Suchergebnisse

Defense Energy Seminar ; In this talk, I will describe recent work in the NPS Center for Infrastructure Defense to assess and improve the operational resilience of critical energy infrastructure systems to either deliberate threats (e.g., attacks, sabotage, vandalism) or non-deliberate hazards (e.g., accidents, failures, natural disasters). We quantify operational resilience for an infrastructure system to a set of disruptive events in terms of degradation of system function. We show how to build and solve a sequence of models to assess and improve the resilience of an infrastructure system to those disruptions. Using notional examples and real applications to the military fuel supply chain the Pacific Theater, I will present insights and lessons learned.

Since Duncan Watts and Steve Strogatz published "Collective Dynamics of Small-World Networks" in Nature in 1998, there has been an explosion of interest in mathematical models of large networks, leading to numerous research papers and books. These works have given us new measures of large networks including hub nodes, broker nodes, connection path length, small-world phenomena, six degrees of separation, power laws of connectivity, and scale-free networks. The National Research Council carried out a study evaluating the emergence of a new area called "network science," which could provide the mathematics and experimental methods for characterizing, predicting, and designing networks. The new area has its share of controversies. An example is whether the power law distribution of number of nodes of given connectivity leads to valid conclusions for real networks. The power law distribution predicts that the network will have hubs—a few nodes with high connectivity—and has led to the claim that such networks are vulnerable to attacks against the hubs. The Internet has been reported to follow power law connectivity but its design resists hub failures. How might we explain this anomaly? David Alderson has become a leading advocate for formulating the foundations of network science so that its predictions can be applied to real networks. He is an assistant professor in the Operations Research Department at the Naval Postgraduate School in Monterey, Calif., where he conducts research with military officer-students on the operation, attack, and defense of network infrastructure systems. We interviewed him to find out what is going on. (Peter Denning, Editor)

The current strategy for achieving resilient infrastructures is making progress too slowly to keep up with the pace of change as evidenced by a continuing stream of "shock" events. How do we better anticipate changing threats and recognize emerging new vulnerabilities in an increasingly interconnected world? We are facing a Strategic Agility Gap that requires us to revise our current perspective and processes if we are to make meaningful progress.

Military Communications Conference (MILCOM 2013), San Diego, CA, November 2013. ; Refereed Article ; Civilian and military networks are continually probed for vulnerabilities. Cyber criminals, and autonomous botnets under their control, regularly scan networks in search of vulnerable systems to co-opt. Military and more sophisticated adversaries may also scan and map networks as part of reconnaissance and intelligence gathering. This paper focuses on adversaries attempting to map a network's \emph{infrastructure}, \ie the critical routers and links supporting a network. We develop a novel methodology, rooted in principles of military deception, for deceiving a malicious traceroute probe and influencing the structure of the network as inferred by a mapping adversary. Our Linux-based implementation runs as a kernel module at a border router to present a deceptive external topology. We construct a proof-of-concept test network to show that a remote adversary using traceroute to map a defended network can be presented with a false topology of the defender's choice.

AbstractThe concept of "resilience analytics" has recently been proposed as a means to leverage the promise of big data to improve the resilience of interdependent critical infrastructure systems and the communities supported by them. Given recent advances in machine learning and other data‐driven analytic techniques, as well as the prevalence of high‐profile natural and man‐made disasters, the temptation to pursue resilience analytics without question is almost overwhelming. Indeed, we find big data analytics capable to support resilience to rare, situational surprises captured in analytic models. Nonetheless, this article examines the efficacy of resilience analytics by answering a single motivating question: Can big data analytics help cyber–physical–social (CPS) systems adapt to surprise? This article explains the limitations of resilience analytics when critical infrastructure systems are challenged by fundamental surprises never conceived during model development. In these cases, adoption of resilience analytics may prove either useless for decision support or harmful by increasing dangers during unprecedented events. We demonstrate that these dangers are not limited to a single CPS context by highlighting the limits of analytic models during hurricanes, dam failures, blackouts, and stock market crashes. We conclude that resilience analytics alone are not able to adapt to the very events that motivate their use and may, ironically, make CPS systems more vulnerable. We present avenues for future research to address this deficiency, with emphasis on improvisation to adapt CPS systems to fundamental surprise.

AbstractThe Mission Dependency Index (MDI) is a risk metric used by US military services and federal agencies for guiding operations, management, and funding decisions for facilities. Despite its broad adoption for guiding the expenditure of billions in federal funds, several studies on MDI suggest it may have flaws that limit its efficacy. We present a detailed technical analysis of MDI to show how its flaws impact infrastructure decisions. We present the MDI used by the US Navy and develop a critique of current methods. We identify six problems with MDI that stem from its interpretation, use, and mathematical formulation, and we provide examples demonstrating how these flaws can bias decisions. We provide recommendations to overcome flaws for infrastructure risk decision making but ultimately recommend the US government develop a new metric less susceptible to bias.

We propose a definition of infrastructure resilience that is tied to the operation (or function) of an infrastructure as a system of interacting components and that can be objectively evaluated using quantitative models. Specifically, for any particular system, we use quantitative models of system operation to represent the decisions of an infrastructure operator who guides the behavior of the system as a whole, even in the presence of disruptions. Modeling infrastructure operation in this way makes it possible to systematically evaluate the consequences associated with the loss of infrastructure components, and leads to a precise notion of "operational resilience" that facilitates model verification, validation, and reproducible results. Using a simple example of a notional infrastructure, we demonstrate how to use these models for (1) assessing the operational resilience of an infrastructure system, (2) identifying critical vulnerabilities that threaten its continued function, and (3) advising policymakers on investments to improve resilience.

AbstractFailure of critical national infrastructures can result in major disruptions to society and the economy. Understanding the criticality of individual assets and the geographic areas in which they are located is essential for targeting investments to reduce risks and enhance system resilience. Within this study we provide new insights into the criticality of real‐life critical infrastructure networks by integrating high‐resolution data on infrastructure location, connectivity, interdependence, and usage. We propose a metric of infrastructure criticality in terms of the number of users who may be directly or indirectly disrupted by the failure of physically interdependent infrastructures. Kernel density estimation is used to integrate spatially discrete criticality values associated with individual infrastructure assets, producing a continuous surface from which statistically significant infrastructure criticality hotspots are identified. We develop a comprehensive and unique national‐scale demonstration for England and Wales that utilizes previously unavailable data from the energy, transport, water, waste, and digital communications sectors. The testing of 200,000 failure scenarios identifies that hotspots are typically located around the periphery of urban areas where there are large facilities upon which many users depend or where several critical infrastructures are concentrated in one location.

Military Operations Research, 18(1), pp. 21-37. ; The article of record as published may be located at http://dx.doi.org/10.5711/1082598318121 ; This paper shows that no simple, common-sense rule of thumb can be used to identify a most-vital arc, even in a simple maximum-flow problem. The correct answer requires analysis equivalent in difficulty to completely solving the maximum-flow problem, perhaps repeatedly. This insight generalizes to finding a most-vital component, or set of components, in a system whose operations is described by a more general model. Our paper shows how to evaluate the criticality of sets of components, how to assess the worst-case set of components that might be lost to a given number of simultaneous hostile attacks (or engineering failures, or losses to Mother Nature), and how to allocate limited defensive resources to minimize the maximum damage from subsequent attack. Collateral insights include the fact that there is no way to prioritize individual components by critically, and the the analysis that determines critical component sets also yields objective assessments of operations system resilience and can provide constructive advice on how to increase it.