We apply new bilevel and trilevel optimization models to make critical infrastructure more resilient against terrorist attacks. Each model features an intelligent attacker (terrorists) and a defender (us), information transparency, and sequential actions by attacker and defender. We illustrate with examples of the US Strategic Petroleum Reserve, the US Border Patrol at Yuma, Arizona, and an electrical transmission system. We conclude by reporting insights gained from the modeling experience and many “red-team” exercises. Each exercise gathers open-source data on a real-world infrastructure system, develops an appropriate bilevel or trilevel model, and uses these to identify vulnerabilities in the system or to plan an optimal defense.

/pdf/defending-critical-infrastructure-96d9t34vw8.pdf

Defending Critical Infrastructure

With the ever-growing complexity and dynamicity of computer systems, proactive fault management is an effective approach to enhancing availability. Online failure prediction is the key to such techniques. In contrast to classical reliability methods, online failure prediction is based on runtime monitoring and a variety of models and methods that use the current state of a system and, frequently, the past experience as well. This survey describes these methods. To capture the wide spectrum of approaches concerning this area, a taxonomy has been developed, whose different approaches are explained and major concepts are described in detail.

A survey of online failure prediction methods

The Applied Technology Council is adapting PEER's performance-based earthquake engineering methodology to professional practice. The methodology's damage-analysis stage uses fragility functions to calculate the probability of damage to facility components given the force, deformation, or other engineering demand parameter (EDP) to which each is subjected. This paper introduces a set of procedures for creating fragility functions from various kinds of data: (A) actual EDP at which each specimen failed; (B) bounding EDP, in which some specimens failed and one knows the EDP to which each specimen was subjected; (C) capable EDP, where specimen EDPs are known but no specimens failed; (D) derived, where fragility functions are produced analytically; (E) expert opinion; and (U) updating, in which one improves an existing fragility function using new observations. Methods C, E, and U are all introduced here for the first time. A companion document offers additional procedures and more examples.

/pdf/creating-fragility-functions-for-performance-based-2pyqmykvfw.pdf

Creating Fragility Functions for Performance-Based Earthquake Engineering:

Attack trees have found their way to practice because they have proved to be an intuitive aid in threat analysis. Despite, or perhaps thanks to, their apparent simplicity, they have not yet been provided with an unambiguous semantics. We argue that such a formal interpretation is indispensable to precisely understand how attack trees can be manipulated during construction and analysis. We provide a denotational semantics, based on a mapping to attack suites, which abstracts from the internal structure of an attack tree, we study transformations between attack trees, and we study the attribution and projection of an attack tree.

Foundations of attack trees

/pdf/arguing-safety-a-systematic-approach-to-managing-safety-1m8tx85i6w.pdf

Arguing Safety - A Systematic Approach to Managing Safety Cases

Introduction: Since 1975, a short course entitled "System Safety and Reliability Analysis" has been presented to over 200 NRC personnel and contractors. The course has been taught jointly by David F. Haasl, Institute of System Sciences, Professor Norman H.
Roberts, University of Washington, and members of the Probabilistic Analysis Staff, NRC, as part of a risk assessment training program sponsored by the Probabilistic Analysis Staff. This handbook has been developed not only to serve as text for the System Safety
and Reliability Course, but also to make available to others a set of otherwise undocumented material on fault tree construction and evaluation. The publication of this handbook is in accordance with the recommendations of the Risk Assessment Review Group Report (NUREG/CR-0400) in which it was stated that the fault/event tree methodology both can and should be used more widely by the NRC. It is hoped that this document will help to codify and systematize the fault tree approach to systems analysis.

https://apps.dtic.mil/sti/pdfs/ADA354973.pdf

D. F. Haasl

Papers

Fault Tree Handbook