Optimal and Near-Optimal Resource Allocation for Information Security and Critical Infrastructure Protection

这笔赠款为研究最佳和接近最佳的战略提供资金，以保护关键基础设施免受智能和适应性强的对手的攻击。 将开发博弈论优化模型，同时考虑要防御的系统的结构（例如，串联和/或并联子系统），以及关于防御者和对手的目标、知识和约束的不同假设。 如果系统过于复杂，无法得到封闭形式的最优结果，则将使用启发式攻击策略进行分析，该策略在各种情况下都接近最优，并以此为基础开发针对这些攻击策略的最优或接近最优防御。如果成功，本研究的结果将为关键基础设施保护的资源分配提供更好的指导。 这项工作的主要目标是确定防御性投资策略，这些策略经过优化，可以抵御具有不同假设目标，知识和约束的攻击者。 例如，攻击者的目标可以包括最大化攻击成功的概率，最大化攻击成功时造成的损害，或者最大化攻击造成的损害的预期值。 类似地，攻击者可能对系统的防御投资具有不同的知识水平，并且具有不同的约束（例如，在检测到并禁用攻击者之前，对失败攻击的数量进行限制。 确定最佳或接近最佳的策略来防御具有不同特征的攻击者，将有助于提高我们关键基础设施的安全性，并降低关键基础设施保护的成本。 这项工作也将有助于复杂系统中的资源分配问题的计算工具和方法。

This grant provides funding for the investigation of optimal and near-optimal strategies for defense of critical infrastructure from an intelligent and adaptable adversary. Game-theoretic optimization models will be developed taking into account the structure of the system to be defended (e.g., series and/or parallel subsystems), and also varying assumptions about the goals, knowledge, and constraints of both the defender and the adversary. Systems that are too complex to yield closed-form optimal results will be analyzing using a heuristic attack strategy that is demonstrably near-optimal for a wide range of cases, as a basis for developing optimal or near-optimal defenses against those attack strategies.If successful, the results of this research will lead to improved guidance for allocation of resources to critical infrastructure protection. The primary goal of this work is to identify defensive investment strategies that are optimized to defend against attackers with varying assumed goals, knowledge, and constraints. For example, attacker goals may include maximizing the probability that an attack succeeds, maximizing the damage caused by an attack if successful, or maximizing the expected value of the damage caused by an attack. Similarly, attackers may have differing levels of knowledge about the system's defensive investments, and differing constraints (e.g., limits on the number of failed attacks before the attacker is detected and disabled. Determining optimal or near-optimal strategies to defend against attackers with varying characteristics will help both to improve the security of our critical infrastructure, and also to reduce the cost of critical infrastructure protection. This work will also contribute to the computational tools and methodologies available for resource allocation problems in complex systems.