A General Framework for the Assessment of Power System Vulnerability to Malicious Attacks

The protection and safe operations of power systems heavily rely on the identification of the causes of damage and service disruption. This article presents a general framework for the assessment of power system vulnerability to malicious attacks. The concept of susceptibility to an attack is employed to quantitatively evaluate the degree of exposure of the system and its components to intentional offensive actions. A scenario with two agents having opposing objectives is proposed, i.e., a defender having multiple alternatives of protection strategies for system elements, and an attacker having multiple alternatives of attack strategies against different combinations of system elements. The defender aims to minimize the system susceptibility to the attack, subject to budget constraints; on the other hand, the attacker aims to maximize the susceptibility. The problem is defined as a zero‐sum game between the defender and the attacker. The assumption that the interests of the attacker and the defender are opposite makes it irrelevant whether or not the defender shows the strategy he/she will use. Thus, the approaches “leader–follower game” or “simultaneous game” do not provide differences as far as the results are concerned. The results show an example of such a situation, and the von Neumann theorem is applied to find the (mixed) equilibrium strategies of the attacker and of the defender.     

Resource Distribution in Multiple Attacks Against a Single Target

A target is protected by the defender and attacked by an attacker launching sequential attacks. For each attack, a contest intensity measures whether the agents’ efforts have low or high impact on the target vulnerability (low vs. high contest intensity). Both the defender and the attacker have limited resources. It is assumed that the attacker can observe the outcome of each attack and stop the sequence of attacks when the target is destroyed. Two attacker objectives are considered, that is, to maximize the target vulnerability or to minimize the expected attacker resource expenditure. The article addresses the following three questions: whether the attacker should allocate its entire resource into one large attack or distribute it among several attacks; whether geometrically increasing or decreasing resource distribution into a fixed number of sequential attacks is more beneficial than equal resource distribution; and how the optimal attack strategy depends on the contest intensity.     

Defender–Attacker Games with Asymmetric Player Utilities

The presence of strategic attackers has become an important factor in the security and protection of systems, especially since the 9/11/2001 attacks, and considerable efforts have been dedicated to its study. When defending against the strategic attacker, many existing studies assume that the attacker would seek to minimize the defender's utility, which implies that the defender and attacker have symmetric utilities. However, the attacker's objective is determined by its own valuation of the system and target of the attack, which is not necessarily consistent with the defender's utility. If the attacker unexpectedly targets a different utility, then the defense strategy might no longer be optimal. In particular, the defense strategy could be inferior if the attacker's utility is not known to the defender. This study considers a situation where the defender's utility is the system survivability and the attacker's utility is the expected number of destroyed elements in the system. We investigate possible attack strategies under these two different utilities and compare (a) the conservative defense strategy when the attack utility is unknown to the defender with (b) the optimal defense strategy when the attack utility is known to the defender. We show that the conservative protection strategy is still optimal under asymmetric utilities when the contest intensity is smaller than one.     

Supply Performance in Multi‐Echelon Inventory Systems with Intermediate Product Demand: A Perspective on Allocation

In this article, we study the performance of multi‐echelon inventory systems with intermediate, external product demand in one or more upper echelons. This type of problem is of general interest in inventory theory and of particular importance in supply chain systems with both end‐product demand and spare parts (subassemblies) demand. The multi‐echelon inventory system considered here is a combination of assembly and serial stages with direct demand from more than one node. The aspect of multiple sources of demands leads to interesting inventory allocation problems. The demand and capacity at each node are considered stochastic in nature. A fixed supply and manufacturing lead time is used between the stages. We develop mathematical models for these multi‐echelon systems, which describe the inventory dynamics and allow simulation of the system. A simulation‐based inventory optimization approach is developed to search for the best base‐stock levels for these systems. The gradient estimation technique of perturbation analysis is used to derive sample‐path estimators. We consider four allocation schemes: lexicographic with priority to intermediate demand, lexiographic with priority to downstream demand, predetermined proportional allocation, and proportional allocation. Based on the numerical results we find that no single allocation policy is appropriate under all conditions. Depending on the combinations of variability and utilization we identify conditions under which use of certain allocation polices across the supply chain result in lower costs. Further, we determine how selection of an inappropriate allocation policy in the presence of scarce on‐hand inventory could result in downstream nodes facing acute shortages. Consequently we provide insight on why good allocation policies work well under differing sets of operating conditions.     

Efficient Allocation of Resources for Defense of Spatially Distributed Networks Using Agent‐Based Simulation

This article presents ongoing research that focuses on efficient allocation of defense resources to minimize the damage inflicted on a spatially distributed physical network such as a pipeline, water system, or power distribution system from an attack by an active adversary, recognizing the fundamental difference between preparing for natural disasters such as hurricanes, earthquakes, or even accidental systems failures and the problem of allocating resources to defend against an opponent who is aware of, and anticipating, the defender's efforts to mitigate the threat. Our approach is to utilize a combination of integer programming and agent‐based modeling to allocate the defensive resources. We conceptualize the problem as a Stackelberg “leader follower” game where the defender first places his assets to defend key areas of the network, and the attacker then seeks to inflict the maximum damage possible within the constraints of resources and network structure. The criticality of arcs in the network is estimated by a deterministic network interdiction formulation, which then informs an evolutionary agent‐based simulation. The evolutionary agent‐based simulation is used to determine the allocation of resources for attackers and defenders that results in evolutionary stable strategies, where actions by either side alone cannot increase its share of victories. We demonstrate these techniques on an example network, comparing the evolutionary agent‐based results to a more traditional, probabilistic risk analysis (PRA) approach. Our results show that the agent‐based approach results in a greater percentage of defender victories than does the PRA‐based approach.     

Behavioral Modeling of Adversaries with Multiple Objectives in Counterterrorism

Attacker/defender models have primarily assumed that each decisionmaker optimizes the cost of the damage inflicted and its economic repercussions from their own perspective. Two streams of recent research have sought to extend such models. One stream suggests that it is more realistic to consider attackers with multiple objectives, but this research has not included the adaption of the terrorist with multiple objectives to defender actions. The other stream builds off experimental studies that show that decisionmakers deviate from optimal rational behavior. In this article, we extend attacker/defender models to incorporate multiple objectives that a terrorist might consider in planning an attack. This includes the tradeoffs that a terrorist might consider and their adaption to defender actions. However, we must also consider experimental evidence of deviations from the rationality assumed in the commonly used expected utility model in determining such adaption. Thus, we model the attacker's behavior using multiattribute prospect theory to account for the attacker's multiple objectives and deviations from rationality. We evaluate our approach by considering an attacker with multiple objectives who wishes to smuggle radioactive material into the United States and a defender who has the option to implement a screening process to hinder the attacker. We discuss the problems with implementing such an approach, but argue that research in this area must continue to avoid misrepresenting terrorist behavior in determining optimal defensive actions.     

Facilitating Redundancy‐Oriented Management with Gene‐Therapy‐Oriented Management Against Disaster

This article tests the hypothesis that “if redundancy‐oriented management has negative aspects, then it could be facilitated by gene‐therapy‐oriented management.” Negative aspects include disadvantages, misjudgments, or miscalculations. The article provides a newly revised principle of disaster management by studying gene‐therapy‐oriented management. Based on qualitative analysis, redundancy‐oriented and gene‐therapy‐oriented management are analyzed via five variables: governments, business, volunteers, households, and the international community. The article is valuable because an analytical frame on gene‐therapy‐oriented management is systematically reconceptualized for the field of disaster management via three elements: unhealthy proteins (problems or failed measures), a vector (new or modified solutions), and target cells (positive outcomes). In accepting the hypothesis, the key tenet is that stakeholders have to assist the progress of redundancy‐oriented management with gene‐therapy‐oriented management by paying attention to the genes of each disaster.     

Resource Distribution in Multiple Attacks with Imperfect Detection of the Attack Outcome

This article extends the previous research of consecutive attacks strategy by assuming that an attacker observes the outcome of each attack imperfectly. With given probabilities it may wrongly identify a destroyed target as undestroyed, and wrongly identify an undestroyed target as destroyed. The outcome of each attack is determined by a contest success function that depends on the amount of resources allocated by the defender and the attacker to each attack. The article suggests a probabilistic model of the multiple attacks and analyzes how the target destruction probability and the attacker's relative resource expenditure are impacted by the two probabilities of incorrect observation, the attacker's and defender's resource ratio, the contest intensity, the number of attacks, and the resource distribution across attacks. We analyze how the attacker chooses the number of attacks, the attack stopping rule, and the optimal resource distribution across attacks to maximize its utility.     

Defense Resource Distribution Between Protection and Redundancy for Constant Resource Stockpiling Pace

The article considers the optimal resource distribution in a parallel system between increasing protection and providing redundancy in a situation when the attacker's and defender's resources are stockpiling and the resource increment rate is constant. It is assumed that the system must perform within an exogenously given time horizon and the attack time probability is uniformly distributed along this horizon. The defender optimizes the resource distribution in order to minimize the system destruction probability during the time horizon. First, we find the optimal pace of construction of the new redundant elements assuming that the construction must start in the initial stage of the stockpiling process. We show that starting construction of new elements in the beginning of the system's existence results in its high initial vulnerability. Introducing the time delay before starting the construction can reduce the initial system vulnerability and the entire system destruction probability. The problem of optimization of time delay and new element construction pace is considered with and without constraint on the initial system vulnerability. Examples illustrating the methodology of the optimal defense strategy analysis are presented.     

Assessing End‐Of‐Supply Risk of Spare Parts Using the Proportional Hazard Model

Operators of long field‐life systems like airplanes are faced with hazards in the supply of spare parts. If the original manufacturers or suppliers of parts end their supply, this may have large impacts on operating costs of firms needing these parts. Existing end‐of‐supply evaluation methods are focused mostly on the downstream supply chain, which is of interest mainly to spare part manufacturers. Firms that purchase spare parts have limited information on parts sales, and indicators of end‐of‐supply risk can also be found in the upstream supply chain. This article proposes a methodology for firms purchasing spare parts to manage end‐of‐supply risk by utilizing proportional hazard models in terms of supply chain conditions of the parts. The considered risk indicators fall into four main categories, of which two are related to supply (price and lead time) and two others are related to demand (cycle time and throughput). The methodology is demonstrated using data on about 2,000 spare parts collected from a maintenance repair organization in the aviation industry. Cross‐validation results and out‐of‐sample risk assessments show good performance of the method to identify spare parts with high end‐of‐supply risk. Further validation is provided by survey results obtained from the maintenance repair organization, which show strong agreement between the firm's and the model's identification of high‐risk spare parts.     

Redundancy in Designs

The author contends that a previous Risk Analysis article overemphasized the pitfalls of incorporating redundancy into designs. Relevant aspects of that article are reviewed and commented upon, then the potentials and pitfalls of redundancy in systems and procedures are more broadly discussed. To provide a solid foundation for that discussion, some definitions for systems risk analysis terminology are presented. It is shown that pairs and larger sets of related failures (the physical causes of shortfalls in redundancy effectiveness) can be divided into two types: (1) cascading/induced failures and (2) common-external-cause failures. Each type has its own physical characteristics and implications for mathematical modeling. Service experience with large-commercial-airplane jet-engine propulsion systems is used to illustrate the two types of related failures. Finally, an overview is provided of event-sequence analysis, an alternative approach to systems risk analysis. When the possibility of related failures of mutually-redundant system elements must be accounted for, event-sequence analysis can usually do that better than fault-tree analysis.     

Impacts of Power Structure on Supply Chains with Uncertain Demand

In this study, we use a game‐theory‐based framework to model power in a supply chain with random and price‐dependent demand and examine how power structure and demand models (expected demand and demand shock) affect supply chain members' performance. We demonstrate that whether a firm benefits from its power depends on the expected demand model but not on demand shock model. A firm benefits from its power only for linear but not for constant elasticity expected demand. The impact of power structure on supply chain efficiency depends on the models of both expected demand and demand shock. With additive shock, supply chain efficiency is highest (lowest) when neither firm dominates for linear (constant elasticity) expected demand. With multiplicative shock, the supply chain efficiency is highest with a power retailer (manufacturer) for linear (constant elasticity) expected demand. The manufacturer always benefits from a reduction in demand uncertainty. However, the retailer loses (benefits) from demand uncertainty reduction for linear (constant elasticity) expected demand. With a power retailer, the retail price is always on the higher end for linear expected demand, and the customer service level is the lowest for constant elasticity expected demand. Consequently, consumers do not necessarily benefit from a power retailer.     

An Optimization‐Based Framework for the Identification of Vulnerabilities in Electric Power Grids Exposed to Natural Hazards

This article proposes a novel mathematical optimization framework for the identification of the vulnerabilities of electric power infrastructure systems (which is a paramount example of critical infrastructure) due to natural hazards. In this framework, the potential impacts of a specific natural hazard on an infrastructure are first evaluated in terms of failure and recovery probabilities of system components. Then, these are fed into a bi‐level attacker–defender interdiction model to determine the critical components whose failures lead to the largest system functionality loss. The proposed framework bridges the gap between the difficulties of accurately predicting the hazard information in classical probability‐based analyses and the over conservatism of the pure attacker–defender interdiction models. Mathematically, the proposed model configures a bi‐level max‐min mixed integer linear programming (MILP) that is challenging to solve. For its solution, the problem is casted into an equivalent one‐level MILP that can be solved by efficient global solvers. The approach is applied to a case study concerning the vulnerability identification of the georeferenced RTS24 test system under simulated wind storms. The numerical results demonstrate the effectiveness of the proposed framework for identifying critical locations under multiple hazard events and, thus, for providing a useful tool to help decisionmakers in making more‐informed prehazard preparation decisions.     

Deterrence and Risk Preferences in Sequential Attacker–Defender Games with Continuous Efforts

Most attacker–defender games consider players as risk neutral, whereas in reality attackers and defenders may be risk seeking or risk averse. This article studies the impact of players' risk preferences on their equilibrium behavior and its effect on the notion of deterrence. In particular, we study the effects of risk preferences in a single‐period, sequential game where a defender has a continuous range of investment levels that could be strategically chosen to potentially deter an attack. This article presents analytic results related to the effect of attacker and defender risk preferences on the optimal defense effort level and their impact on the deterrence level. Numerical illustrations and some discussion of the effect of risk preferences on deterrence and the utility of using such a model are provided, as well as sensitivity analysis of continuous attack investment levels and uncertainty in the defender's beliefs about the attacker's risk preference. A key contribution of this article is the identification of specific scenarios in which the defender using a model that takes into account risk preferences would be better off than a defender using a traditional risk‐neutral model. This study provides insights that could be used by policy analysts and decisionmakers involved in investment decisions in security and safety.     

Integrating Models and Data to Estimate the Structural Reliability of Utility Poles During Hurricanes

Utility systems such as power and communication systems regularly experience significant damage and loss of service during hurricanes. A primary damage mode for these systems is failure of wooden utility poles that support conductors and communication lines. In this article, we present an approach for combining structural reliability models for utility poles with observed data on pole performance during past hurricanes. This approach, based on Bayesian updating, starts from an imperfect but informative prior and updates this prior with observed performance data. We consider flexural and foundation failure mechanisms in the prior, acknowledging that these are an incomplete, but still informative, subset of the possible failure mechanisms for utility poles during hurricanes. We show how a model‐based prior can be updated with observed failure data, using pole failure data from Hurricane Katrina as a case study. The results of this integration of model‐based estimates and observed performance data then offer a more informative starting point for power system performance estimation for hurricane conditions.     

A FACILITY LOCATION PROBLEM WITH DISTANCE-DEPENDENT DEMAND

This paper examines network systems where demand for the services of a facility originates at the nodes of the network and its magnitude depends on the shortest distance to a service-providing facility. Service systems with such features include bank branches, fastfood outlets, and grocery stores. With the assumption that demand is a Poisson-distributed random variable whose mean is an exponentially decreasing function of distance, possible locations based on two important performance measures are characterized: the expected value and the variance of the demand. Two procedures are proposed: one to find the locations with the minimum and maximum expected demand and the other to find the location(s) that provide a given level of expected demand. The procedures are illustrated by two examples.     

Revenue Management in Order‐Driven Production Systems

This article investigates the effectiveness of a tactical demand‐capacity management policy to guide operational decisions in order‐driven production systems. The policy is implemented via a heuristic that attempts to maximize revenue by selectively accepting or rejecting customer orders for multiple product classes when demand exceeds capacity constantly over the short term. The performance of the heuristic is evaluated in terms of its ability to generate a higher profit compared to a first‐come‐first‐served (FCFS) policy. The policies are compared over a wide range of conditions characterized by variations in both internal (firm) and external (market) factors. The heuristic, when used with a Whole Lot order‐processing approach, produces higher profit compared to FCFS when profit margins of products are substantially different from each other and demand exceeds capacity by a large amount. In other cases it is better to use the heuristic in conjunction with the Split Lot order‐processing approach.     

The Dynamic Newsvendor Model with Correlated Demand

The classic newsvendor model was developed under the assumption that period‐to‐period demand is independent over time. In real‐life applications, the notion of independent demand is often challenged. In this article, we examine the newsvendor model in the presence of correlated demands. Specifically under a stationary AR(1) demand, we study the performance of the traditional newsvendor implementation versus a dynamic forecast‐based implementation. We demonstrate theoretically that implementing a minimum mean square error (MSE) forecast model will always have improved performance relative to the traditional implementation in terms of cost savings. In light of the widespread usage of all‐purpose models like the moving‐average method and exponential smoothing method, we compare the performance of these popular alternative forecasting methods against both the MSE‐optimal implementation and the traditional newsvendor implementation. If only alternative forecasting methods are being considered, we find that under certain conditions it is best to ignore the correlation and opt out of forecasting and to simply implement the traditional newsvendor model.      

Game Theory and Risk Analysis

Risk analysts often analyze adversarial risks from terrorists or other intelligent attackers without mentioning game theory. Why? One reason is that many adversarial situations—those that can be represented as attacker‐defender games, in which the defender first chooses an allocation of defensive resources to protect potential targets, and the attacker, knowing what the defender has done, then decides which targets to attack—can be modeled and analyzed successfully without using most of the concepts and terminology of game theory. However, risk analysis and game theory are also deeply complementary. Game‐theoretic analyses of conflicts require modeling the probable consequences of each choice of strategies by the players and assessing the expected utilities of these probable consequences. Decision and risk analysis methods are well suited to accomplish these tasks. Conversely, game‐theoretic formulations of attack‐defense conflicts (and other adversarial risks) can greatly improve upon some current risk analyses that attempt to model attacker decisions as random variables or uncertain attributes of targets (“threats”) and that seek to elicit their values from the defender's own experts. Game theory models that clarify the nature of the interacting decisions made by attackers and defenders and that distinguish clearly between strategic choices (decision nodes in a game tree) and random variables (chance nodes, not controlled by either attacker or defender) can produce more sensible and effective risk management recommendations for allocating defensive resources than current risk scoring models. Thus, risk analysis and game theory are (or should be) mutually reinforcing.     

Nuclear Waste Management under Approaching Disaster: A Comparison of Decommissioning Strategies for the German Repository Asse II

This article compares different strategies for handling low‐ and medium‐level nuclear waste buried in a retired potassium mine in Germany (Asse II) that faces significant risk of uncontrollable brine intrusion and, hence, long‐term groundwater contamination. We survey the policy process that has resulted in the identification of three possible so‐called decommissioning options: complete backfilling, relocation of the waste to deeper levels in the mine, and retrieval. The selection of a decommissioning strategy must compare expected investment costs with expected social damage costs (economic, environmental, and health damage costs) caused by flooding and subsequent groundwater contamination. We apply a cost minimization approach that accounts for the uncertainty regarding the stability of the rock formation and the risk of an uncontrollable brine intrusion. Since economic and health impacts stretch out into the far future, we examine the impact of different discounting methods and rates. Due to parameter uncertainty, we conduct a sensitivity analysis concerning key assumptions. We find that retrieval, the currently preferred option by policymakers, has the lowest expected social damage costs for low discount rates. However, this advantage is overcompensated by higher expected investment costs. Considering all costs, backfilling is the best option for all discounting scenarios considered.