gregory levitin, kjell hausken
DESCRIPTION
Gregory Levitin, Kjell Hausken. Meeting a demand vs. enhancing protections in homogeneous parallel systems. Advisor : Professor Frank Y.S. Lin Presented by Yu-Pu Wu. About. Author Gregory Levitin, Kjell Hausken Title - PowerPoint PPT PresentationTRANSCRIPT
Gregory Levitin, Kjell HauskenMeeting a demand vs. enhancing protections in homogeneous parallel systems
Advisor : Professor Frank Y.S. LinPresented by Yu-Pu Wu
About Author
Gregory Levitin, Kjell Hausken Title
Meeting a demand vs. enhancing protections in homogeneous parallel systems
Provenance Reliability Engineering and System
Safety 94 (2009) 1711–1717
Agenda Introduction The Model Evenly Distributed A subset of elements Conclusions
Introduction Classical reliability theory considers
providing redundancy and improving reliability of elements as measures of system reliability enhancement.
When the defense of systems exposed to intentional attacks is concerned, the separation of elements and their protection against malicious impacts become essential elements of the defense strategy.
Introduction This article considers a situation when a
defender deploys costly separated identical system elements and protects them to minimize the losses associated with not meeting the demand.
The protection is a technical or organizational measure aimed at the reduction of the destruction probability of system elements in the case of attack.
Introduction Losses may be planned or forced. Planned losses are those where the
producer decides not to meet the demand.
Forced losses are those where a determined adversary seeks to destroy the elements by attacking them which reduce their performance.
Delivery of electricity
Introduction We think our model applies for any good
for which there is a demand, assuming the good is costly to deploy and that it delivers a performance.
Incurring planned and forced losses entail different kinds of assessments.
Introduction The defender needs to strike a delicate tradeoff
between planned and forced losses when determining how many elements to deploy.
The optimal strategies the cost of deployment the resources of the defender and attacker the unit costs of defense and attack efforts the contest intensity the demand the relative unit cost of planned and forced losses
Introduction Consider as an example an electric power
company that plans to supply electricity to new customers in some area.
The company has a limited budget that should be divided between deployment of new generating units and protecting the units.
Forced losses are usually much greater than the planned losses.
Introduction It was assumed that the defender
minimizes the success probability and expected damage of an attack.
This article assumes that successful attack on each element totally destroys this element. Only damage caused by the attack is considered without taking into account the elements’ failures.
Agenda Introduction The Model Evenly Distributed A subset of elements Conclusions
The Model A system that is built from identical
parallel elements with the same functionality each has the performance g.
N means number of elements in the system.
The existing demand is F.
The Model If the number of elements is not enough
to meet the demand (Ng<F) the defender has planned losses Lp proportional to the demand deficiency.
The Model When the system performance
decreases as a result of an attack, the forced losses are proportional to the extent of performance reduction below the demand F (when the demand is initially satisfied Ng≥F) or below the planned cumulative performance Ng (Ng<F).
The Model Eqs. (1) and (2) give three scenarios. First, demand is met both without and
with an attack. Second, demand is met without an
attack, but not with a destructive attack. Third, demand is met neither without an
attack, nor with an attack.
The Model The total attacker’s resource is R. The cost of the attacker’s effort unit is A. The defender’s resource is r.
This resource is distributed between protection and deployment of elements.
The resource needed to deploy one element is x. We assume r≥Nx and N≥1.
The cost of the protection effort unit is a.
The Model The attacker’s and the defender’s
resources R and r can be measured as available budgets.
The attack and the protection efforts T and t can be measured as the cumulative destructive power of attacking weapons and the strength of protection shields respectively.
The Model In this paper we assume that the system
elements are so simple that they can be totally destroyed by any successful attack.
Therefore we define element vulnerability as a scalar index equal to the conditional probability of element destruction given the element is attacked.
The Model The element vulnerability depends on
attack and protection efforts allocated to this element.
The vulnerability can be determined by the attacker–defender contest success function modeled with the common ratio.
The Model A benchmark intermediate value is m =
1, which means that the investments have proportional impact on the vulnerability.
0<m<1 gives a disproportional advantage of investing less than one’s opponent.
m>1 gives a disproportional advantage of investing more effort than one’s opponent.
The Model In the extreme case m = 0, the efforts t
and T have equal impact on the vulnerability regardless of their size, which gives 50% vulnerability.
The other extreme case m =∞ gives a step function where ‘‘winner-takes-all’’.
The Model The contest success function was initially
used in rent seeking and expresses agents’ success in securing a rent dependent on efforts exerted. Higher effort gives higher success, but is also
costly. Traditional reliability theory focused on how
reliable a system is, which depends on factors that have typically been of a non-intentional nature.
The Model In the authors’ view this becomes a
question about resource expenditures. how much effort to exert to ensure,
versus not ensure, that the element survives the attack.
If the attacker expends the same amount of resources as before the defender’s improvements, the element will have more chances to survive.
The Model In some situations the attacker cannot
direct the attack exactly against certain targets and the defender cannot protect only a subset of targets.
In such situations one should assume that both the attacker and the defender distribute their efforts evenly among all elements.
The Model If the information about the protected
elements is unavailable to the attacker It may be beneficial for the defender to
protect some of the system elements concentrating more resources on protecting this subset.
The attacker can also prefer to attack a subset of the elements to achieve effort superiority or avoid effort inferiority for each of the attacked elements.
Agenda Introduction The Model Evenly Distributed A subset of elements Conclusions
Evenly Distributed Consider the case when the defender
distributes its resource r between deployment of N elements and their protection (the protection investment is evenly distributed among the elements). The cost of single element is x.
The effort allocated at protection of each element is t = (r–Nx)/(aN) = (r/N–x)/a.
Evenly Distributed The attacker attacks all N elements and
distributes its resource evenly among them. The effort allocated at attacking each element is T = R/(NA).
The vulnerability of each element is
Evenly Distributed The damage caused by an attack is
associated with reduction of the cumulative system performance in the case of destruction of some elements. If the number of destroyed elements is k, the forced performance reduction is
Evenly Distributed The expected forced losses can be
obtained as
The total losses are
Evenly Distributed We can normalize the losses and obtain
Planned losses require not only F > g but also F > Ng, analysis of 1-out-of-N (F ≤ g) system is out of scope for this paper.
Evenly Distributed Consider an example of a power system that
should supply a demand F = 1 by deploying generating units with capacity g = 0.1 each.
Each deployed unit is protected by a casing. The strength of the casing (protection effort)
depends on protection budget allocated to each unit.
Fig. 1 presents the normalized losses as a function of cost x of deploying one generating unit for ε = r= R = m = 1, α = 2, and different values of the number N of units.
Evenly Distributed
Evenly Distributed
Evenly Distributed
Evenly Distributed
Evenly Distributed It can be seen that for any combination
of the model parameters one can find the number of elements N that minimizes the expected losses.
Therefore, the optimal defenders strategy is to find the number of elements that minimizes its expected losses
Evenly Distributed
The minimal achievable normalized expected losses grow with both α and m.
Agenda Introduction The Model Evenly Distributed A subset of elements Conclusions
A subset of elements If F ≤ g, the attacker has to destroy all N
elements in order to cause unsupplied demand. In the case when F > g, unsupplied demand can
be caused by partial destruction of the system. To increase the expected damage the attacker
can decide to attack Q < N elements concentrating more effort on attacking each one of the chosen Q elements. the attacker’s effort per target increases from
R/(NA) to R/(QA)
A subset of elements The defender can also decide to protect M out of
N elements allocating the effort t = (r – Nx)/(Ma) to each one if the attacker has no information about the defense effort distribution among the elements and chooses the attacked elements randomly.
In this case both the attacker and the defender have free choice variables that determine their strategies: the defender chooses N and M whereas the
attacker chooses Q.
A subset of elements The defender builds the system over time and the
attacker takes it as given when it chooses its attack strategy. Therefore, we analyze a two periods game where the
defender moves in the first period, and the attacker moves in the second period.
The optimal defender strategy (N, M) can be found as a solution of a minmax game in which the defender should chose N and M that minimize the expected losses, given that for any N and M the attacker chooses Q that maximizes the expected losses:
A subset of elements For any given defense strategy (N, M), there
are M protected and N – M unprotected elements in the system.
When the attacker attacks Q elements, the number of attacked protected elements can vary from max{0, Q – N+M} to min{Q, M}.
According to the hypergeometric distribution, the probability that the attacker attacks exactly q protected elements and Q – q unprotected elements is
A subset of elements The vulnerability of each protected
element is
A subset of elements The probability that exactly k elements
are destroyed out of q protected elements that are attacked is
All the attacked unprotected elements are destroyed with probability 1.
A subset of elements If the attacker attacks exactly q protected
elements and Q – q unprotected elements, it destroys k elements (0<k<q) with probability w(q, k) and Q – q elements with probability 1.
The total number of destroyed elements is k + Q – q, where random k varies from 0 to q. Note that different q and k can produce the
same total number of the destroyed elements s when k = s + q – Q.
A subset of elements The probability of destruction of exactly
s elements can be obtained as
A subset of elements For any demand F and number of
elements N we can obtain the normalized expected losses as
A subset of elements The optimal values of M and N can be obtained by the
following enumerative procedure.
A subset of elements
A subset of elements
A subset of elements It can be seen that for relatively low losses cost
ratio α, the optimal number of units increases in the case of optimal M and Q, whereas it decreases for large a and becomes smaller than the optimal number of elements for M = Q = N.
When the forced losses cost is much greater than the planned losses cost (high α), the defender can afford to deploy only one single generating unit and spends all the remaining resources in protecting this unit from the attack.
A subset of elements For low α, the defender benefits from the
minmax strategy For high α, the attacker benefits from the
minmax strategy. Therefore, when the cost of forced losses
exceeds the cost of planned losses the defender should try to avoid the minmax game. Urging the attacker to distribute its resources
among all the generating units.
Agenda Introduction The Model Evenly Distributed A subset of elements Conclusions
Conclusions We consider a situation when the
defender deploys costly separated identical system elements and protects them to minimize the losses associated with amount of the unsupplied demand.
The losses may be planned or forced. The attacker distributes its effort evenly
among all the N elements or among elements from a chosen subset.
Conclusions We first analyze the case when the
defender and the attacker distribute their efforts evenly among all elements.
Thereafter analyze the case when the defender protects an optimal number M of elements, and the attacker attacks an optimal number Q of elements.
Conclusions We find that the optimal number of elements
deployed is a decreasing function of the contest intensity m and the losses cost ratio α = cf /cp for forced and planned losses.
When the defender protects an optimal subset of elements and the attacker attacks an optimal subset of elements, the optimal number of protected elements M also decreases in α, whereas the optimal number of attacked elements can behave non-monotonically.
Conclusions When the losses cost ratio α is low the defender
benefits from the minmax and when this ratio is high the attacker benefits from the minmax strategy.
The model presented in this paper can be easily generalized to the case when the losses constitute any function of the unsatisfied demand.
Another extension of the model can consider the series–parallel systems with non-identical elements, which causes an uneven distribution of the efforts among the elements.
Thanks for your attention!