Interdiction models for delaying adversarial attacks against critical information technology infrastructure

Abstract

Information technology (IT) infrastructure relies on a globalized supply chain that is vulnerable to numerous risks from adversarial attacks. It is important to protect IT infrastructure from these dynamic, persistent risks by delaying adversarial exploits. In this paper, we propose max‐min interdiction models for critical infrastructure protection that prioritizes cost‐effective security mitigations to maximally delay adversarial attacks. We consider attacks originating from multiple adversaries, each of which aims to find a “critical path” through the attack surface to complete the corresponding attack as soon as possible. Decision‐makers can deploy mitigations to delay attack exploits, however, mitigation effectiveness is sometimes uncertain. We propose a stochastic model variant to address this uncertainty by incorporating random delay times. The proposed models can be reformulated as a nested max‐max problem using dualization. We propose a Lagrangian heuristic approach that decomposes the max‐max problem into a number of smaller subproblems, and updates upper and lower bounds to the original problem via subgradient optimization. We evaluate the perfect information solution value as an alternative method for updating the upper bound. Computational results demonstrate that the Lagrangian heuristic identifies near‐optimal solutions efficiently, which outperforms a general purpose mixed‐integer programming solver on medium and large instances.

Strategies for Effective Integration of Management Information System in Secondary Schools: Teachers’ Perspective from Awka Education Zone in Anambra State

“…Based on the result, the lack of learning equipment tools and resource in new pedagogical approaches is a major challenge encountered in integrating MIS in secondary schools. This finding is related to the report by Zheng and Albert [16] who observed that inadequate technology infrastructure, resource materials, and other basic tools for effective teaching makes learning difficult. Jones [6] posits that individual teachers who possessed less than upper secondary education are considerably less likely to use computers for a range of reasons.…”

“…While items 21, 24, 25, and 28 having a mean score below 2.50 and corresponding standard deviation of 1.18, 1.16, 0.64, and 1.30 were rejected by male teachers. Similarly, items 11,12,13,14,16,17,18,19, and 20 having a mean score above 2.50 and corresponding standard deviation of 0.98, 0.71, 0.78, 1.03, 1.00, 1.22, 0.78, and 0.69 were all accepted by female teachers. While items 14 and 15 having a mean score of 2.42 and 2.42 corresponding to standard deviation of 0.75 and 1.19 were rejected by female teachers.…”

Preventing or Mitigating Adversarial Supply Chain Attacks; a legal analysis

“…Prevention or mitigation techniques include anything traditionally used against adversarial attacks, such as organisational measures, encryption and other classic measures. Of particular interest is mitigation at scale and through simulations and modelling [51,50].…”

“…As is the lack of deliberately abstract guidance which, like Denmark, does not exist. Definitions of operators of essential services and what is otherwise needed are here, but one noticeable difference is clear, as fines and investigations are done through either designated authorities 51 or authorized officers 52 . The latter is interesting, but does not mean there will be differences in enforcement, which is found in Reg 34.…”

Теоретико-Ігрові Та Оптимізаційні Моделі І Методи Підвищення Безпеки Кіберінфраструктур

“…Для розв'язання такої задачі пропонується евристична декомпозиція. Дворівнева оптимізація також використовується для проекту перехоплення, у якому особи, які приймають рішення, розгортають заходи, спрямовані на максимальні затримки множинних ворожих атак, коли тривалості затримки є невизначеними [59]. 100 ISSN 1028-0979 Оскільки в реальних задачах не завжди всі параметри відомі напевне, пропонуються моделі стохастичної оптимізації [60], зокрема модель вибору портфеля засобів контролю безпеки з урахуванням середнього та найменшого значень міри ефективності [61,62].…”