Defense Resource Allocation Research Articles

Towards a Cognitive Theory of Cyber Deception.

This work is an initial step toward developing a cognitive theory of cyber deception. While widely studied, the psychology of deception has largely focused on physical cues of deception. Given that present-day communication among humans is largely electronic, we focus on the cyber domain where physical cues are unavailable and for which there is less psychological research. To improve cyber defense, researchers have used signaling theory to extended algorithms developed for the optimal allocation of limited defense resources by using deceptive signals to trick the human mind. However, the algorithms are designed to protect against adversaries that make perfectly rational decisions. In behavioral experiments using an abstract cybersecurity game (i.e., Insider Attack Game), we examined human decision-making when paired against the defense algorithm. We developed an instance-based learning (IBL) model of an attacker using the Adaptive Control of Thought-Rational (ACT-R) cognitive architecture to investigate how humans make decisions under deception in cyber-attack scenarios. Our results show that the defense algorithm is more effective at reducing the probability of attack and protecting assets when using deceptive signaling, compared to no signaling, but is less effective than predicted against a perfectly rational adversary. Also, the IBL model replicates human attack decisions accurately. The IBL model shows how human decisions arise from experience, and how memory retrieval dynamics can give rise to cognitive biases, such as confirmation bias. The implications of these findings are discussed in the perspective of informing theories of deception and designing more effective signaling schemes that consider human bounded rationality.

Development and Yield Traits Indicate That the Constitutive Wound Response Phenotype of Prosystemin Overexpressing Tomato Plants Entails No Fitness Penalty

Systemin is a peptide hormone that regulates the wound response in tomato plants. Consequently, the overexpression of its prosystemin (ProSys) precursor protein leads to a resource-demanding constitutive activation of tomato’s wound-response. According to the growth vs. defense resource allocation premise, ProSys overexpression should negatively affect the physiological fitness of tomato plants. The present study was performed to explore why the opposite effect was steadily observed, instead. It was based on the premise that a better understanding of this unexpected outcome could help establish improved wound and related defense responses without negatively affecting crop productivity. To this effect, an experimental strategy was deployed to measure various physiological, biochemical and molecular parameters associated with either development, productivity, defense or in combination in untransformed (WT) and ProSys overexpressing (ProSys-OE) tomato plants. Thus, the chlorophyll fluorescence data obtained from plants grown under greenhouse experiments indicated that photosynthetic performance was not affected in ProSys-OE plants which also grew 7–14% taller than WT plants. Moreover, they showed accelerated flowering and yielded fruits of increased size (7–16% taller and wider) and weight (16–58% heavier), with modified fruit quality in terms of firmness (28% higher), titratable acidity (27–32% higher) and chemical composition. These findings suggest two complementary possibilities: (i) systemin is able to modulate both the wound response and plant development through the activation of jasmonic acid biosynthesis and signaling, and (ii) ProSys, an intrinsically disordered protein, acts as a signaling hub to regulate development and defense programs. These results shed light on the understanding of this plant regulatory mechanism and further suggest that systemin/ProSys-based regulation is central to control the defense-development balance in tomato. This knowledge could eventually lead to improved and more environmentally sound agricultural production practices.

Community vulnerability perspective on robust protection planning in interdependent infrastructure networks

Critical infrastructure networks, including water, power, communication, and transportation, among others, are necessary to society’s functionality. In recent years, the threat of different types of disruptions to such infrastructure networks has become an increasingly important problem to address. Due to existing interdependencies, damage to a small area of one of the networks could have far-reaching effects on the ability to meet demand across the entire system. Common disruption scenarios include, among others, intentional malevolent attacks, natural disasters, and random failures. Similar works have focused on only one type of scenario, but combining a variety of disruptions may lead to more realistic results. Additionally, the concept of social vulnerability, which describes an area’s ability to prepare for and respond to a disruption, must be included. This should promote not only the protection of the most at-risk components but also ensure that socially vulnerable communities are given adequate resources. This work provides a decision making framework to determine the allocation of defensive resources that accounts for all these factors. Accordingly, we propose a multi-objective mathematical model with the objectives of: (i) minimizing the vulnerability of a system of interdependent infrastructure networks, and (ii) minimizing the total cost of the resource allocation strategy. Moreover, to account for uncertainty in the proposed model, this paper incorporates a means to address robustness in finding the most adaptable network protection plan to reduce the vulnerability of the system of interdependent networks to a variety of disruption scenarios. The proposed work is illustrated with an application to social vulnerability and interdependent power, gas, and water networks in Shelby County, Tennessee.

The Impact of Performance Budgeting on Defense Resource Allocation

Performance information utilization is an important method to improve budget efficiency and organizational performance. The nature of performance budgeting is to apply performance information to the budgeting process. Research on the impact of government or department performance budgeting on resource allocation has always been controversial. On the one hand, there are many external interference factors in government or department for integrating performance information and budget; on the other hand, there are defects in the generation and quality of performance information of public organizations, and the impact of performance information at different levels on resource allocation is quite different. Therefore, the objective of this paper is to study the impact of based-program performance budgeting within the department on resource allocation. The U.S. Department of Defense, as the largest single department entity in the world, is typical in integrating performance information and budget processes. Using data from the U.S. Department of Defense for fiscal years 2010-2017, this study finds that performance information at the program level within the department has a positive impact on defense resource allocation. Therefore, the integration of performance information into the budgeting process can improve sector budget in spite of political constraints. However, there are many constraints and organizational differences to successfully integrate performance information into the budgeting process in departmental budgeting.

Research on Robustness of Critical information infrastructure Based on Attack-Defensive Game Model

Because the traditional network robustness research ignores the confrontation process and information asymmetry conditions, this paper analyzes the impact of information asymmetry conditions on the robustness and simulates the information asymmetry conditions through a perturbation model. Based on the stackelberg game, an attack-defensive game model under asymmetric information is established, by solving the game equilibrium solution, the defensive resource allocation strategy that optimizes the network robustness is obtained. The simulation results show that when attack resources are scarce, the attacker tends to respond with a low priority attack; when the attack resources are abundant, the attacker tends to have a high priority attack response. Under the mixed defensive strategy corresponding to the equilibrium solution of the game, the optimization rate of the defender's robustness payoff compared with the expected return under the pure strategy reached 4% to 12%.

Technology adoption for airport security: Modeling public disclosure and secrecy in an attacker-defender game

Airport security agencies throughout the world play a vital role in safeguarding the aviation industry against terrorist attacks. As a result of the evolving and adaptive behaviors of terrorists, it is critical that security agencies continue to adopt new airport screening technologies in order to expose and deter threats. To this end, the question arises as to whether or not to publicly disclose new screening technology adoption. Although there is literature on strategic information disclosure in defensive resource allocation, to the best of our knowledge, no previous literature has focused on modeling disclosure and secrecy for defensive technology adoption. To address this gap, we develop an attacker-defender game model where the defender is considering adopting a new screening technology, and an adversary is considering attacking an aviation target. Our model addresses two distinct information disclosure strategies on behalf of the defender: (i) public disclosure, which is modeled in a sequential subgame, and (ii) secrecy, which is modeled in a simultaneous subgame. We find that in the proposed complete information game, disclosure of the defender’s technology adoption strategy is either preferred to, or equivalent to, maintaining secrecy. That is to say that the defender never prefers secrecy over disclosure. Overall, this paper helps to fill a significant gap in the literature concerning technology adoption and information disclosure strategies for airport security screening, and also has implications that can inform decision makers in the broader homeland security domain. Historical data is used to drive numerical sensitivity analyses of the equilibrium strategies.

Defensive Resource Allocation: The Roles of Forecast Information and Risk Control.

In defensive resource allocation problems, the defender usually collects some forecast information about the attacker. However, the forecast information may be incorrect, which means that there could be a risk associated with the defender using it in their decision making. In this article, we propose a forecast and risk control (FRC) framework to manage the risk in defensive resource allocation with forecast information. In the FRC framework, we introduce a new measure of risk and three types of defense plans: riskless defense plan, risky defense plan, and risk-control defense plan. Several desirable properties based on the concepts of reward and penalty show that the risk-control defense plan is a general form to support defensive resource allocation. Subsequently, we study a specific defensive allocation problem with forecast information and develop an optimization model that considers the forecast information and the defender's risk tolerance level in order to obtain the risk-control defense plan with maximum reward. Furthermore, we provide some numerical analysis to illustrate the effects of forecast information and risk tolerance level on the risk-control defense plan. Finally, a numerical case study is presented to demonstrate the usability of a risk-control defense plan.

Counterfactual regret minimization for integrated cyber and air defense resource allocation

This research presents a new application of optimal and approximate solution techniques to solve resource allocation problems with imperfect information in the cyber and air-defense domains. We develop a two-player, zero-sum, extensive-form game to model attacker and defender roles in both physical and cyber space. We reformulate the problem to find a Nash equilibrium using an efficient, sequence-form linear program. Solving this linear program produces optimal defender strategies for the multi-domain security game. We address large problem instances with an application of the approximate counterfactual regret minimization algorithm. This approximation reduces computation time by 95% while maintaining an optimality gap of less than 3%. Our application of discounted counterfactual regret results in a further 36% reduction in computation time from the base algorithm. We develop domain insights through a designed experiment to explore the parameter space of the problem and algorithm. We also address robust opponent exploitation by combining existing techniques to extend the counterfactual regret algorithm to include a discounted, constrained variant. A comparison of robust linear programming, data-biased response, and constrained counterfactual regret approaches clarifies trade-offs between exploitation and exploitability for each method. The robust linear programming approach is the most effective, producing an exploitation to exploitability ratio of 10.8 to 1.

Modeling multi-target defender-attacker games with quantal response attack strategies

Due to the growing interest in incorporating behavioral models within the defender-attacker game literature, the perfect rationality assumption of adversaries has been relaxed in many recent works. This paper studies four multi-target defensive resource allocation in defender-attacker games by using a quantal response model, in which the attacker might be bounded rational. We compare the results from the proposed models with the traditional game theoretic model where the attacker behaves rationally. Moreover, we studied the impacts of the attacker’s rationality level on the defender’s optimal defense strategies. Real data from the Urban Areas Security Initiative (UASI) and the Global Terrorism Database (GTD) are employed to estimate the rationality parameter as well as numerically illustrate the model. The results show that: (a) in the quantal response model, the defender’s expected loss at equilibrium increases with the attacker’s rationality parameter and the expected loss approach the results from the game theoretic model; (b) when the attacker’s rationality parameter in the quantal response model approaches infinity, both the equilibrium defensive allocation and expected loss approach to the results from the game theoretic model; (c) when the attacker uses quantal response while the defender falsely believes that the attacker uses game theoretic response, the expected loss will be similar to the model where both players utilize game theoretic response, but higher than the expected loss from the model where both players use quantal response; (d) when the attacker uses game theoretic response while the defender falsely believes that the attacker uses quantal response, the expected equilibrium loss will be higher than the ones from the other three scenarios; and (e) the quantal response model gives a closer resource allocation to the real allocation than the game theoretic model does. This paper provides some novel insights to defensive resource allocation when considering that the attacker is bounded rationality.

An Attacker-defender Resource Allocation Game with Substitution and Complementary Effects.

The United States is funding homeland security programs with a large budget (e.g., 74.4 billion for FY 2019). A number of game-theoretic defender-attacker models have been developed to study the optimal defense resource allocation strategies for the government (defender) against the strategic adversary (attacker). However, to the best of our knowledge, the substitution or complementary effects between different types of defensive resources (e.g., human resource, land resource, and capital resource) have not been taken into consideration even though they exist in practice. The article fills this gap by studying a sequential game-theoretical resource allocation model and then exploring how the joint effectiveness of multiple security investments influences the defensive budget allocation among multiple potential targets. Three false belief models have been developed in which only the defender, only the attacker, and both the defender and attacker hold false beliefs about the joint effectiveness of resources. Regression analysis shows that there are significant substitution effects between human and capital resources. The results show that the defender will suffer a higher loss if he fails to consider the substitution or complementary effects. Interestingly, if the attacker holds a false belief while the defender does not, the defender will suffer an even higher loss, especially when the resources are substitutes. However, if both the attacker and defender hold false beliefs, there will be lower loss when resources are complementary. The results also show that the defender should allocate the highly effective resource when the resources substitute each other. This article provides some new insights to the homeland security resourceallocation.

Optimal defense resource allocation for attacks in wireless sensor networks based on risk assessment model

Abstract To solve the unreasonable allocation problem of network security defense resource, this paper presents a framework for optimal defense resource allocation for minimizing the network risk. The vulnerability power function model of network nodes is built based on nonlinear theory between defense resource and network vulnerability. The network risk assessment model is described by vulnerability model combining with local and global information of node. Numerical studies demonstrate that the strategies are optimum in terms of protection and redundancy allocation of network nodes. Simulation results show that our algorithm achieves the optimum allocation strategies of defense resource. Furthermore, network risk can quickly converge to a lower value.

A Cybersecurity Insurance Model for Power System Reliability Considering Optimal Defense Resource Allocation

With the increasing application of Information and Communication Technologies (ICTs), cyberattacks have become more prevalent against Cyber-Physical Systems (CPSs) such as the modern power grids. Various methods have been proposed to model the cybersecurity threats, but so far limited studies have been focused on the defensive strategies subject to the limited security budget. In this paper, the power supply reliability is evaluated considering the strategic allocation of defense resources. Specifically, the optimal mixed strategies are formulated by the Stackelberg Security Game (SSG) to allocate the defense resources on multiple targets subject to cyberattacks. The cyberattacks against the intrusion-tolerant Supervisory Control and Data Acquisition (SCADA) system are mathematically modeled by Semi-Markov Process (SMP) kernel. The intrusion tolerance capability of the SCADA system provides buffered residence time before the substation failure to enhance the network robustness against cyberattacks. Case studies of the cyberattack scenarios are carried out to demonstrate the intrusion tolerance capability. Depending on the defense resource allocation scheme, the intrusion-tolerant SCADA system possesses varying degrees of self-healing capability to restore to the good state and prevent the substations from failure. If more defense resources are invested on the substations, the intrusion tolerant capability can be further enhanced for protecting the substations. Finally, the actuarial insurance principle is designed to estimate transmission companies’ individual premiums considering correlated cybersecurity risks. The proposed insurance premium principle is designed to provide incentive for investments on enhancing the intrusion tolerance capability, which is verified by the results of case studies.

Sex-Related Differences in Growth, Herbivory, and Defense of Two Salix Species

Sex-related differences in sex ratio, growth, and herbivory are widely documented in many dioecious plants. The common pattern is for males to grow faster than females and to be less well-defended against herbivores, but Salix is an exception. To study sex-related differences in the patterns of resource allocation for growth and defense in willows, we conducted a large-scale field experiment to investigate the flowering sex ratio, mortality, growth traits, insect herbivory and content of defensive substances in three Salix populations comprising two species. Results demonstrate that the two Salix suchowensis Cheng populations have a female bias in the sex ratio, whereas no bias is found in the S. triandra L. population. Male individuals in the S. suchowensis populations have significantly higher mortality rates than females. However, the mortality rate of S. triandra population has no gender difference. This finding may be one of the explanations for the difference in sex ratio between the two species. The females are larger in height, ground diameter, and biomass, and have a higher nutritional quality (N concentration) than males in both species. Nevertheless, slow-growing males have a higher concentration of the defense chemical (total phenol) and lower degrees of insect herbivory than females. Additionally, biomass is positively correlated with herbivory and negatively correlated with defense in the two willow species. It is concluded that the degrees of herbivory would have a great influence on resource allocation for growth and defense. Meanwhile, it also provides important implications for understanding the evolution of dioecy.

Orchestrating DDoS mitigation via blockchain-based network provider collaborations

Abstract Network providers either attempt to handle massive distributed denial-of-service attacks themselves or redirect traffic to third-party scrubbing centers. If providers adopt the first option, it is sensible to counter such attacks in their infancy via provider collaborations deploying distributed security mechanisms across multiple domains in an attack path. This motivated our work presented in this paper. Specifically, we investigate the establishment of trusted federations among adjacent and disjoint network domains, that is, autonomous systems (ASes) that collectively mitigate malicious traffic. Our approach is based on Distributed Ledger Technologies for signaling, coordination, and orchestration of a collaborative mitigation schema via appropriate blockchain-based smart contracts. Reputation scores are used to rank ASes based on their mitigation track record. The allocation of defense resources across multiple collaborators is modeled as a combinatorial optimization problem considering reputation scores and network flow weights. Malicious flows are mitigated using programmable network data paths within the eXpress Data Path (XDP) framework; this enables operators with enhanced packet processing throughput and advanced filtering flexibility. Our schema was implemented in a proof-of-concept prototype and tested under realistic network conditions.

Defensive Resource Allocation Method for Improving Survivability of Communication and Information System in CPPS Against Cyber-attacks

With the widespread use of communication and information technology, power system has been evolving into cyber-physical power system (CPPS) and becoming more vulnerable to cyber-attacks. Therefore, it is necessary to enhance the ability of the communication and information system in CPPS to defend against cyber-attacks. This paper proposes a method to enhance the survivability of the communication and information system in CPPS. Firstly, the communication and information system for critical business of power system is decomposed into certain types of atomic services, and then the survivability evaluation indexes and their corresponding calculation method for the communication and information system are proposed. Secondly, considering the efficacy and cost defensive resources, a defensive resource allocation model is proposed to maximize the survivability of communication and information system in CPPS. Then, a modified genetic algorithm is adopted to solve the proposed model. Finally, the simulation results of CPPS for an IEEE 30-node system verify the proposed method.

A Linearization Method in the “Attack–Defense” Game with Nonhomogeneous Opponent Resources

A nonhomogeneous generalization of the “attack–defense” game is considered. A linearization method is proposed to determine the best guaranteed outcome (BGO) of defense. The linearization utilizes a decomposition of the solution in a small parameter in the neighborhood of the trivial uniform distribution of defense resources. We show that the determination of correcting perturbations to the trivial uniform allocation of defense resources is reducible to a linear program. A prototype example to construct the correcting perturbations is considered.

PPBE: Research on Operation and Latest Development

PPBE (Planning-Planning-Budget-Execution System), is a multi-year, overlapping and rolling budget cycle process, which consists of four phases of planning, programming, budgeting, and execution. The purpose of PPBE is to establish a link between policy objectives and budgeting and form an effective defense resource allocation system with optimized combination of manpower, equipment, and support under certain resource constraints. Since the 1960s, PPBE has continued to make revisions and reforms with increasing changes of political, institutional environment. There were three important reforms, Laird reform, The Goldwater-Nichols Defense Restructuring Act, and Rumsfeld Reform. Since Rumsfeld's reform, the adjustment and development of PPBE is mainly to improve the efficiency of resource. Although budget management has its own emphasis in different periods, last development of PPBE is mainly flexibility, conciseness, and efficiency improvement. This paper reviews the evolution process and the latest development by historical analysis. After more than 60 years of evolution and development, PPBE continues to play an important strategic management function in the US Department of Defense. The study found that PPBE is more challenging for large organizations to maintain normal operation and improve adaptability and responsiveness in uncertain environments. In the 21st century of conflict and uncertainty, it would be long-time challenge for PPBE to trade off increasing defense demand and decreasing financial constraints. Therefore, it is worthy of further studying how to improve the budget capability of PPBE participants in the future.

Defending a parallel system against a strategic attacker with redundancy, protection and disinformation

Motivated by the defense of a power grid control center against cyber-attacks, this research considers the optimal allocation of defense resources for defending a parallel system consisting of identical elements. To enhance the system survivability, the defender distributes its limited resources to provide redundancy, disinform the attacker, and protect system elements. Correspondingly, the attacker allocates its limited resources to intelligence actions and impact contests. The defender determines the optimal number of genuine elements and false elements to deploy and the optimal amount of resources used for disinformation actions. The attacker seeks to maximize the system damage by taking the defender's strategy as given and allocating its resources optimally into intelligence actions and impact contests. Two types of parallel systems are considered: (1) where the system damage is defined as the probability of system failure, and (2) where the system damage is defined as the unsupplied demand of the system. Due to the complexity of the optimization model, we analyze the optimal defense strategy under various parameter settings via numerical methods. The results provide useful insights on how to defend such a system under different situations.

Behavioral Determinants of Target Shifting and Deterrence in an Analog Cyber-Attack Game.

This study examines how exploiting biases in probability judgment can enhance deterrence using a fixed allocation of defensive resources. We investigate attacker anchoring heuristics for conjunctive events with missing information to distort attacker estimates of success for targets with equal defensive resources. We designed and conducted a behavioral experiment functioning as an analog cyber attack with multiple targets requiring three stages of attack to successfully acquire a target. Each stage is associated with a probability of successfully attacking a layer of defense, reflecting the allocation of resources for each layer. There are four types of targets that have nearly equal likelihood of being successfully attacked, including one type with equally distributed success probabilities over every layer and three types with success probabilities that are concentrated to be lowest in the first, second, or third layer. Players are incentivized by a payoff system that offers a reward for successfully attacked targets and a penalty for failed attacks. We collected data from a total of 1,600 separate target selections from 80 players and discovered that the target type with the lowest probability of success on the first layer was least preferred among attackers, providing the greatest deterrent. Targets with equally distributed success probabilities across layers were the next least preferred among attackers, indicating greater deterrence for uniform-layered defenses compared to defenses that are concentrated at the inner (second or third) levels. This finding is consistent with both attacker anchoring and ambiguity biases and an interpretation of failed attacks as near misses.

Robust Optimization for Microgrid Defense Resource Planning and Allocation Against Multi-Period Attacks

This paper investigates a microgrid defense resource planning and allocation problem with the consideration of multi-period attacks. The defensive transmission lines and distributed generators (DGs) are, respectively, planned and allocated to mitigate the multi-period attack damage on transmission lines and minimize the shed loads for microgrid, based on a multi-period defender–attacker–defender model. Robust optimization technique is utilized for the problem formulation, resulting in a two-stage decision process: in the first stage, the defender proposes defensive line plan and DG allocation scheme for the purpose of minimizing the attacker’s damage; and in the second stage, the attacker disrupts the transmission lines of microgrid system aiming at the maximum damage by the multi-period attacks, then the defender reacts to optimize the power flow on the remaining microgrid system to minimize the shed loads. Solution process is developed based on the customized column-and-constraint generation algorithm. The effectiveness and superiority of the proposed model and algorithm are validated with numerical experiments. In addition, sensitivity analysis is also carried out with various parameters and settings.