Protection vs. false targets in series systems Reliability Engineering and System Safety(2009) Kjell...
-
Upload
nigel-glenn -
Category
Documents
-
view
213 -
download
0
Transcript of Protection vs. false targets in series systems Reliability Engineering and System Safety(2009) Kjell...
Protection vs. false targets in series systems
Reliability Engineering and System Safety(2009)
Kjell Hausken , Gregory Levitin Advisor: Frank,Yeong-Sung Lin
Presented by Jia-Ling Pan2010/3/30 1NTU IM OPLab
Agenda
•Introduction•The model •Scenario 1:The attacker attacks one
element •Scenario 2:The attacker evenly attacks all
elements •Scenario 3:The attacker evenly attacks a
subset of the elements •Conclusion
2010/3/30
2
NTU OPLab
2010/3/30 NTU OPLab 1
Agenda
•Introduction•The model •Scenario 1:The attacker attacks one
element •Scenario 2:The attacker evenly attacks all
elements •Scenario 3:The attacker evenly attacks a
subset of the elements •Conclusion
2010/3/30
3
NTU OPLab
2010/3/30 NTU OPLab 1
Introduction
•The paper analyses the optimal distribution of the defense resources between protecting the genuine system elements and deploying false elements in a series system which is destroyed when any genuine element is destroyed.
•False and genuine elements cannot be distinguished by the attacker.
2010/3/30NTU OPLab
4
Introduction• The probability of element destruction in the case
of attack is defined as a contest function depending on the ratio of the defender’s and attacker’s effort and on a contest intensity parameter.
• The dependence of the minmax defense strategy (number of false elements) and the most harmful attack strategy (number of attacked elements) on the amount of resources available to the counterparts, on the number of genuine system elements and on the contest intensity is analyzed
2010/3/30NTU OPLab
5
Agenda
•Introduction•The model •Scenario 1:The attacker attacks one
element •Scenario 2:The attacker evenly attacks all
elements •Scenario 3:The attacker evenly attacks a
subset of the elements •Conclusion
2010/3/30
6
NTU OPLab
2010/3/30 NTU OPLab 1
The model
•The system consists of N genuine elements connected in series.
•Destruction of any GE causes destruction of the entire system.
•Defender protects all GEs, and distributes the protection resource among the GEs evenly.
•The even resource distribution appears to be optimal if the protection effort cost is the same for different GEs .
2010/3/30NTU OPLab
8
The model •The attacker is not able to distinguish
GEs and FEs.•Both the defender and the attacker have
complete information about the structure of the game, the strategy sets, and all parameters, and are fully rational.
•The defender’s one free-choice variable is the number of false targets H.
•The attacker’s one free-choice variable is the number of elements to attack Q.
2010/3/30NTU OPLab
9
The model
•The defender’s resource is r ▫The resource needed to deploy one FE is x
where 0<x<r . ▫If the defender deploys H FEs, the resource
remaining for the protection is r-Hx.▫The maximum number of deployed FEs is
H=[r/x].▫The defender allocates its protection
resource r-Hx evenly among N GEs achieving protection effort t=(r-Hx)/N per element.
2010/3/30NTU OPLab
10
The model •The attacker’s resource is R
▫If the attacker attacks Q elements out of N+H, it achieves the per element effort TQ =R/Q.
•The vulnerability of any attacked GE is determined by the ratio form of the attacker–defender contest success function.
• where m ≥ 0 , ∂v/∂T > 0 and ∂v/∂t < 0.
2010/3/30NTU OPLab
11
Agenda
•Introduction•The model •Scenario 1:The attacker attacks one
element •Scenario 2:The attacker evenly attacks all
elements •Scenario 3:The attacker evenly attacks a
subset of the elements •Conclusion
2010/3/30
13
NTU OPLab
2010/3/30 NTU OPLab 1
Scenario 1:The attacker attacks one element •Attacker has the ability to attack only
once against any one of the N+H elements.
•The probability that the attacked element is a GE is p = N/(N+H).
• When one element is attacked, Q = 1 ,
2010/3/30NTU OPLab
14
Scenario 1:The attacker attacks one element • This paper assume m = 1 first because it is
the most natural choice if a choice is to be made, and second because it is usually the easiest case to handle analytically.
• Although this does not allow generalization to ma1,thepresenceof m in the exponent in (1) shows that, especially when t and TQ have similar sizes, the vulnerability changes moderately as m increases moderately above or below m = 1,and changes more extensively as m approaches infinity or 0.
2010/3/30NTU OPLab
15
Scenario 1:The attacker attacks one element •When m = 1,differentiating V with respect
to H and equating the derivative with zero gives the interior solution.
•The second-order derivative is positive at the interior minimum.
2010/3/30NTU OPLab
16
Scenario 1:The attacker attacks one element •Property 1.
▫When m = 1 ,at the interior solution the optimal number H of deployed FEs decreases in the deployment cost x, increases in both the defender’s and the attacker’s resource r and R, and in the ratio r/R, increases in the number N of GEs when R>x, and decreases in N when R<x.
2010/3/30NTU OPLab
17
Scenario 1:The attacker attacks one element
• Fig. 1. Optimal number H* of deployed FEs and vulnerability V* as functions of r/R for different m, where N =5 and x/R =0.5. The stepwise movement follows since H* can take only
integer values
2010/3/30NTU OPLab
18
r/R=5.85r/R=5.85
Scenario 1:The attacker attacks one element
• Fig. 2. System vulnerability V as a function of H for various r/R, where m = 3, N = 5, and x/R = 0.5.
2010/3/30NTU OPLab
19
r/R=6,V(1)>V(12)
r/R=8,V(1)<V(12)
Scenario 1:The attacker attacks one element
Fig. 3. (r/R)* asafunctionof m, x/R, and N.
2010/3/30NTU OPLab
20
m=2
Scenario 1:The attacker attacks one element
Fig. 4. Optimal H* and V* as functions of N for different values of m, where r/R = 5 and x/R = 0.5.
2010/3/30NTU OPLab
21
Scenario 1:The attacker attacks one element
• Fig. 5. System vulnerability V as a function of H for various N when m = 3 and0.7,where r/R = 5 and x/R = 0.5.
2010/3/30NTU OPLab
22
Scenario 1:The attacker attacks one element
Fig. 4. Optimal H* and V* as functions of N for different values of m, where r/R = 5 and x/R = 0.5.
2010/3/30NTU OPLab
23
Agenda
•Introduction•The model •Scenario 1:The attacker attacks one
element •Scenario 2:The attacker evenly
attacks all elements •Scenario 3:The attacker evenly attacks a
subset of the elements •Conclusion
2010/3/30
24
NTU OPLab
2010/3/30 NTU OPLab 1
Scenario 2:The attacker evenly attacks all elements•Attacker attacks all Q = N+H elements
evenly distributing its resource among them.
•The probability that one GE survives is s=1-v.
•Hence the probability that the system is destroyed is
2010/3/30NTU OPLab
25
Scenario 2:The attacker evenly attacks all elements•When m = 1,differentiating V with respect
to H and equating the derivative with zero gives the interior solution.
•The second-order derivative is positive at the interior minimum.
2010/3/30NTU OPLab
26
Scenario 2:The attacker evenly attacks all elements•Proposition.
▫The optimal number of false elements H is independent of the contest intensity m when the attacker attacks all elements evenly.
2010/3/30NTU OPLab
27
Scenario 2:The attacker evenly attacks all elements•Property2.
▫When m = 1,the defender always deploys fewer FEs when the attacker attacks all elements evenly compared with attacking only one element.
2010/3/30NTU OPLab
28
Scenario 2:The attacker evenly attacks all elements
• Fig. 6. Optimal number of deployed FEs H*, and V*, as functions of r/R, for different m, where N = 5 and x/R = 0.5.
2010/3/30NTU OPLab
29
Scenario 2:The attacker evenly attacks all elements
2010/3/30NTU OPLab
30
Fig.1 attacker attacks one element
Fig.6 attacker evenly attacks all elements
Scenario 2:The attacker evenly attacks all elements
2010/3/30NTU OPLab
31
Fig.1 attacker attacks one element
Fig.6 attacker evenly attacks all elements
Scenario 2:The attacker evenly attacks all elements
Fig. 7. Optimal H* and V* as functions of N for different m, where r/R = 5
and x/R = 0.5.
2010/3/30NTU OPLab
32
Agenda
•Introduction•The model •Scenario 1:The attacker attacks one
element •Scenario 2:The attacker evenly attacks all
elements •Scenario 3:The attacker evenly
attacks a subset of the elements •Conclusion
2010/3/30
33
NTU OPLab
2010/3/30 NTU OPLab 1
Scenario 3:The attacker evenly attacks a subset of the elements •Attacker can choose the number of
attacked elements that maximizes the system vulnerability.
•Analyze a two-period minmax game. The defender chooses H in the first period to minimize the maximum vulnerability V that the attacker can inflict in the second period by choosing Q.
2010/3/30NTU OPLab
34
Scenario 3:The attacker evenly attacks a subset of the elements •For any given Q, the number of attacked
GEs q among N+H elements can vary from max{0,Q-H} to min{Q,N}.
•The probability that exactly q GEs are attacked is
2010/3/30NTU OPLab
35
Scenario 3:The attacker evenly attacks a subset of the elements •If exactly q GEs are attacked, the
destruction probability of the series system is
V = 1-sq = 1-(1-v)q, when Q targets are attacked, the total destruction probability of the system is
2010/3/30NTU OPLab
36
Scenario 3:The attacker evenly attacks a subset of the elements• The solution of the minmax game(optimal
values of Q* and H* and corresponding value of the expected vulnerability V*) is obtained by the following enumerative procedure:
1. Assign V* = 1; 2. For each H = 0,…, [r/x]
2.1. Assign Vmax = 0; 2.2. For each Q = 1,…,N+H
2.2.1. Determine V(Q,H) according to(7); 2.2.2. if Vmax<V(Q,H) assign Vmax = V(Q,H) and Qopt =
Q;2.3. if Vmax< V* assign V* = Vmax, Q* = Qopt, H* = H.
2010/3/30NTU OPLab
37
Scenario 3:The attacker evenly attacks a subset of the elements
2010/3/30NTU OPLab
38
Fig. 8. Optimal Q*, H*, and V* as functions of r/R for different m, where N = 5 and x/R = 0.5.
Scenario 3:The attacker evenly attacks a subset of the elements
Fig. 8. Optimal Q*, H*, and V* as functions of r/R for different m, where N = 5 and x/R = 0.5.
2010/3/30NTU OPLab
39
Scenario 3:The attacker evenly attacks a subset of the elements
2010/3/30NTU OPLab
40
Fig. 9. Optimal Q*, H*, and V* as functions of N for different m, where r/R = 5 and x/R = 0.5.
Fig.4 attacker attacks one element
Scenario 3:The attacker evenly attacks a subset of the elements
• Fig. 9. Optimal Q*, H*, and V* as functions of N for different m, where r/R = 5 and x/R = 0.5.
2010/3/30NTU OPLab
41
Fig.9 attacker attacks a subset of the elements
Fig.4 attacker attacks one element
Scenario 3:The attacker evenly attacks a subset of the elements
Fig. 10. Best response functions Q*(H) and H*(Q) for various m, assuming N = 5,
r/ R = 5, and x/R = 0.5.
2010/3/30NTU OPLab
42
Agenda
•Introduction•The model •Scenario 1:The attacker attacks one
element •Scenario 2:The attacker evenly attacks all
elements •Scenario 3:The attacker evenly attacks a
subset of the elements •Conclusion
2010/3/30
43
NTU OPLab
2010/3/30 NTU OPLab 1
Conclusion •Series system can be destroyed by an attack
if any one of the elements is destroyed.•To reduce the system vulnerability, the
defender protects the genuine elements and deploys false elements.
•The optimal number of false targets in general depends on the resources available to the attacker and the defender, on the false target cost, on the contest intensity and on the number of the genuine elements.
2010/3/30NTU OPLab
44
Conclusion
•When the attacker attacks only one element, as the attacker’s resource increases, it becomes more important for the defender to deploy more false elements to divert the attacker.▫With low contest intensity, efforts have
modest impact on the outcome of protection and attack, and the defender deploys many false elements to decrease the probability that a genuine element is attacked.
2010/3/30NTU OPLab
45
Conclusion
•With high contest intensity, the attacker easily gets contest success since it attacks only one element, while the defender protects all genuine elements. ▫Defender deploys a maximum number of
false elements when not too resourceful. ▫As the defender becomes more resourceful,
it abruptly decreases the deployment of false elements.
2010/3/30NTU OPLab
46
Conclusion •When the attacker attacks all elements, the
defender always deploys fewer FEs.▫With low contest intensity, this results in
high vulnerability since efforts have low impact, and the attacker is not diverted to too many FEs.
▫With high contest intensity, the vulnerability is low when the defender is sufficiently resourceful, The optimal number of FEs does not depend of the m and strictly decreases with the number of the GEs.
2010/3/30NTU OPLab
47
Conclusion
•When the attacker can choose how many elements to attack,▫low contest intensity induces the attacker
to attack all elements since contest success is more egalitarian regardless of effort.
▫with high contest intensity effort matters more and the attacker attacks overall fewer elements as the defender’s resource increases.
2010/3/30NTU OPLab
48
Conclusion • The presented model applies a contest
intensity parameter m that cannot be exactly evaluated in practice.
• Two ways of handling the uncertainty of the contest intensity can be outlined:
1.m can be defined as a fuzzy variable and fuzzy logic model can be studied.
2.The range of possible variation of m can be determined and the ‘‘worst-case’’ defense strategy can be obtained under the assumption that m takes the values that are most favorable for the attacker.
2010/3/30NTU OPLab
49