a linear program - a parametric analysis.Eur J Oper Res 1995;86:580591.

34. Washburn AR, Wood RK. Two-person zero-sum games for network interdiction. Oper Res1994;43:243251.

35. Cormican KJ, Morton DP, Wood RK. Stochas-tic network interdiction. Oper Res 1998;46:184197.

36. Whiteman PS. Improving single strike effec-tiveness for network interdiction. Mil OperRes 1999;4(1):1530.

37. Pan F, Charlton W, Morton D. A stochas-tic program for interdicting smuggled nuclearmaterial. In: Woodruff DL, editor. Networkinterdiction and stochastic integer program-ming. Dordrecht, The Netherlands: KluwerAcademic Publishers; 2003. pp. 120.

38. Morton DP, Pan F, Saeger KJ. Models fornuclear smuggling interdiction. IIE Trans2007;39:314.


39. Brown G, Carlyle M, Royset J, et al. On thecomplexity of delaying an adversarys project.In: Golden B, Raghavan S, Wasil E, editors.The next wave in computing, optimization anddecision technologies. New York: Springer;2005. pp. 317.

40. BrownG,CarlyleM, Salmeron J, et al. Analyz-ing the vulnerability of critical infrastructureto attack, and planning defenses. In: Green-berg H, Smith J, editors. Tutorials in oper-ations research: emerging theory, methods,and applications. Hanover (MD): Institute forOperations Research and Management Sci-ence; 2005.

41. Brown G, Carlyle M, Diehl D, et al. A two-sided optimization for theater ballistic missiledefense. Oper Res 2005;53:263275.

42. Lim C, Smith JC. Algorithms for dis-crete and continuous multicommodity flownetwork interdiction problems. IIE Trans2007;39:1526.

43. Barkley TR. An attacker-defender model forIP-based networks [Masters Thesis]. Mon-terey (CA): Operations Research Department,Naval Postgraduate School; 2008.

44. Brown G, Carlyle M, Harney R, et al. Inter-dicting a nuclear weapons project. Oper Res2009;57:866877.

45. Salmeron J, Wood K, Baldick R. Worst-case interdiction analysis of large-scale elec-tric power grids. IEEE Trans Power Syst2009;24:96104.

46. Magnanti TL, Wong RT. Accelerating Ben-ders decomposition: algorithmic enhance-ment and model selection criteria. Oper Res1981;29:464484.

47. Smith JC, Lim C, Alptekinoglu A. Opti-malmixed-integer programming and heuristicmethods for a bilevel stackelberg prod-uct introduction game. Naval Res Logist2009;56:714729.

48. Morton D, Rosenthal RE, Lim T. Optimizationmodeling for airlift mobility. Mil Oper Res1997;1(4):4968.

49. Mehring JS, Gutterman MM. Supplyand distribution planning support forAmoco (U.K.) Limited. Interfaces 1990;20(4):95104.

50. Ben-Ayed O. Bi-level linear programming.Comput Oper Res 1993;20:485501.

51. Bard J, Moore J. A branch and bound algo-rithm for the bi-level programming prob-lem. SIAM J Sci Stat Comput 1990;11:281292.

52. Wen U, Yang Y. Algorithms for solving themixed integer two-level linear programmingproblem. Comput Oper Res 1990;17:133142.

53. Hansen P, Jaumard B, Savard G. Newbranch-and-bound rules for linear bi-levelprogramming. SIAM J Sci Stat Comput1992;13:11941217.

54. Morton DP, Wood RK. Restricted recoursebounds for stochastic linear programming.Oper Res 1999;47:943956.

55. Cormican KJ. Computational methods fordeterministic and stochastic network inter-diction problems [Masters Thesis]. Mon-terey (CA): Operations Research Department,Naval Postgraduate School; 1995.

56. Motto AL, Arroyo JM, Galiana FD. A mixed-integer LP procedure for the analysis of elec-tric grid security under terrorist threat. IEEETrans Power Syst 2005;20:13571365.

57. Benders JF. Partitioning procedures for solv-ing mixed integer variables programmingproblems. Numer Math 1962;4:238252.

58. Garfinkel RS, Nemhauser GL. Integer Pro-gram. New York: John Wiley & Sons; 1972.

59. Birge JR. Decomposition and partitioningmethods for multistage stochastic linear pro-grams. Oper Res 1985;33:9891007.

60. Nemhauser GL, Wolsey LA. Integer and com-binatorial optimization. New York: Wiley-Interscience; 1988.

61. Brown GG, Graves G, Honczarenko M.Design and operation of a multicommodityproduction/distribution system using primalgoal decomposition. Manage Sci 1987;33:14691480.

62. Geoffrion A. Generalized Benders decomposi-tion. J Optim Theor Appl 1972;10:237260.

63. Davis EW. Project scheduling under resourceconstraints: historical review and catego-rization of procedures. AIIE Trans 1973;5:297313.

64. Overbye TJ, Cheng X, Sun Y. A compari-son of the AC and DC power flow models forLMP calculations. Proceedings, 37th HawaiiInternational Conference on System Sciences.Hawaii: 2004.

bilevel network interdiction

Documents