author copy

© 2012 Operational Research Society Ltd. All rights reserved. 0160-5682/12

Journal of the Operational Research Society (2012) 63, 969–981

www.palgrave-journals.com/jors/

Individual versus overarching protection against strategic attacks G Levitin

1,2

3

and K Hausken

1

2

University of Electronic Science and Technology of China, Chengdu, China; The Israel Electric 3 Corporation Ltd., Haifa, Israel; and University of Stavanger, Stavanger, Norway This article considers a system consisting of elements that can be protected and attacked individually and collectively. To destroy the system, the attacker must always penetrate/destroy the collective (overarching) protection. In the case of the parallel system, it also must destroy all elements, whereas in the case of the series system, it must destroy at least one element. Both the attacker and the defender have limited resources and can distribute these freely between the two types of protection. The attacker chooses the resource distribution and the number of attacked elements to maximize the system destruction probability. The defender chooses the resource distribution and the number of protected elements to minimize the system destruction probability. The bi-contest minmax game is formulated and its analytical solutions are presented and analysed. The asymptotical analysis of the solutions is presented. The influence of the game parameters on the optimal defence and attack strategies is discussed.

PY

Journal of the Operational Research Society (2012) 63, 969–981. doi:10.1057/jors.2011.96 Published online 19 October 2011

O

Keywords: vulnerability; defence; attack; redundancy; protection; contest success function

system only if it succeeds in destroying/penetrating the overarching protection and then in destroying the individual protection. Thus, the defender enjoys two-layer defence. However, deploying the overarching protection may be very costly. Having limited defence resources, the defender must distribute them optimally to achieve the lowest possible probability of system destruction. Early work on the balance between individual and overarching protection has been done by Powell (2007) and Haphuriwat and Bier (2009, 2010). Powell considered the allocation of defensive resources between target hardening and border security, assuming discrete attacker target choice. Haphuriwat and Bier considered the defender’s optimal investment in protecting the targets individually and collectively, assuming a conditional probability of a successful attack determined parametrically by a powerlaw function. It was assumed that the attacker chooses a single target and spends all its resources on attacking this target. Korczak et al (2005, 2007) analysed multi-level protection against single and multiple destructive factors in multi-state systems. Accounting for strategic attackers, Golalikhani and Zhuang (2011) allow the defender to protect any subset or arbitrary layers of targets due to functional similarity or geographical proximity. This article also considers systems consisting of elements that can be protected and attacked individually and collectively, but assumes that any number of system

C

1. Introduction

A

U

TH

O

R

For many systems, a balance has to be struck between protecting individual system elements and protecting the system as a whole. For example, a power-generating plant may design protection around its outer boundaries, or may design individual protections of the plant’s various individual components to varying degrees. Similarly, a country may protect its border against other countries (eg Chinese wall, US border towards Mexico), a city may design borders for its surroundings, or assets (eg Fort Knox, water production plants) may be protected individually. Another example of a combination of individual and common (overarching) protection is deploying antiaircraft systems aimed at preventing airborne attacks on objects located in an area and protecting these objects from strikes individually (by using bunkers, protective casings etc). Hiding the targets is a special case of overarching protection, as without detecting the targets the attacker cannot strike them. Overarching protection can alternatively be referred to as group, collective, or outer protection. When an attacker attacks a system that has both individual and overarching protection, it destroys the

Correspondence: K Hausken, Faculty of Social Sciences, University of Stavanger, N-4036 Stavanger, Norway. E-mail: [email protected]

Journal of the Operational Research Society Vol. 63, No. 7

Costs of attacker’s and defender’s effort unit in overarching contest Exponential parameter for the system protection unit cost Intensity of attacker–defender contest for each system element (individual contest) Intensity of attacker–defender contest for the entire system (overarching contest) Defender’s effort superiority parameter in the overarching contest Defender’s effort superiority parameter in the individual contests Element vulnerability Element vulnerability in series system Overarching defence vulnerability System destruction probability in the case of the attack

B, b c m f h g n w V P

2.2. The overarching and individual contests

PY

The attacker and defender have resources R and r and spend their parts X and x, respectively, 0pX, xp1, on attack and protection in the overarching contest. More specifically, the attacker allocates RX at unit cost B to attacking the overarching protection, which gives attack effort RX/B. As the number of elements n increases, the overarching protection becomes more expensive (or more vulnerable). We thus express the protection unit cost as bnc, which increases convexly in n when c41. A constant protection cost is given when c ¼ 0. The defender thus allocates resource rx at unit cost bnc to the overarching protection, which gives protection effort rx/bnc. Applying the ratio form contest success function (Skaperdas, 1996; Tullock, 1980), the system vulnerability is

Variable/ parameter R, r X, x

n k A, a

A

2.1. Notation

U

2. The contest model

TH

O

R

C

elements can be attacked and that both the defender and the attacker optimize their resource distribution strategies. We consider series and parallel systems with individual and overarching protection. In earlier research, Levitin and Hausken (2009a) considered intelligence and impact contests in systems with false targets, and Levitin and Hausken (2009b) considered intelligence and impact contests in systems with redundancy, false targets, and partial protection. An intelligence contest plays a role similar to a contest with overarching attack and defence. Without winning the intelligence contest the attacker cannot attack. If the attacker wins the intelligence contest, it distributes its remaining resources among the individually protected targets. Earlier research has considered one protection layer. Azaiez and Bier (2007) considered optimal resource allocation for combined series/parallel reliability systems. Bier et al (2005) considered protection of systems with differently valued components. Bier et al (2008) analysed the optimal resource allocation for defence of targets based on differing measures of attractiveness. Cox (2009) analysed how to make telecommunications networks resilient against terrorist attacks. Brown et al (2006) considered the defence of critical infrastructures. Zhuang and Bier (2007) analysed target protection against terrorism and natural disasters. Assuming discrete attacker target choice, Powell (2007) considered the allocation of defensive resources between target hardening and border security. For work on border security and the control of weapons of mass destruction, see Avenhaus and Canty (2005), Boros et al (2009), Haphuriwat and Bier (2010), and McLay et al (2011). In this paper, Section 2 presents the contest model. Section 3 solves the model when the defender protects k out of n elements for the parallel system. Section 4 solves the model when the attacker attacks k out of n elements for the series system. Section 5 analyses the solution of the minmax bi-contest game. Section 6 concludes.

O

970

Description

Total attacker’s and defender’s resources Relative fractions of attacker’s and defender’s resources allocated to overarching attack and protection, respectively Number of system elements Number of protected or attacked system elements, 1pkpn Costs of attacker’s and defender’s effort unit in individual contest

V¼

ðRX=BÞ f f

ðRX=BÞ þ

ðrx=bnc Þ f

¼

1 1þ

ðh=nc Þ f ðx=X Þ f

;

ð1Þ

where h ¼ Br/bR expresses the defender’s effort superiority in the overarching contest, qV/qX40, qV/qxo0, and fX0 is the overarching contest intensity. When f ¼ 0, whereas X40 and x40, X and x have no impact on the vulnerability, regardless of their size, which gives vulnerability V ¼ 0.5. When 0ofo1, exerting more effort than one’s opponent gives less advantage in terms of vulnerability than the proportionality of the agents’ efforts specifies. When f ¼ 1, the investments have proportional impact on the vulnerability. When f41, exerting more effort than one’s opponent gives more advantage in terms of vulnerability than the proportionality of the agents’ efforts specifies. Finally, f ¼ N gives a step function where the ‘winner-takes-all’.

G Levitin and K Hausken—Individual versus overarching protection against strategic attacks

The system consists of n elements. If both agents distribute their efforts evenly across the n elements, their efforts on each element are R(1X)/An and r(1x)/an. The element vulnerability is

971

0.5

ð2Þ

P (x,X)

0.4

ðRð1 XÞ=AnÞm v¼ ðRð1 XÞ=AnÞm þðrð1 xÞ=anÞm 1 1x m ; ¼ m 1 þ g 1X

0.3

0.2

where g ¼ Ar/aR expresses the defender’s effort superiority in the contests over individual elements, qv/qXo0, qv/ qx40, and mX0 is the element contest intensity with the same interpretation as f.

0.1

0.95 0 0.05

0.5 0.25

0.45

0.65

X

3. The defender protects k out of n elements for the parallel system

0.85

x

0.05

Figure 1 P ¼ Vvk as functions of x, X for h ¼ 2, g ¼ 0.5, n ¼ 3, c ¼ k ¼ m ¼ f ¼ 1.

3.1. Solving the model

O

PY

analytical results obtained above were confirmed by a numerical optimization procedure. As an example, Figure 1 presents (3) as a function P(x, X) for h ¼ 2, g ¼ 0.5, n ¼ 3, c ¼ k ¼ m ¼ f ¼ 1. It can be seen that the saddle point resides at x ¼ X ¼ 0.4, which fits (4).

C

Assume for the parallel system that the defender protects k out of n elements, 1pkpn, evenly distributing the protection effort among the elements. The attacker attacks all n elements (otherwise the system always survives) and destroys all unprotected elements for certain with negligible effort. Thus, for each protected element, the defender’s effort is r(1x)/(ak) and the attacker’s effort is R(1X)/(An). The system is destroyed if the attacker succeeds to destroy k protected elements. This gives the system vulnerability

3.2. Analysing the extreme cases

1 1 P ¼ Vv ¼ h f x f gnm 1x m k ; 1 þ nc X 1þ k 1X

ð3Þ

O

R

k

U

TH

which is equivalent to Levitin’s (2009, p 47) Equation (5) when n ¼ k ¼ 1 and c ¼ 0. The defender chooses x and k that minimize Vvk, whereas the attacker chooses X that maximizes Vvk. For any chosen k, the first-order conditions are solved in the Appendix (Theorem and Corollary 2) f

fh ð1 þ ðgn=kÞ Þ ; ð4Þ fh f ð1 þ ðgn=kÞm Þ þ kmðgn=kÞm ðncf þ h f Þ

A

x¼X ¼

m

which is inserted into (3) to yield P ¼ Vvk ¼

1 1þ

ðh=nc Þf

1 m k

ð1 þ ðgn=kÞ Þ

:

ð5Þ

Equation (5) allows us to obtain the optimal k numerically as a function of h, f, g, m, and n. To prove rigorously that the obtained point is the saddle point of function (3), one has to prove that the Hessian matrix of this function is indefinite. Whereas the analytical proof is too complicated and has not been obtained, the

When the defender has no means for the overarching protection, h ¼ 0, (4) gives x ¼ X ¼ 0, which means that there is no overarching contest. For h ¼ 0, (5) gives P¼

1 ð1 þ ðgn=kÞm Þ

k

:

ð6Þ

When f ¼ 0, x ¼ X ¼ 0, which means that when the outcome of the overarching contest does not depend on the agents’ efforts, both agents can spend negligible resources on this contest and concentrate on individual contests. For f ¼ 0, (5) gives P¼

1 2ð1 þ ðgn=kÞm Þ

k

:

ð7Þ

Note that the cases with h ¼ 0 and f ¼ 0 are not identical. In the former case, the attacker penetrates the overarching protection with negligible resource for certain, meeting no resistance. In the latter case, both agents allocate negligible resources into the overarching contest and both outcomes of this contest are equally likely.


P¼

1 1 þ ðh=nc Þf

ð8Þ

:

When m ¼ 0, (4) gives x ¼ X ¼ 1, which means that when the outcome of the individual contests does not depend on the agents’ efforts, both agents avoid spending resources on the individual contest and concentrate on overarching contests. For m ¼ 0, (5) gives P¼

1

2k 1 þ ðh=nc Þf

:

ð9Þ

In the case of g ¼ 0, the attacker destroys all the system elements with negligible efforts if it penetrates the overarching protection, whereas when m ¼ 0, each agent spends negligible efforts on the individual contests and the outcomes of each of these contests are determined by chance (with probability 1/2). When the attacker has no means for the overarching attack (h ¼N) or for the individual attacks (g ¼N), the system survives for certain: P ¼ 0. Expression (4) can be represented in the form 1 f

ð10Þ

: m 1þðk=gnÞ m

R

1þk

ðnc =hÞf þ1

C

x¼X ¼

A

U

TH

O

From this expression and expression (5) it can be seen that Limm!1 X ¼ Limm!1 x ¼ 0 and Limm!1 P ¼ 0 when kogn and Limm!1 X ¼ Limm!1 x ¼ 1 and Limm!1 P ¼ 1=ð1 þ ðh=nc Þf Þ when k4gn. The defender’s choice of kogn guarantees system survival for extremely highly intensive individual contests. If go1/n, the defender can never achieve the inequality kogn; both agents concentrate their efforts on the overarching contest and

Table 1 Parallel system destruction probability P for the extreme values of m and f

kogn, kogn, kogn, k4gn, k4gn, k4gn, k=gn, k=gn, k=gn,

h4nc honc h=nc h4nc honc h=nc h4nc honc h=nc

f=m=0

f=N, m=0

f=0, m=N

m=f=N

2k1 2k1 2k1 2k1 2k1 2k1 2k1 2k1 2k1

0 2k 2k1 0 2k 2k1 0 2k 2k1

0 0 0 1/2 1/2 1/2

0 0 0 0 1 1/2 0 2k 2k1

k1

2 2k1 2k1

if the defender loses this contest the entire system is destroyed for certain. It can also be seen that Limf !1 X ¼ Limf !1 x ¼ 0 k and Limf !1 P ¼ 1=ð1 þ ðgn=kÞm Þ when nc4h and Limf !1 X ¼ Limf !1 x ¼ 1 and Limf !1 P ¼ 0 when ncoh. In the former case, the overarching protection is too expensive for the defender. It has no chances of winning the overarching contest and concentrates all its efforts on the individual contests. In the latter case, the defender can concentrate enough efforts to win the overarching contest for certain and can guarantee the system survival without protecting the elements individually. The values of the system destruction probability P for the extreme values of the contest intensities are presented in Table 1. We can observe from (5) that, for any fixed k, Limn!1 P ¼ 0 when g40 and m40. From (10) it follows that Limn!1 x ¼ Limn!1 X ¼ 0 when c40 and Limn!1 X ¼ Limn!1 x ¼ 1=ð1 þ kmf 1 ðhf þ 1ÞÞ when c ¼ 0. The agents allocate resources exclusively to protection and attack of individual elements as the number of parallel elements approaches infinity, and the defender enjoys zero vulnerability because of the substantial redundancy. When n is infinite, the defender can drive the system destruction probability to zero through individual protection, making the overarching protection irrelevant. This result follows since the attacker needs to attack all elements in a parallel system to make it vulnerable. A large c (strong convexity for the defender effort unit cost in the overarching contest) does not change this result since the beneficial impact for the defender of infinitely many redundant elements makes the overarching protection unnecessary.

PY

When the defender has no means for the individual protection, g ¼ 0, (4) gives x ¼ X ¼ 1, which means that there is no overarching contest. For g ¼ 0, (5) gives

O

972

4. The attacker attacks k out of n elements for the series system 4.1. Solving the model Let us assume for the series system that the attacker strikes k out of n elements. The defender protects all n elements (otherwise the attacker destroys the system for certain, striking all n elements with negligible non-zero effort) and enjoys zero destruction probability for all unattacked elements. Thus, for each attacked element, the defender’s effort is r(1x)/an and the attacker’s effort is R(1X)/Ak. The system is destroyed if at least one out of k attacked elements is destroyed. The system vulnerability is P ¼ Vð1 ð1 vÞk Þ 0 ¼

1þ

1 B h f x f @1 nc

X

1 1þ

1 C 1X m n m k A; 1x

gk

ð11Þ


which is equivalent to (3) when n ¼ k ¼ 1 and c ¼ 0. The defender chooses x and k that minimize V(1(1v)k), whereas the attacker chooses X that maximizes V(1(1v)k). For any chosen k, the first-order conditions are solved in the Appendix (Theorem and Corollary 2):

¼

fhf 1 þ

fh 1 þ m n gk

m n gk

1þ

1þ

m k n gk

m k n gk

1

; m n 1 þ km gk ðncf þ hf Þ ð12Þ

which is inserted into (11) to yield P ¼Vð1 ð1 vÞk Þ 0 ¼

1þ

nc

1þ

1 þ ðh=nc Þf

ð17Þ

:

When m ¼ 0, (4) gives x ¼ X ¼ 1, which means that when the outcome of the individual contests does not depend on the agents’ efforts, both agents avoid spending resources on the individual contest and concentrate on overarching contests. For m ¼ 0, (13) gives 1 P¼ 1 k : 2 1 þ ðh=nc Þf 1

1

1 B h f @1

1

P¼

1 C m k A:

ð13Þ

n gk

ð18Þ

In the case of g ¼ 0, the attacker destroys all the system elements with negligible efforts if it penetrates the overarching protection, whereas when m ¼ 0, each agent spends negligible efforts on the individual contests and the outcomes of each of these contests are determined by chance (with probability 1/2). When the attacker has no means for the overarching attack (h ¼N) or for the individual attacks (g ¼N), the system survives for certain: P ¼ 0. From (14) and (13), it can be seen that Limm!1 X ¼ Limm!1 x ¼ 0 and Limm!1 P ¼ 0 when nokg and Limm!1 X ¼ Limm!1 x ¼ 1 and Limm!1 P ¼ 1=ð1 þ ðh=nc Þf Þ when n4kg. The attacker always tries to choose kon/g that avoids guaranteed system survival for extremely highly intensive individual contests. If g4n,

4.2. Analysing the extreme cases

O

Expression (12) can be represented in the form

1þ

f c þ1 k ðn =hÞ f

TH

1

x¼X ¼

R

C

Again, the analytical proof that the Hessian matrix of function (11) is indefinite is too complicated and has not been obtained. The analytical results obtained above were confirmed by a numerical optimization procedure. As an example, Figure 2 presents (11) as a function P(x, X) for h ¼ 2, g ¼ 0.5, n ¼ 3, c ¼ k ¼ m ¼ f ¼ 1. It can be seen that the saddle point resides at x ¼ X ¼ 0.737, which fits (12).

PY

f

The cases with h ¼ 0 and f ¼ 0 are not identical. The explanation is identical to that for the case of parallel system. When the defender has no means for the individual protection, g ¼ 0, (14) gives x ¼ X ¼ 1, which means that there is no overarching contest. For g ¼ 0, (13) gives

O

x¼X

973

m k ð1þðgk=nÞm Þðð1þðn=gkÞm Þ 1Þ

:

ð14Þ 0.8

P¼1

1 m k

ð1 þ ðn=gkÞ Þ

:

ð15Þ

When f ¼ 0, x ¼ X ¼ 0, which means that when the outcome of the overarching contest does not depend on the agents’ efforts, both agents can spend negligible resources on this contest and concentrate on individual contests. For f ¼ 0, (13) gives

0.6 P (x,X )

A

U

When the defender has no means for the overarching protection, h ¼ 0, (12) gives x ¼ X ¼ 0, which means that there is no overarching contest. For h ¼ 0, (13) gives

0.4

0.2 0.85 0 0.45

0.05

x

0.3 0.55 X

P¼

1 2ð1 þ ðgn=kÞm Þ

k

:

ð16Þ

0.05 0.8

k

Figure 2 P ¼ V(1(1v) ) as functions of x, X for h ¼ 2, g ¼ 0.5, n ¼ 3, c ¼ k ¼ m ¼ f ¼ 1.


Limf !1 P ¼ 1 1=ð1 þ ðn=gkÞm Þ

k

c

when n 4h and

Limf !1 X ¼ Limf !1 x ¼ 1 and Limf !1 P ¼ 0 when ncoh. Similar to the parallel system, in the former case the overarching protection is too expensive for the defender. It has no chances of winning the overarching contest and concentrates all its efforts on the individual contests. In the latter case, the defender can concentrate enough efforts to win the overarching contest for certain and guarantee the system survival without protecting the elements individually. The values of the system destruction probability P for the extreme values of the contest intensities are presented in Table 2. We can observe in (12) that Limn!1 x ¼ Limn!1 X ¼ 1, and in (13) that Limn!1 P ¼ 1=ð1 þ hf Þ when c ¼ 0 and Limn!1 P ¼ 1 when c40. This is the largest vulnerability that the attacker can enjoy with infinitely many elements, which makes the individual protection and attack of each

Table 2 Series system destruction probability P for the extreme values of m and f m=f=N

(12k)/2 (12k)/2 (12k)/2 (12k)/2 (12k)/2 (12k)/2 (12k)/2 (12k)/2 (12k)/2

0 12k (12k)/2 0 12k (12k)/2 0 12k (12k)/2

0 0 0 1/2 1/2 1/2 (12k)/2 (12k)/2 (12k)/2

0 0 0 0 1 1/2 0 (12k) (12k)/2

R

O

TH

0.15

Parallel System

Parallel System

0.12

A

0.6

Figures 3 and 4 present optimal x and corresponding P as functions of h for different f and c and n ¼ 5, m ¼ 1 for the parallel and series systems. In both cases, the defender prefers to protect all its five elements and the attacker prefers to attack all five elements. It can be seen that both agents spend more resources on the overarching contest when the defender’s effort superiority in this contest h increases. The defender always benefits from the increase of h. If the system protection cost is relatively small (c ¼ 0), the attacker benefits from the increase of f when h is low, and the defender benefits from the increase of f when h is high. The agents concentrate more resources on the overarching contest when f increases. If the system protection is expensive (c ¼ 2), the attacker always benefits from the increase of f, and the agents concentrate less resources on the overarching contest when f increases. Figure 5 presents optimal x and k and corresponding P as functions of g for different m and c and n ¼ 5, f ¼ h ¼ 1. P decreases towards zero, according to (5) and (11), for both the parallel and series systems. For the parallel system, k increases towards k ¼ n ¼ 5, causing the defender to protect all elements when superior. For the series

C

f=0, m=N

5. Analysing the solutions

U

h4nc honc h=nc h4nc honc h=nc h4nc honc h=nc

f=N, m=0

0.4

P

0.09

x

nogk, nogk, nogk, n4gk, n4gk, n4gk, n=gk, n=gk, n=gk,

f=m=0

element irrelevant. Instead, both agents allocate resources exclusively to overarching attack and protection as the number of series elements approaches infinity. This result is driven by the defender’s exposure in a series system when required to protect each element individually. The defender prefers the overarching protection to avoid the costly protection of each individual element. The attacker benefits from the convexly increasing defender effort unit in the overarching contest.

PY

the attacker can never achieve the inequality kon/g and has no chances to destroy the system. It can also be seen that Limf !1 X¼ Limf !1 x ¼ 0 and

O

974

0.06 0.2 0.03 0

0 0

1

2 h

3

4

0

1

2 h

3

4

f=0.5,c=0

f=1,c=0

f=2,c=0

f=0.5,c=0

f=1,c=0

f=2,c=0

f=0.5,c=2

f=1,c=2

f=2,c=2

f=0.5,c=2

f=1,c=2

f=2,c=2

Figure 3 x and corresponding P in parallel system as functions of h for different f and c and n ¼ 5, m ¼ 1, g ¼ 0.5.


1

1

Series System

0.8

0.6

0.6

Series System

x

P

0.8

975

0.4

0.4

0.2

0.2

0

0 0

1

2 h

3

4

0

1

2 h

3

4

f=0.5,c=0

f=1,c=0

f=2,c=0

f=0.5,c=0

f=1,c=0

f=2,c=0

f=0.5,c=2

f=1,c=2

f=2,c=2

f=0.5,c=2

f=1,c=2

f=2,c=2

Figure 4 x and corresponding P in series system as functions of h for different f and c and n ¼ 5, m ¼ 1, g ¼ 2.

O

PY

the existence of n protected parallel elements. The attacker benefits from the increase of m, which makes the element vulnerability v in (2) more sensitive to g. With the increase of m up to some point both agents concentrate more efforts on the individual contests (x and X decrease). From some value of m the defender cannot afford itself protection of all the elements, especially when g is low. It decreases the number of protected elements and achieves the per-element effort superiority by sacrificing the unprotected elements. From this point, the defender benefits from increase of m. P is thus inverse U-shaped in m when go0.5, and decreases throughout in m when gX0.5. The agents’ allocation x ¼ X to overarching protection is relatively low for all m and g, and has an overall decreasing tendency in m, approaching zero as m reaches infinity, consistent with the transition from protecting all five elements when m is small, to protecting fewer elements when m is large. The defender has an advantage in parallel systems. Infinitely large individual contest intensity induces the defender to defend one element, and the attacker then has to attack this one element, making overarching defence and attack irrelevant. x ¼ X also decreases in g. As the defender becomes more inferior with lower g, it relies on protecting each element individually instead of overarching protection, causing the attacker to face individual protection. A low g ¼ 0.25 and an intermediate mE1.2 is especially detrimental for the defender causing large P. The agents then have substantial challenges in striking a balance between overarching and individual protection. The defender handles this challenge by decreasing k quickly from 5 to 1 as m increases. During this transition there is a modest increase in x ¼ X, and x ¼ X thereafter decreases as the agents focus on the one protected element. We then consider the case gok/n, where k/n ¼ 0.2 for k ¼ 1 and n ¼ 5. When the defender is very inferior in the individual contests exemplified with g ¼ 0.125, and m approaches infinity, it prefers the overarching protection

A

U

TH

O

R

C

system, k decreases to 1 when m ¼ 2 for both c ¼ 0 and c ¼ 2; it is sufficient for the attacker to attack one element, and for intensive contests it is wise for the attacker to attack one element. When m ¼ 0.5 and m ¼ 1, k ¼ n ¼ 5; for less intensive contests, the attacker attacks all the series elements, regardless how superior the defender is, inducing the defender to protect all elements. The overarching protection and attack x ¼ X have an overall decreasing tendency in g for both the parallel and series systems, because with the increase of the defender’s resource superiority in the individual contests g the defender concentrates more resources on individual protection and the attacker also must concentrate more resources on individual attacks to have a chance to destroy the system. We can observe from (3) that when g ¼N, P ¼ 0 for any xo1, m40, and k40, which means that, in this case, the agent’s strategies do not matter. The only defender’s strategy is to allocate any non-zero resource to each individual contest. Thus, Limg!1 x is undefined. (Analogously for h: when h ¼N, P ¼ 0 for any x40, f40.) Figure 6 presents optimal x and k and corresponding P as functions of m for different g and n ¼ 5, f ¼ c ¼ h ¼ 1. For both the parallel and series systems, k decreases towards 1 when m increases, reflecting that it is sufficient for the defender to protect one element in the parallel system and it is sufficient for the attacker to attack one element in the series system (except when g ¼ 1 for the parallel system, where the numerical procedure cannot distinguish P for k ¼ 1 and k ¼ 2 as P is very close to 0). We first consider the parallel system and the case g4k/n. When the individual contest intensity is relatively small, the defender prefers to protect all elements even though it suffers from the per-element effort inferiority (which takes place when the defender’s effort superiority parameter is not too high, go2, which means that it cannot preserve the per-element effort superiority when it dissipates its resource among all elements). This inferiority is compensated by

976


6

Parallel System

0.5

5

0.4

4

0.3

3

k

x

0.6

0.2

2

0.1

1

0

Parallel System

0 0

1

2

3

0

1

g

2

3

g

m=0.5,c=0

m=1,c=0

m=2,c=0

m=0.5,c=0

m=1,c=0

m=2,c=0

m=0.5,c=2

m=1,c=2

m=2,c=2

m=0.5,c=2

m=1,c=2

m=2,c=2

0.8

1

Parallel System

Series System

0.8

0.6

x

P

0.6 0.4

0.4 0.2

0

0 1

2 g

3

4

m=1,c=0

m=2,c=0

m=0.5,c=2

m=1,c=2

m=2,c=2

C

m=0.5,c=0

6

Series System

5

4

8 g

12

16

m=0.5,c=0

m=1,c=0

m=2,c=0

m=0.5,c=2

m=1,c=2

m=2,c=2

1

Series System

R

0.8

3

TH

2 1 0

4

U

0

8 g

0.6

P

O

4

k

0

O

0

PY

0.2

0.4 0.2 0

12

16

0

4

8 g

12

16

m=1,c=0

m=2,c=0

m=0.5,c=0

m=1,c=0

m=2,c=0

m=0.5,c=2

m=1,c=2

m=2,c=2

m=0.5,c=2

m=1,c=2

m=2,c=2

A

m=0.5,c=0

Figure 5 Optimal x and k and corresponding P in the parallel and series systems as functions of g for different m and c and n ¼ 5, f ¼ h ¼ 1.

as shown with x approaching one as m approaches infinity, and P approaches 5/6 concavely, in accordance with Section 3.2. In the case of the series system when gon/k, exemplified with the three curves gp4 when m is above a minimum, the contest intensity is relatively small and the attacker prefers to attack all elements even though it suffers from

the per-element effort inferiority. This inferiority is compensated by the greater probability that at least one out of n attacked elements is destroyed. The defender benefits from the increase of m, which makes element vulnerability more sensitive to the effort ratio. With the increase of m, both agents concentrate more efforts on individual contests. From some value of m the attacker cannot afford itself


1

977

6

Parallel System

Parallel System 5

0.8

4

x

k

0.6 0.4

3 2

0.2

1 0

0 0

5

10 m

g=0.125

15

g=0.25

20

g=0.5

0

5 g=0.125

g=1

10 m

15

20

g=0.25

g=0.5

g=1

1

0.8 Parallel System

0.8

0.6

x

P

0.6 0.4

0.4 0.2

0.2

0

0 0

5

10 m g=0.25

20

g=0.5

g=1

6

5

10

g=1

15 m

g=2

20

25

g=4

30 g=8

0.8

C

5

R

3

O

2

TH

1

P

0.6

4

k

0

O

g=0.125

15

PY

Series System

0.4 0.2 Series System

Series System

0 0

5

U

g=1

10

15 m g=2

20 g=4

0 25

30 g=8

0

5 g=1

10

15 m g=2

20 g=4

25

30 g=8

A

Figure 6 x and k and corresponding P as functions of m for different g and n ¼ 5, f ¼ c ¼ h ¼ 1.

attacking all the elements. It decreases the number of attacked elements and achieves the per-element effort superiority by concentrating on fewer elements. From this point, the attacker benefits from the increase of m. For the series system, the attacker’s choice of k corresponds to the defender’s choice of k in the parallel system. Thus, we can observe how k decreases in m, but decreases more quickly when the defender enjoys a large g (in contrast to the parallel system). Also, correspondingly, P is U-shaped in m when g41, and increases throughout in m when gp1. The attacker suffers low P when g is large and m is

intermediate. For the series system, the agents’ allocation x ¼ X to overarching protection is relatively high, except when the attacker suffers from large g and intermediate m. x ¼ X approaches one as m reaches infinity, and the attacker prefers attacking one element. If the other elements are not protected, they are destroyed by negligible effort. Hence the defender prefers the overarching protection to protect the entire series system, and the attacker has to transit to overarching attack, and enjoys P ¼ 5/6, as determined by (13), when m approaches infinity. The attacker has an advantage in the series systems.


Figure 8 presents optimal x and k and corresponding P as functions of n for different c and f ¼ m ¼ 2, g ¼ h ¼ 1. As was shown in Sections 3.2 and 4.2, for the parallel system, P decreases towards 0 and x ¼ X decreases towards 0 for any c40. When c ¼ 0 for the given parameters, x ¼ X approaches 1/(1 þ 2k/(1 þ (k/n)2)). As k(n)En/2, x ¼ XE1/ (1 þ 0.8n). x ¼ X decreases in c. As the overarching protection becomes more expensive for the defender, increasing convexly in n, the defender switches to protection of individual elements. For the series system, x ¼ X eventually increases towards 1 and P increases towards 1 for any c40. When c ¼ 0, P increases towards the constant Limn!1 P ¼ 1=ð1 þ h f Þ ¼ 0:5. Again x ¼ X decreases in c. Interestingly, for cX1, x ¼ X first decreases in n as the defender cannot accept the convexly increasing protection unit cost. However, as n exceeds a certain threshold, protecting each element individually in the series system (which is required for the defender to ensure system functionality) becomes unacceptably costly, and the defender resorts to the overarching protection instead, which is also costly. The defender thus suffers P close to 1.

0.04

O

1

PY

When g4n/k for the series system exemplified with g ¼ 8, the defender’s superiority enables enjoying P ¼ 0 as m approaches infinity. Furthermore, x ¼ X approaches 0 as m approaches infinity inducing both agents to protect and attack one element individually in an intensive contest. Figure 7 presents optimal x and corresponding P as functions of f for different h and n ¼ 5, m ¼ c ¼ g ¼ 1. In the considered range of parameters, k always equals five for both the parallel and series systems. The intensity parameter f for the overarching contest operates in the same manner for both systems. Hence for both systems when nc4h, exemplified with the three curves hp4, x ¼ X is inverse U-shaped and approaches 0, and P increases concavely towards a constant. k The constant is Limf !1 P ¼ 1=ð1 þ ðgn=kÞm Þ ¼ 5 2 ¼ 0:03125 for the parallel system, where the defender enjoys low destruction probability, and Limf !1 P ¼ 1 k 1=ð1 þ ðn=gkÞm Þ ¼ 1 25 ¼ 0:96875 for the series system, where the attacker enjoys high destruction probability, in accordance with Sections 3.2 and 4.2. When ncoh, exemplified with h ¼ 8, x ¼ X increases towards 1 and P decreases towards 0.

0.8

C

0.03

R

x

0.6

O

0.4

P

978

0.01

Parallel System

0 0

5

TH

0.2

10

h=2

20

Parallel System 0

25

h=4

30

0

h=8

10

15 f h=2

20

25

h=4

30 h=8

1

A

1

5 h=1

U

h=1

15 f

0.02

0.8

0.6

0.6

x

P

0.8

0.4

0.4

0.2

0.2 Series System

Series System 0

0 0

5 h=1

10 h=2

15 f

20 h=4

25

30 h=8

0

5 h=1

10 h=2

15 f

20 h=4

25

30 h=8

Figure 7 Optimal x and corresponding P as functions of f for different h and n ¼ 5, m ¼ c ¼ g ¼ 1.


979

15 0.5

Parallel System

Parallel System 12 9

0.3

k 6

0.2

3

0.1 0

0 0

5 c=0

10 n c=1

15

20

0

c=2

5 c=0

10 n c=1

15

20 c=2

1

0.25

Parallel System

Series System 0.8

0.2

0.6

x

P

0.15 0.1

0.4

0.05

0.2 0

0 5 c=0

10 n c=1

15

20

0

5

c=0

c=2

O

0

PY

x

0.4

15

10 n c=1

15

20 c=2

1

Series System

C

Series System 12

0.8

O

6

0 0

TH

3

5

U

c=0

10 n c=1

P

k

R

9 0.6

0.4

0.2 15

20 c=2

0

5 c=0

10 n c=1

15

20 c=2

A

Figure 8 x and k and corresponding P as functions of n for different c and f ¼ m ¼ 2, g ¼ h ¼ 1.

6. Conclusion We consider series and parallel systems that are protected by both individual and overarching protections such that any attack can succeed only if both the two types of protection are destroyed or penetrated. It is assumed that an attacker and a defender have limited resources, and distribute them optimally, trying to maximize (in the case of the attacker) and minimize (in the case of the defender) the probability of system destruction. The attack–defence

contest for each type of protection is modelled using a contest success function that relates the attack success probability to the attack–defence effort ratio and the contest intensity parameter. For the minmax game, analytical solutions are obtained that allow one to analyse the influence of the game parameters on the optimal agents’ resource distributions and the system destruction probability. The asymptotic analysis of the solutions is presented and the behaviour of the solutions for some realistic parameters is demonstrated.


The presented results demonstrate the influence of the game parameters on the optimal defence and attack strategies that cannot be anticipated based on the intuitive reasoning. In particular, the non-monotonic dependence of the resource distribution parameter on the contest intensities and on the number of system elements is demonstrated. In many practical situations, the values of the contest intensities cannot be exactly determined. Therefore, it would be useful to suggest a practical way to determine the optimal defence strategy for certain intervals of the contest intensity parameters m and f. Further research can be devoted to this problem.

Levitin G and Hausken K (2009b). Intelligence and impact contests in systems with redundancy, false targets, and partial protection. Reliability Engineering & System Safety 94(12): 1927–1941. McLay LA, Lloyd JD and Niman E (2011). Interdicting nuclear material on cargo containers using knapsack problem models. Annals of Operations Research 33(9): 747–759. Powell R (2007). Defending against terrorist attacks with limited resources. American Political Science Review 101(3): 527–541. Skaperdas S (1996). Contest success functions. Economic Theory 7: 283–290. Tullock G. (1980). Efficient rent-seeking. In: Buchanan JM, Tollison RD and Tullock G (eds). Toward a Theory of the Rent-seeking Society. Texas A. & M. University Press, College Station, pp 97–112. Zhuang J and Bier VM (2007). Balancing terrorism and natural disasters—Defensive strategy with endogenous attacker effort. Operations Research 55(5): 976–991.

Appendix Theorem Let fðX; xÞ ¼ F

X ¼ x ¼

ðA:1Þ

F 0 ð1ÞGð1Þ F 0 ð1ÞGð1Þ þ G 0 ð1ÞFð1Þ

ðA:2Þ

and

fðX ; x Þ ¼ Fð1ÞGð1Þ:

R

O

TH

U

A

x 1 x G X 1X

for differentiable F and G, and (X, x ) be a Nash saddle point of f. Then, we have

C

Avenhaus R and Canty M (2005). Playing for time: A sequential inspection game. European Journal of Operational Research 167(2): 475–492. Azaiez N and Bier VM (2007). Optimal resource allocation for security in reliability systems. European Journal of Operational Research 181: 773–786. Bier VM, Haphuriwat N, Menoyo J, Zimmerman R and Culpen AM (2008). Optimal resource allocation for defense of targets based on differing measures of attractiveness. Risk Analysis 28(3): 763–770. Bier VM, Nagaraj A and Abhichandani V (2005). Protection of simple series and parallel systems with components of different values. Reliability Engineering and System Safety 87: 315–323. Boros E, Fedzhora L, Kantor P, Saeger K and Stroud P (2009). A large-scale linear programming model for finding optimal container inspection strategies. Naval Research Logistics 56(5): 404–420. Brown GG, Carlyle WM, Salmeroń J and Wood K (2006). Defending critical infrastructure. Interfaces 36(6): 530–544. Cox LA (2009). Making telecommunications networks resilient against terrorist attacks (Chapter 8). In: Bier VM, Azaiez MN (eds). Game Theoretic Risk Analysis of Security Threats. Springer: New York, pp 175–198. Golalikhani M and Zhuang J (2011). Modeling arbitrary layers of continuous-level defenses in facing with strategic attackers. Risk Analysis 31(4): 533–547. Haphuriwat N and Bier VM (2009). Tradeoffs between target hardening and overarching protection. INFORMS Annual Meeting. San Diego, CA, 11–14 October 2009. Haphuriwat N and Bier VM (2010). Tradeoffs between target hardening and overarching protection. PhD Thesis, University of Wisconsin-Madison. Korczak E and Levitin G (2007). Survivability of systems under multiple factor impact. Reliability Engineering & System Safety 92(2): 269–274. Korczak E, Levitin G and Ben Haim H (2005). Survivability of series-parallel systems with multilevel protection. Reliability Engineering & System Safety 90(1): 45–54. Levitin G (2009). Optimal distribution of constrained resources in bi-contest detection-impact game. International Journal of Performability Engineering 5(1): 45–54. Levitin G and Hausken K (2009a). Intelligence and impact contests in systems with fake targets. Defense and Security Analysis 25(2): 157–173.

PY

References

O

980

ðA:3Þ

For (X, x ) we have

Proof

F qf ðX ; x Þ ¼ qx

0

x 1x G 1X X X

G0

1x 1X

F Xx

1 X

¼0 ðA:4Þ

and qf ðX ; x Þ ¼ qX þ

F0

x 1x G 1X x X

ðX Þ2 1x x G 0 1X ð1 x Þ F X

¼ 0:

ðA:5Þ

1x F 0 Xx G 1X x 1x : X ¼ x ¼ 0 x 1x F X G 1X þ F X G 0 1X

ðA:6Þ

ð1 X Þ2

Solving (A.4) and (A.5) together we get


From (A.6) it follows that F(x /X ) ¼ F(1), F (x /X ) ¼ F 0 (1), G((1x )/(1X )) ¼ G(1), G 0 ((1x )/ (1X )) ¼ G0 (1), which yields

Corollary 2 For

0

X ¼ x ¼

0 fðX; xÞ ¼

0

F ð1ÞGð1Þ F 0 ð1ÞGð1Þ þ G 0 ð1ÞFð1Þ

981

ðA:7Þ

1þ

1

1 B h f x f @1 nc

X

1þ

1 C 1X m n m k A 1x

gk

x ¼ X

and

fðX ; x Þ ¼ Fð1ÞGð1Þ;

ðA:8Þ

which completes the proof. &

m m k n n 1 þ gk fhf 1 þ gk 1 ¼ m m k m n n n 1 þ km gk ðncf þ h f Þ 1 þ gk fh f 1 þ gk ðA:10Þ

Corollary 1 For fðX; xÞ ¼

x ¼ X ¼

1þ

fh f ð1

1 h f x f nc

X

1þ

1 1x m gnm k 1X

f(X, x) ¼ F(x/X)G((1x)/(1X)),

Proof Representing where

k

fh f ð1 þ ðgn=kÞm Þ ; þ ðgn=kÞm Þ þ kmðgn=kÞm ðncf þ h f Þ ðA:9Þ

F ðx=X Þ ¼

1 1þ

ðh=nc Þf ðx=X Þf

PY

and 1x ¼1 G 1X

1þ

A

k

TH

U

we get (A.9) from (A.7). &

O

1x 1 ¼ G 1x m gnm k 1X 1þ

R

and

1X

1x

gk

we get (A.10) from (A.7). &

1 ðh=nc Þf ðx=X Þ f

C

F ðx=X Þ ¼

1þ

O

f(X, x) ¼ F(x/X)G((1x)/(1X)),

Proof Representing where

1 1X m n m k :

Received August 2010; accepted July 2011 after one revision