Defending Complex System Against
External Impacts
Gregory Levitin (IEC, UESTC)
Game Theory vs. Reliability
• Risk arises from technology, nature, humans.
• Conventional reliability and risk analysis assume play
against static, fixed and immutable factors which are
exogenously given.
• Intentionality plays increasing role (9/11, terrorists’
attacks).
• Game theory assumes play against adaptable,
strategic, optimizing, dynamic agents.
Need for combining reliability & risk analysis with
game theory
Game
Player 1
action xX
Information
Player 2
action yY
System
Payoff:
P(x,y)
Five Elements of a Game:
The players
-how many players are there?
-does nature/chance play a role?
*A complete description of what the players can do
– the set of all possible actions (strategies).
*The information that players have available when
choosing their actions
*A description of the payoff consequences for each
player for every possible combination of actions
chosen by all players playing the game.
*A description of all players’ preferences over
payoffs
Defender
System
Attacker
Strategies
Expected
Damage
Strategies
Payoff
Payoff
Survivable system - system that is able to “complete
its mission in a timely manner, even if significant
portions are incapacitated by attack or accident”.
Multi-state system with
Reliability + vulnerability
different performance rates
analysis
Pr{w>W*}
S(W*)
w
W*
Multi-state System
Combination of Elements
G
System
performance
Two types of functional damage assessment
Damage proportional to the
loss of demand probability
Damage proportional to the
unsupplied demand
D
D
No damage
Damage
Demand
Damage
Demand
No damage
P
Bridge,
Voltage protection
P
Production line,
Power generator
Performance redundancy
System without performance
redundancy
x
x
Pr(Gx)
Demand
No damage
System
performance
Damage
Damage
Demand
System
performance
System with performance
redundancy
Pr(Gx)
Defender
System
Attacker
Strategies
Expected
Damage
Strategies
Payoff
Payoff
System survivability enhancement by element separation
Optimal element separation problem
...
PARAMETERS OF SYSTEM ELEMENTS
N of
element
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
G
A
1.2
1.4
1.6
1.8
2.0
5.0
5.0
2.0
2.5
3.5
1.1
1.1
1.3
1.3
1.4
1.4
0.97
0.95
0.94
0.93
0.98
0.98
0.98
0.99
0.97
0.98
0.98
0.98
0.99
0.99
0.98
0.98
11
1
2
8
6
4
5
13
9
3
7
12
10
14
15
16
OPTIMAL SEPARATION SOLUTION
FOR v=0.05
11
2
3
1
4
5
15
8
6
7
13
9
14
10
12
16
System survivability enhancement by element protection
Survivability optimization problem
...
Optimal system structure
Csystem  min | S system  S *
Functional scheme of system
List of available elements with
given performance distributions
List of chosen elements
Separation and protection of
elements
Survivability and cost of possible
protections
Desired system performance and
survivability
W, S*
System survivability enhancement by deploying false
targets
Limited resource
No information
Defense strategy
Separation
Protection
Damage
Destruction
probability
g
v
False targets
Disinformation
Impact
probability
p
Defender
System
Attacker
Strategies
Expected
Damage
Strategies
Payoff
Payoff
Attacker vs. Disaster
Impact resources
Limited
Unlimited
Impact direction
Strategic (optimal)
Random
Single attack strategy
Perfect knowledge about the system and
ability of impact direction
p=1
No knowledge about the system or
inability of impact direction
p=1/N
Imperfect knowledge
p about the system
p
p
Spi=1
Multiple attack strategy with different
attack options
Vulnerability (destruction probability) as function of
actions’ combination
Set of attacker’s actions
Set of defender’s actions
Game with unconstrained resources
(non-zero sum game)
Losses: d+r
min
Expected damage: D
Attack cost: R
Defense cost: r
Expected damage: d
R
Utility: D-R
max
r
Human lives vs. defense budget dilemma
Political decisions
Expected damage
Losses
r
Defense cost
r
Constrained
Problem
Game with constrained resources
(zero sum game)
max
D
min
Expected damage:
D( attacker’s resource allocation,
R
defender’s resource allocation)
r
The resources are almost always constrained
(defense budgets etc.)
Two period game
Defender moves first
(builds the system over time)
MINMAX:
Defender X: D(X,Y(X))  min
Attacker Y(X): D(X,Y)  max
Simple analytical
models
Complex models
R1
R2
R3 R4
R5
R7
R6
Insight,
General
recommendations
Specific
solutions
Importance of protections
1
4
1
6
6
2
2
11
8
9
12
5
7
3
16
13
10
4
8
7
5
14
9
11
17
3
Single attack with
no knowledge
Single attack with
perfect knowledge
4750
Unlimited
multiple attacks
8500
D
1
4650
2
3
4550
4450
1
D
7500
3
5
5
6
6500
0.2
0.4
v
0.6
0.8
1
2
10400
3
4
5
6
10100
7
7
7
8
8
8
9
5500
10
10
11
11
4500
4250
1
D
2
4
9
4350
10700
4
6
0
10
15
9
9800
10
11
9500
0
0.2
0.4
v
0.6
0.8
1
0
0.2
0.4
v
0.6
0.8
1
Example of optimal defense strategies
1
4
1
6
6
2
2
11
9
10
15
12
7
3
5
16
13
4
10
8
3
7
14
5
9
11
17
5050
Multiple attacks
4850
10000
4650
9500
4450
9000
4250
8500
4050
8000
0
50
Multiple
100
150
O
Single, no inf.
3850
300
D single attack
D multiple attacks.
Expected 11000
damage 10500
Single attack with
no knowledge
8
Single attack with
perfect knowledge
Defense
Single, perfect inf.budget
200
250
Protection vs. separation
D=gpv
=
g
=
v
Protection vs. Redundancy
(separated elements)
=
Vsyst=vN
v
=
N
Redundancy with partial protection
D=dpv
=
v
=
v
Attack on a subset of targets
D=gpv
p v
p v
Protection vs. deployment of false targets
Single element
D=gpv
v p
v
v
p
Other topics studied
•
•
•
•
•
•
•
Preventive strike vs. defense
Dynamic (stockpiling) resources
Intelligence vs. attack strength
Imperfect false targets
Double attack strategies
Protection against attacks and disasters
Multiple consecutive attacks
levitin@iec.co.il
levitin_g@yahoo.com
•
•
•
•
Additional information
Further research
Related papers
Collaboration