optimization for cyber-security and protecting critical infrastructure

In the past few years, I’ve been working on cyber-security and infrastructure protection research by applying stochastic programming and network interdiction methodologies. My department posted a news article about my research with former PhD student Kay Zheng that you can read here. The research was supported by the National Science Foundation #1422768

My oldest daughter helped me make a short (and campy) youtube video about my cyber-security research. It looks like a movie trailer simply because my daughter likes making movie trailers. I’d totally see this summer blockbuster 😉

The abstracts and links to my papers in cyber-security are below:

Zheng, K., Albert, L., Luedtke, J.R., Towle, E. 2019. A budgeted maximum multiple coverage model for cybersecurity planning and management, To appear in IISE Transactions. DOI: 10.1080/24725854.2019.1584832

Abstract: This article studies how to identify strategies for mitigating cyber-infrastructure vulnerabilities. We propose an optimization framework that prioritizes the investment in security mitigations to maximize the coverage of vulnerabilities. We use multiple coverage to reflect the implementation of a layered defense, and we consider the possibility of coverage failure to address the uncertainty in the effectiveness of some mitigations. Budgeted Maximum Multiple Coverage (BMMC) problems are formulated, and we demonstrate that the problems are submodular maximization problems subject to a knapsack constraint. Other variants of the problem are formulated given different possible requirements for selecting mitigations, including unit cost cardinality constraints and group cardinality constraints. We design greedy approximation algorithms for identifying near-optimal solutions to the models. We demonstrate an optimal (1–1/e)-approximation ratio for BMMC and a variation of BMMC that considers the possibility of coverage failure, and a 1/2-approximation ratio for a variation of BMMC that uses a cardinality constraint and group cardinality constraints. The computational study suggests that our models yield robust solutions that use a layered defense and provide an effective mechanism to hedge against the risk of possible coverage failure. We also find that the approximation algorithms efficiently identify near-optimal solutions, and that a Benders branch-and-cut algorithm we propose can find provably optimal solutions to the vast majority of our test instances within an hour for the variations of the proposed models that consider coverage failures.

Zheng, K., and Albert, L.A. A robust approach for mitigating risks in cyber supply chains, To appear in Risk Analysis. DOI: 10.1111/risa.13269

In recent years, there have been growing concerns regarding risks in federal information technology (IT) supply chains in the United States that protect cyber infrastructure. A critical need faced by decisionmakers is to prioritize investment in security mitigations to maximally reduce risks in IT supply chains. We extend existing stochastic expected budgeted maximum multiple coverage models that identify “good” solutions on average that may be unacceptable in certain circumstances. We propose three alternative models that consider different robustness methods that hedge against worst‐case risks, including models that maximize the worst‐case coverage, minimize the worst‐case regret, and maximize the average coverage in the ( 1 − α ) worst cases (conditional value at risk). We illustrate the solutions to the robust methods with a case study and discuss the insights their solutions provide into mitigation selection compared to an expected‐value maximizer. Our study provides valuable tools and insights for decisionmakers with different risk attitudes to manage cybersecurity risks under uncertainty.

Zheng, K., and Albert, L.A. Interdiction models for delaying adversarial attacks against critical information technology infrastructure. To appear in Naval Research Logistics.

Information technology (IT) infrastructure relies on a globalized supply chain that is vulnerable to numerous risks from adversarial attacks. It is important to protect IT infrastructure from these dynamic, persistent risks by delaying adversarial exploits. In this paper, we propose max‐min interdiction models for critical infrastructure protection that prioritizes cost‐effective security mitigations to maximally delay adversarial attacks. We consider attacks originating from multiple adversaries, each of which aims to find a “critical path” through the attack surface to complete the corresponding attack as soon as possible. Decision‐makers can deploy mitigations to delay attack exploits, however, mitigation effectiveness is sometimes uncertain. We propose a stochastic model variant to address this uncertainty by incorporating random delay times. The proposed models can be reformulated as a nested max‐max problem using dualization. We propose a Lagrangian heuristic approach that decomposes the max‐max problem into a number of smaller subproblems, and updates upper and lower bounds to the original problem via subgradient optimization. We evaluate the perfect information solution value as an alternative method for updating the upper bound. Computational results demonstrate that the Lagrangian heuristic identifies near‐optimal solutions efficiently, which outperforms a general purpose mixed‐integer programming solver on medium and large instances.

Zheng, K., and Albert, L.A. An exact algorithm for solving the bilevel facility interdiction and fortification problem. Operations Research Letters 46(6), 573 – 578.

We present an exact approach for solving the r-interdiction median problem with fortification. Our approach consists of solving a greedy heuristic and a set cover problem iteratively that guarantees to find an optimal solution upon termination. The greedy heuristic obtains a feasible solution to the problem, and the set cover problem is solved to verify optimality of the solution and to provide a direction for improvement if not optimal. We demonstrate the performance of the algorithm in a computational study.