1. Defending Complex System Against External Impacts Gregory Levitin (IEC, UESTC)

2. Game Theory vs. Reliability Risk arises from technology, nature, humans. Conventional reliability and risk analysis assume play against static, fixed and immutable factors which are exogenously given. Intentionality plays increasing role (9/11, terrorists’ attacks). Game theory assumes play against adaptable, strategic, optimizing, dynamic agents. Need for combining reliability & risk analysis with game theory

3. System Game Player 1 action x  X Player 2 action y  Y Payoff: P(x,y) Information

4. Five Elements of a Game: The players -how many players are there? -does nature/chance play a role? *A complete description of what the players can do – the set of all possible actions (strategies). *The information that players have available when choosing their actions *A description of the payoff consequences for each player for every possible combination of actions chosen by all players playing the game. *A description of all players’ preferences over payoffs

5. AttackerDefender System Strategies Expected Damage Payoff

6. Survivable system - system that is able to “complete its mission in a timely manner, even if significant portions are incapacitated by attack or accident”. Multi-state system with different performance rates Reliability + vulnerability analysis w Pr{w>W*} W* S(W*)

7. Multi-state System Combination of Element s G System performance

8. Damage proportional to the loss of demand probability Demand Damage Two types of functional damage assessment No damage Damage proportional to the unsupplied demand Demand Damage No damage Production line, Power generator Bridge, Voltage protection P D P D

9. System without performance redundancy Demand System performance Damage System with performance redundancy Demand System performance Damage Performance redundancy No damage x x Pr(G  x)

10. AttackerDefender System Strategies Expected Damage Payoff

11. System survivability enhancement by element separation

12. ... Optimal element separation problem

13. PARAMETERS OF SYSTEM ELEMENTS 1 3 4 2 5 9 8 10 6 7 11 13 14 12 15 16

14. 1 3 4 2 5 9 8 10 11 13 14 12 15 16 6 7 OPTIMAL SEPARATION SOLUTION FOR v=0.05

15. System survivability enhancement by element protection

16. ... Survivability optimization problem

17. Functional scheme of system Desired system performance and survivability W, S* Survivability and cost of possible protections List of available elements with given performance distributions List of chosen elements Separation and protection of elements Optimal system structure

18. System survivability enhancement by deploying false targets Limited resource No information

19. Defense strategy Damage Separation Protection Destruction probability False targets Impact probability Disinformation p g v

20. AttackerDefender System Strategies Expected Damage Payoff

21. Attacker vs. Disaster Impact resources Limited Unlimited Impact direction Strategic (optimal) Random

22. Single attack strategy p=1/N p=1 p Imperfect knowledge about the system pp  p i =1 No knowledge about the system or inability of impact direction Perfect knowledge about the system and ability of impact direction

23. Multiple attack strategy with different attack options

24. Set of attacker’s actionsSet of defender’s actions Vulnerability (destruction probability) as function of actions’ combination

25. Expected damage: D Utility: D-R max Attack cost: R Expected damage: d Losses: d+r min Defense cost: r Game with unconstrained resources (non-zero sum game) Rr

26. Expected damage Losses Defense cost Human lives vs. defense budget dilemma r r Political decisions Constrained Problem

27. Expected damage: D( attacker’s resource allocation, R defender’s resource allocation) r Game with constrained resources (zero sum game) D The resources are almost always constrained (defense budgets etc.) max min

28. Two period game Defender X: D(X,Y(X))  min Attacker Y(X): D(X,Y)  max Defender moves first (builds the system over time) MINMAX MINMAX:

29. Simple analytical models Insight, General recommendations Complex models Specific solutions R1R1 R2R2 R3R3 R4R4 R5R5 R7R7 R6R6

30. Importance of protections 1 3 4 2 5 7 6 8 9 10 13 11 16 15 17 14 12 1 2 3 4 5 6 7 8 9 10 11 Single attack with perfect knowledge Single attack with no knowledge Unlimited multiple attacks

31. Example of optimal defense strategies 1 3 4 2 5 7 6 8 9 10 13 11 16 15 17 14 12 1 2 3 4 5 6 7 8 9 10 11 Single attack with perfect knowledge Single attack with no knowledge Multiple attacks Defense budget Expected damage

32. Protection vs. separation = = D=gpv g v

33. Protection vs. Redundancy (separated elements) = = v V syst =v N N

34. Redundancy with partial protection = = D=dpv v v

35. Attack on a subset of targets D=gpv pv pv

36. Protection vs. deployment of false targets Single element D=gpv v p vp v

37. Other topics studied Preventive strike vs. defense Dynamic (stockpiling) resources Intelligence vs. attack strength Imperfect false targets Double attack strategies Protection against attacks and disasters Multiple consecutive attacks

38. levitin@iec.co.il levitin_g@yahoo.com Additional information Further research Related papers Collaboration