Gregory Levitin Kjell Hausken Meeting a demand vs

Gregory Levitin, Kjell Hausken Meeting a demand vs. enhancing protections in homogeneous parallel systems Advisor : Professor Frank Y. S. Lin Presented by Yu-Pu Wu

About Author Gregory Levitin, Kjell Hausken Title Meeting a demand vs. enhancing protections in homogeneous parallel systems Provenance Reliability Engineering and System Safety 94 (2009) 1711– 1717

Agenda Introduction The Model Evenly Distributed A subset of elements Conclusions

Introduction Classical reliability theory considers providing redundancy and improving reliability of elements as measures of system reliability enhancement. When the defense of systems exposed to intentional attacks is concerned, the separation of elements and their protection against malicious impacts become essential elements of the defense strategy.

Introduction This article considers a situation when a defender deploys costly separated identical system elements and protects them to minimize the losses associated with not meeting the demand. The protection is a technical or organizational measure aimed at the reduction of the destruction probability of system elements in the case of attack.

Introduction Losses may be planned or forced. Planned losses are those where the producer decides not to meet the demand. Forced losses are those where a determined adversary seeks to destroy the elements by attacking them which reduce their performance. Delivery of electricity

Introduction We think our model applies for any good for which there is a demand, assuming the good is costly to deploy and that it delivers a performance. Incurring planned and forced losses entail different kinds of assessments.

Introduction The defender needs to strike a delicate tradeoff between planned and forced losses when determining how many elements to deploy. The optimal strategies the cost of deployment the resources of the defender and attacker the unit costs of defense and attack efforts the contest intensity the demand the relative unit cost of planned and forced losses

Introduction Consider as an example an electric power company that plans to supply electricity to new customers in some area. The company has a limited budget that should be divided between deployment of new generating units and protecting the units. Forced losses are usually much greater than the planned losses.

Introduction It was assumed that the defender minimizes the success probability and expected damage of an attack. This article assumes that successful attack on each element totally destroys this element. Only damage caused by the attack is considered without taking into account the elements’ failures.

Agenda Introduction The Model Evenly Distributed A subset of elements Conclusions

The Model A system that is built from identical parallel elements with the same functionality each has the performance g. N means number of elements in the system. The existing demand is F.

The Model If the number of elements is not enough to meet the demand (Ng<F) the defender has planned losses Lp proportional to the demand deficiency.

The Model When the system performance decreases as a result of an attack, the forced losses are proportional to the extent of performance reduction below the demand F (when the demand is initially satisfied Ng≥F) or below the planned cumulative performance Ng (Ng<F).

The Model Eqs. (1) and (2) give three scenarios. First, demand is met both without and with an attack. Second, demand is met without an attack, but not with a destructive attack. Third, demand is met neither without an attack, nor with an attack.

The Model The total attacker’s resource is R. The cost of the attacker’s effort unit is A. The defender’s resource is r. This resource is distributed between protection and deployment of elements. The is x. resource needed to deploy one element We The assume r≥Nx and N≥ 1. cost of the protection effort unit is a.

The Model The attacker’s and the defender’s resources R and r can be measured as available budgets. The attack and the protection efforts T and t can be measured as the cumulative destructive power of attacking weapons and the strength of protection shields respectively.

The Model In this paper we assume that the system elements are so simple that they can be totally destroyed by any successful attack. Therefore we define element vulnerability as a scalar index equal to the conditional probability of element destruction given the element is attacked.

The Model The element vulnerability depends on attack and protection efforts allocated to this element. The vulnerability can be determined by the attacker–defender contest success function modeled with the common ratio.

The Model A benchmark intermediate value is m＝ 1, which means that the investments have proportional impact on the vulnerability. 0<m<1 gives a disproportional advantage of investing less than one’s opponent. m>1 gives a disproportional advantage of investing more effort than one’s opponent.

The Model In the extreme case m＝ 0, the efforts t and T have equal impact on the vulnerability regardless of their size, which gives 50% vulnerability. The other extreme case m＝∞ gives a step function where ‘‘winner-takes-all’’.

The Model The contest success function was initially used in rent seeking and expresses agents’ success in securing a rent dependent on efforts exerted. Higher effort gives higher success, but is also costly. Traditional reliability theory focused on how reliable a system is, which depends on factors that have typically been of a non-intentional nature.

The Model In the authors’ view this becomes a question about resource expenditures. how much effort to exert to ensure, versus not ensure, that the element survives the attack. If the attacker expends the same amount of resources as before the defender’s improvements, the element will have more chances to survive.

The Model In some situations the attacker cannot direct the attack exactly against certain targets and the defender cannot protect only a subset of targets. In such situations one should assume that both the attacker and the defender distribute their efforts evenly among all elements.

The Model If the information about the protected elements is unavailable to the attacker It may be beneficial for the defender to protect some of the system elements concentrating more resources on protecting this subset. The attacker can also prefer to attack a subset of the elements to achieve effort superiority or avoid effort inferiority for each of the attacked elements.

Agenda Introduction The Model Evenly Distributed A subset of elements Conclusions

Evenly Distributed Consider the case when the defender distributes its resource r between deployment of N elements and their protection (the protection investment is evenly distributed among the elements). The cost of single element is x. The effort allocated at protection of each element is t = (r–Nx)/(a. N) = (r/N–x)/a.

Evenly Distributed The attacker attacks all N elements and distributes its resource evenly among them. The effort allocated at attacking each element is T = R/(NA). The vulnerability of each element is

Evenly Distributed The damage caused by an attack is associated with reduction of the cumulative system performance in the case of destruction of some elements. If the number of destroyed elements is k, the forced performance reduction is

Evenly Distributed The expected forced losses can be obtained as The total losses are

Evenly Distributed We can normalize the losses and obtain Planned losses require not only F > g but also F > Ng, analysis of 1 -out-of-N (F ≤ g) system is out of scope for this paper.

Evenly Distributed Consider an example of a power system that should supply a demand F＝ 1 by deploying generating units with capacity g＝ 0. 1 each. Each deployed unit is protected by a casing. The strength of the casing (protection effort) depends on protection budget allocated to each unit. Fig. 1 presents the normalized losses as a function of cost x of deploying one generating unit for ε＝r＝R＝m＝ 1, α＝ 2, and different values of the number N of units.

Evenly Distributed

Evenly Distributed

Evenly Distributed

Evenly Distributed

Evenly Distributed It can be seen that for any combination of the model parameters one can find the number of elements N that minimizes the expected losses. Therefore, the optimal defenders strategy is to find the number of elements that minimizes its expected losses

Evenly Distributed The minimal achievable normalized expected losses grow with both α and m.

Agenda Introduction The Model Evenly Distributed A subset of elements Conclusions

A subset of elements If F ≤ g, the attacker has to destroy all N elements in order to cause unsupplied demand. In the case when F > g, unsupplied demand can be caused by partial destruction of the system. To increase the expected damage the attacker can decide to attack Q < N elements concentrating more effort on attacking each one of the chosen Q elements. the attacker’s effort per target increases from R/(NA) to R/(QA)

A subset of elements The defender can also decide to protect M out of N elements allocating the effort t = (r – Nx)/(Ma) to each one if the attacker has no information about the defense effort distribution among the elements and chooses the attacked elements randomly. In this case both the attacker and the defender have free choice variables that determine their strategies: the defender chooses N and M whereas the attacker chooses Q.

A subset of elements The defender builds the system over time and the attacker takes it as given when it chooses its attack strategy. Therefore, we analyze a two periods game where the defender moves in the first period, and the attacker moves in the second period. The optimal defender strategy (N, M) can be found as a solution of a minmax game in which the defender should chose N and M that minimize the expected losses, given that for any N and M the attacker chooses Q that maximizes the expected losses:

A subset of elements For any given defense strategy (N, M), there are M protected and N – M unprotected elements in the system. When the attacker attacks Q elements, the number of attacked protected elements can vary from max{0, Q – N+M} to min{Q, M}. According to the hypergeometric distribution, the probability that the attacker attacks exactly q protected elements and Q – q unprotected elements is

A subset of elements The vulnerability of each protected element is

A subset of elements The probability that exactly k elements are destroyed out of q protected elements that are attacked is All the attacked unprotected elements are destroyed with probability 1.

A subset of elements If the attacker attacks exactly q protected elements and Q – q unprotected elements, it destroys k elements (0<k<q) with probability w(q, k) and Q – q elements with probability 1. The total number of destroyed elements is k + Q – q, where random k varies from 0 to q. Note that different q and k can produce the same total number of the destroyed elements s when k = s + q – Q.

A subset of elements The probability of destruction of exactly s elements can be obtained as

A subset of elements For any demand F and number of elements N we can obtain the normalized expected losses as

A subset of elements The optimal values of M and N can be obtained by the following enumerative procedure.

A subset of elements

A subset of elements

A subset of elements It can be seen that for relatively low losses cost ratio α, the optimal number of units increases in the case of optimal M and Q, whereas it decreases for large a and becomes smaller than the optimal number of elements for M = Q = N. When the forced losses cost is much greater than the planned losses cost (high α), the defender can afford to deploy only one single generating unit and spends all the remaining resources in protecting this unit from the attack.

A subset of elements For low α, the defender benefits from the minmax strategy For high α, the attacker benefits from the minmax strategy. Therefore, when the cost of forced losses exceeds the cost of planned losses the defender should try to avoid the minmax game. Urging the attacker to distribute its resources among all the generating units.

Agenda Introduction The Model Evenly Distributed A subset of elements Conclusions

Conclusions We consider a situation when the defender deploys costly separated identical system elements and protects them to minimize the losses associated with amount of the unsupplied demand. The losses may be planned or forced. The attacker distributes its effort evenly among all the N elements or among elements from a chosen subset.

Conclusions We first analyze the case when the defender and the attacker distribute their efforts evenly among all elements. Thereafter analyze the case when the defender protects an optimal number M of elements, and the attacker attacks an optimal number Q of elements.

Conclusions We find that the optimal number of elements deployed is a decreasing function of the contest intensity m and the losses cost ratio α = cf /cp forced and planned losses. When the defender protects an optimal subset of elements and the attacker attacks an optimal subset of elements, the optimal number of protected elements M also decreases in α, whereas the optimal number of attacked elements can behave non-monotonically.

Conclusions When the losses cost ratio α is low the defender benefits from the minmax and when this ratio is high the attacker benefits from the minmax strategy. The model presented in this paper can be easily generalized to the case when the losses constitute any function of the unsatisfied demand. Another extension of the model can consider the series–parallel systems with non-identical elements, which causes an uneven distribution of the efforts among the elements.

Thanks for your attention!