Defense Strategies for Asymmetric Networked Systems with Discrete Components.

We consider infrastructures consisting of a network of systems, each composed of discrete components. The network provides the vital connectivity between the systems and hence plays a critical, asymmetric role in the infrastructure operations. The individual components of the systems can be attacked by cyber and physical means and can be appropriately reinforced to withstand these attacks. We formulate the problem of ensuring the infrastructure performance as a game between an attacker and a provider, who choose the numbers of the components of the systems and network to attack and reinforce, respectively. The costs and benefits of attacks and reinforcements are characterized using the sum-form, product-form and composite utility functions, each composed of a survival probability term and a component cost term. We present a two-level characterization of the correlations within the infrastructure: (i) the aggregate failure correlation function specifies the infrastructure failure probability given the failure of an individual system or network, and (ii) the survival probabilities of the systems and network satisfy first-order differential conditions that capture the component-level correlations using multiplier functions. We derive Nash equilibrium conditions that provide expressions for individual system survival probabilities and also the expected infrastructure capacity specified by the total number of operational components. We apply these results to derive and analyze defense strategies for distributed cloud computing infrastructures using cyber-physical models.

1. Introduction

Infrastructures for cloud computing, science experiments and computations and smart energy grid consist of complex, geographically-dispersed systems that are connected over long-haul networks. In these infrastructures, the communications network plays a critical, asymmetric role of providing the vital connectivity between the systems such as cloud computing sites, or supercomputers, or energy distribution centers. Network failures render the individual systems unreachable and in extreme cases can render the entire infrastructure unavailable. Such an infrastructure is represented by its constituent systems, , , and the network connecting them is represented as a separate system . The individual systems themselves are complex, consisting of several discrete cyber and physical components, which must be operational and connected to the network. The individual components of may be disabled or disconnected, and as a system may be disconnected, by cyber and physical attacks on the components. We formulate the problem of ensuring the infrastructure performance as a game between an attacker that launches cyber or physical attacks on the components and a provider that reinforces them to withstand the attacks. Since both attacks and reinforcements incur costs, the two players both weight the costs with expected benefits by minimizing utility functions. We derive Nash Equilibrium (NE) conditions that provide expressions for individual system survival probabilities and also the expected capacity specified by the total number of operational components. This paper extends and presents a unified view of the partial results presented in earlier conference papers on sum- and product-form utilities [1], composite utilities [2,3] and multi-site cloud infrastructures [4].

The components can be reinforced to survive direct attacks, but they can still be unavailable due to attacks on other components. For example, a super computer at a site may be hardened against cyber attacks, but can still be made unavailable by cutting fiber connections to the site. On the other hand, we consider that non-reinforced cyber and physical components will be disabled by direct cyber and physical attacks, respectively. Furthermore, in addition to within system , the effects of attacks on its components may propagate to components of other systems , . Thus, both the correlations between components within individual systems and those between systems represent the propagation of disruptions across the infrastructure. The infrastructure provider is tasked with developing strategies to choose a number of components of each system to reinforce against the attacks by taking into account both types of correlations.

Let denote the number of components of , , of which and denote the number of components attacked and reinforced, respectively. Let be the survival probability of and be the survival probability of the entire infrastructure. Furthermore, let denote the infrastructure without and be its survival probability. The relative importance of is captured by the aggregate failure correlation function given by the failure probability of given the failure of . Under the asymmetric network conditions, the specific role of the network is specified by two conditions: (a) indicates that network failure will disrupt the entire infrastructure; and (b) , for , indicates that disruptions of individual systems are uncorrelated. The correlations between components of individual systems are captured by simple first-order differential conditions on using the system multiplier functions that capture correlations within systems and also abstract the effects of system-level parameters [5]. This two-level characterization helps to conceptualize the basic correlations in infrastructures, such as cloud computing and smart grid infrastructures and provides insights into the needed defense strategies by naturally “separating” the system-level and component-level aspects.

A game between an attacker and a provider involves balancing the costs of attacks and reinforcements of systems, given by and , respectively, with the survival probability of the infrastructure. We consider that the provider minimizes the composite utility function given by: where the first product term corresponds to the reward and the second product term corresponds to the cost. Within the product terms, and are the reward and cost multipliers, respectively, of the provider, and and represent the reward and cost terms, respectively, of keeping the infrastructure operational. Similarly, we consider that the attacker minimizes: where and are the reward and cost multipliers, respectively, of the attacker, and and represent the reward and cost terms of disrupting the infrastructure operation, respectively. The expected capacity of the infrastructure is the expected number of available components, given by: which reflects the part of the infrastructure that survives the attacks. In the example of the cloud infrastructure, it represents the number of operational servers that are available to users on average.

The composite utility function can be specialized to obtain sum-form and product-form utilities by using appropriate terms, as summarized in Table 1, and their choice represents different values in keeping the infrastructure operational:

Table 1

Gain and cost terms and their multipliers for sum-form and product-form utilities of the provider.

	F_D,G	G_D	F_D,L	L_D
sum-form: U_D+	1−P_I	g_D	1	L_D
product-form: U_D×	0	0	1−P_I	L_D

The sum-form utility function is given by: which will be minimized by the provider. The scalar represents the benefit of keeping the infrastructure operational such as income from an operational cloud computing infrastructure. Thus, the sum-form represents a weak coupling between gain and cost terms, since the effect of their minimization on the utility function is independent. For a provider, this form is used when explicit “gain” in keeping the infrastructure up can be identified and balanced against the cost.

The product-form utility function is given by: which will be minimized by the provider; it represents the “wasted” cost to the provider since it is the expected cost under the condition that the infrastructure fails. Thus, the product-form represents a strong coupling between probability and cost terms, since the effect of minimization of one term gets multiplied by the other. This utility is used when the main goal of the provider is to keep the infrastructure up with the cost incurred, since there is no explicit ”gain” term.

The Nash Equilibrium (NE) conditions based on the utility functions can used to estimate ’s for the provider using various methods [6,7]. Our objective in this paper is to show that critical insights can be gained by deriving estimates of system survival probabilities and expected capacity explicitly in terms of various correlations, without relying on explicit solutions for ’s. The differences in the goals of sum- and product-form utilities lead to qualitatively different defense strategies, which are derived separately in earlier works, and the corresponding expressions for the survival probabilities that are structurally different [5,8]. We show that under the asymmetric network conditions, NE conditions of this game lead to expressions for ’s and with the same structure. In particular, the estimates of for sum-form and product-form utilities have the same expression in Theorem 3 except for one term, given by and . To consider the case where the sum-form and the product-form utilities are equivalent, we equate the two terms and obtain the following “equivalent” gain term of the sum-form: for , which is an increasing function in both and ; or, equivalently, we have, . This similarity is striking since the sum-form and product-form utilities represent two quite different objectives.

The composite utility functions lead to simple expressions for , , and at NE, which subsume the above cases. In general, the dependence of on cost terms and aggregate correlation functions, as well as their partial derivatives, is presented in a compact form by using the composite gain-cost and composite multiplier terms (defined in Section 4). The expected capacity at NE is expressed in terms of cost term and its derivative, the aggregate correlation functions , , and the system multiplier functions, , (defined in Section 3.2). The expression provides critical information on the dependence of the expected capacity on system parameters, in particular and , and utility functions. Furthermore, by decomposing the system models into sub-models, such as cyber and physical sub-models, finer relationships can be inferred between system parameters, such as refined versions of and , and the expected capacity. We apply these results to a simplified model of cloud computing infrastructure with multiple server sites connected over a communications network.

The organization of this paper is as follows. We describe related work in Section 2. In Section 3, we describe the infrastructure model along with the aggregate correlation function and differential conditions on system survival probabilities. We present our game-theoretic formulation using sum-form, product-form and composite utility functions in Section 4 and derive NE conditions and estimates for the system survival probabilities and expected capacity. We apply the analytical results to a model of cloud computing infrastructure in Section 5. We present conclusions in Section 6.

2. Related Work

Critical infrastructures of power grids, cloud computing and transportation systems provide vital public and private services [9,10]. They depend on complex communications networks that connect the constituent systems, which by themselves consist of many disparate cyber and physical components [10]. The communications network plays a very critical role in these infrastructures [11], in some ways more so than the constituent systems, and its failure can significantly degrade the entire infrastructure [12,13]. These infrastructures are under increasing cyber and physical attacks, which the providers are required to counter by applying defense measures and strategies.

By capturing the interactions between providers and attackers of these infrastructures, game-theoretic methods have been extensively applied to develop the needed defense strategies [14,15,16], which attempt to ensure continued infrastructure operations in the presence of evolving threats [17]. Partial differential equations and discrete component models have been used in several of these infrastructures to model the physical and cyber systems [18] in formulating the underlying games. The game-theoretic formulations and the solutions developed for such infrastructures are quite varied and extensive. They include: multiple-period games that address multiple time-scales of system dynamics [19]; incomplete information games that account for partial knowledge about the system dynamics and attack models [20]; and multiple-target games that account for possibly competing objectives [21].

A comprehensive review of the defense and attack models in various game-theoretic formulations has been presented in [22]. Recent interest in cyber and cyber-physical systems led to the application of game theory to a variety of cyber security scenarios [16,23] and, in particular, for securing cyber-physical networks [24] with applications to power grids [11,25,26,27].

The system availability, reliability and robustness aspects can be explicitly integrated into the game formulations [14] for infrastructures such as power grids, cloud computing and transportation systems. In particular, discrete models of cyber-physical infrastructures have been studied in various forms under Stackelberg game formulations [28]. A subclass of these models using the number of cyber and physical components that are attacked and reinforced as the main variables have been studied in [29]. These models characterize infrastructures with a large number of components and are coarser compared to the models that consider the attacks and reinforcements of individual cyber and physical components. Various forms of correlation functions [5,8,29] are used in these works to capture the dependencies between the survival probabilities of constituent systems, such as the cyber and physical sub-infrastructures.

Complex interacting collections of systems have been studied using game-theoretic formulations in [30], and their two-level correlations have been studied using the sum-form utility functions in [5] and the product-form utility functions in [8]. The sum-form utility represents a gain-centric priority, wherein an independent gain term weighted by represents the gain to be maximized by the provider. The product-form utility, on the other hand, represents a cost-centric priority, wherein the expected cost is to be minimized. The sum-form utility function [5] and the product-form utility function [8] are considered separately for a generic version of this game, wherein all systems play a similar role, unlike the asymmetric role of the network considered here. In terms of analysis, these two formulations have a certain degree of commonality, but there are also differences; in particular, estimates of can be obtained somewhat directly for the product-form as shown in [8]. These two utility functions also lead to qualitatively different defense strategies, and in particular, appears explicitly in the sensitivity estimates of system survival probabilities in product-form, but not in sum-form. These two utility functions are unified in [2], and the sum-form utility function has been studied under the asymmetric role of the communications network in [1].

The infrastructures for smart energy grids, cloud computing and intelligent transportation systems are composed of complex constituent systems that rely on communications networks. For wide-area operations, these networks play a critical asymmetric role of providing the vital connectivity needed for continued infrastructure operations. The asymmetric network correlations have been incorporated into multiple system infrastructures for sum-form and product-form utilities in [1], and these two works are unified in [3] by using the composite utility functions. The multi-site cloud computing infrastructure was discussed as an example for sum-form and product-form utility functions in [1] and composite utility functions in [3], wherein the network plays a critical asymmetric role. This model is further extended by including an HVAC system in [4], and also, additional details of NE conditions and capacity estimates are provided. In this paper, we consolidate these results and present a unified treatment of the sum-form, product-form and composite utilities under asymmetric network correlation conditions. For multi-site cloud infrastructures, we explicitly relate these utility functions and interpret the abstract definitions of correlation functions and system multiplier functions in terms of systems and their components.

3. Discrete System Models

We consider infrastructures with constituent systems consisting of discrete components [5,8] and connected over a communications network [1]. We first consider the correlations at the systems and network levels and then consider the correlations between the components of individual systems.

3.1. System-Level Correlations

The correlations between systems, including the network, in these infrastructures are characterized in terms of their survival probabilities as follows.

Aggregate correlation function: Let for

The aggregate failure correlation function captures the interdependence of the rest of the system on the failure of , which can be illustrated using the following special cases.

Asymmetric network: In a cloud computing infrastructure, consider that the fiber connections to N sites, each with l servers, constitute the network system . Then, we have: where K is a normalization constant, since the fiber failure rate is amplified by l in rendering the servers unavailable. Thus, we have:

Statistical independence: The system failures satisfy a statistical independent condition given by , indicating that the failure probability of is not dependent on . This condition in turn leads to , which indicates the statistical independence of the survival processes of and . More generally, if , the failures in are positively correlated with failures in , that is they occur with a higher probability following the latter. If we denote the failure probability of by , then we have , or equivalently, failure in leads to a higher probability of failure in . If , failures in are negatively correlated with the latter failures, that is .

Definite failure: In another case, when the failure of leads to a definite failure of the rest of the infrastructure, we have such that . This condition indicates that the infrastructure survival probability solely depends on the marginal failure probability of .

ORsystems: The OR systems as modeled in [29] correspond to the special case where the infrastructure consists of uncorrelated cyber and physical systems (denoted by and , respectively) that can be independently analyzed. For OR systems, the failure probabilities of and are uncorrelated such that , and hence, we have or equivalently . Thus, we have . We apply this condition next in Condition 2 for N systems considered in this paper.

The important asymmetric role of the communications network is characterized using the following condition.

Asymmetric network and uncorrelated systems conditions: The aggregated correlation functions of  ☐

Part (i) of Condition 2 leads to , which indicates the role of the rest of infrastructure without the network; namely, its survival probability is the same as that for server sites together. Part (ii) of Condition 2 leads to , , which linearly depends on each of the failure probabilities of the constituent system and the rest of infrastructure . It is important to note that although there are direct correlations between the site failures zero (Part (ii) above), these site failures are still indirectly related through the network. In particular, the failures of and , which are parts of , are correlated with the network via ; for example, they both become simultaneously unavailable when the wide-area network fails.

The effects of reinforcements and attacks on host sites and wide-area networks can be separated using the following two conditions:

the first condition, for , indicates that reinforcing the server site does not directly impact the survival probability of other sites or networks; and

the second condition, for , and , indicates that reinforcing server sites or network does not directly impact the survival probability of server sites or network .

While the reinforcements to individual server sites or networks are not directly reflected in other systems, their failures may still be correlated due to the underlying system structures as reflected in the aggregated correlation function of the network . These system-level considerations for the provider are captured by the following condition, which is obtained by differentiating in Condition 1 with respect to and ignoring the terms corresponding to Parts (i) and (ii) above.

De-coupled reinforcement effects: For for the provider. ☐

The condition captures the effect on the increment in as a result of the change in the number of reinforced components of . It is the sum of (i) the increment in individual system survival probability weighted by “non-correlation” term and (ii) the increment in correlation weighted by the failure probability of . For the sites , , we have:

For the network , we have:

Under Condition 2, is constant, but its partial derivatives with respect to could be non-zero, as other parameters change to keep it constant.

3.2. Component-Level Correlations

The system survival probabilities satisfy the following differential condition that specifies the correlations at the component level [5,31].

System multiplier functions: The survival probabilities for  ☐

The derivative in the above condition is linear in for and is faster than linear if and slower than linear if . These system multiplier functions capture the underlying system structure including its parameters, in addition to the game variables ’s and ’s. For example, in the case of multi-site server infrastructure, in Section 5.2 depends on the number of severs at site i. This somewhat abstract condition enables us to capture such a structure in a generic manner and indeed is satisfied in two special cases studied extensively in the literature.

Statistically independent components: The special case when component survival probabilities are statistically independent with and without reinforcements has been studied in [31]. Let and denote the conditional survival probability of a component of with and without reinforcement, respectively. Under the statistical independence condition of component failures, the probability that with components survives the attacks is: as in [31], or equivalently:

By differentiating the equation with respect to , we obtain:

The condition for the faster than linear derivative is or equivalently , where e is the base of the natural logarithm. The condition that the survival probability of a reinforced component is higher than that of a non-reinforced component, but less than , namely, , corresponds to only the slower than linear derivative.

Contest survival functions: The contest survival functions are to express in [30] such that for a suitably-selected slack variable , which in turn leads to:

The condition for the slower than linear derivative is: which is satisfied for larger values of sufficient to make the left-hand side negative.

4. Game Theoretic Formulation

The provider’s objective is to make the infrastructure resilient by reinforcing components of to optimize the utility function. Similarly, the attacker’s objective is to disrupt the infrastructure by attacking components of to optimize the corresponding utility function. NE conditions are derived by equating the corresponding derivatives of the utility functions to zero, which yields: for for the provider. We define: as the composite gain-cost term, wherein the gain and cost are “amplified” by the derivatives of their corresponding multiplier functions with respect to . We then define: as the composite multiplier term, wherein the gain multiplier and cost multiplier are “amplified” by the derivatives of their corresponding gain and cost terms with respect to , , respectively. These two terms lead to the compact NE condition These NE conditions can be used to solve for ’s using available methods whose complexity depends on the details of gain and cost terms [14,15,16]. Indeed, different methods and trade-offs may be required to derive such solutions by exploiting the details of infrastructure [7]. We show in the next section that estimates for system survival probabilities and expected capacity can be obtained without explicitly solving for ’s, and yet, they provide valuable qualitative insights about the infrastructure. Various terms of the composite utility function specialized to sum-form and product-form utilities are shown in Table 2, which are considered separately in Section 4.3.

Table 2

Gain and cost terms, their multipliers and other terms for sum-form and product-form utilities of the provider.

	F_D,G	G_D	F_D,L	L_D	∂F_D,G∂P_I	∂G_D∂x_i	∂F_D,L∂P_I	LG,LD	FG,LD,i
sum-form: U_D+	1−P_I	g_D	1	L_D	−1	0	0	−g_D	∂L_D∂x_i
product-form: U_D×	0	0	1−P_I	L_D	0	0	−1	−L_D	1−P_I∂L_D∂x_i

4.1. OR Systems

The OR systems [31] constitute a sub-class of abstract infrastructures where simultaneous failures of two or more systems are extremely unlikely, namely their probability is zero. These abstract models are used to illustrate the simplifications that result from ignoring the correlations and are generally used for analysis purposes. Here, OR systems ignore the asymmetric role played by the communications network. These systems are simpler to analyze due to the absence of system-level correlation terms, and they serve as base study cases when the correlations can be ignored. Indeed, an estimate of can be derived as a simple ratio of the gain-cost gradient and system multiplier function . Using , we obtain: where is called the scaled gain-cost gradients of system . Then, Condition 4 provides us an estimate for the survival probability of as the ratio of the scaled gain-cost gradient and the system multiplier function given by: for . These estimates for individual systems depend mainly on the corresponding scaled gain-cost gradients and thus represent a “separation” of the individual systems at this level. In this sense, OR systems constitute an important analytical case wherein the correlations between the individual systems may be ignored. In addition, these estimates provide the sensitivity information of the survival probabilities of the individual systems with respect to various quantities of . In particular, the survival probability estimate is proportional to the corresponding weighted cost and reward functions and inversely proportional to their weighted derivatives. This seemingly counter-intuitive trend applies only to the set of Nash equilibria and not to the overall system behavior. In the rest of the paper, we denote and , by and , respectively, to simplify the notation.

4.2. System Survival Probabilities and Expected Capacity

We now derive estimates for at NE using aggregated correlation functions and their partial derivatives to infer qualitative information about their sensitivities to different parameters.

Survival probability estimates: Under Conditions 1, 3 and 4, estimates of the survival probability of system for

Our proof is based on deriving NE conditions for the utility function. At NE, we have:

Then, using the equation in Condition 3 and from Condition 4, we have:

Under the condition or , we have , and hence, we obtain: for .

Consider the survival probability of the infrastructure; under the asymmetric network condition, we have and , which imply that the condition or is not satisfied; hence, the above formula cannot be used directly since the denominator . Instead, using in Condition 1, we obtain , which implies:

Then, the NE condition is given by: which completes the proof. ☐

The system survival probability estimates provide qualitative information about the effects of various parameters including aggregated correlation coefficient , system multiplier functions , composite gain-cost and composite multiplier ; note that the estimates may not necessarily lie within the range [0,1]. In particular, (i) increases and decreases with and , respectively, (ii) increases with and (iii) depends both on and its derivative for . For the network, is in a simpler form since .

We now consider that the asymmetric role played by the network described in Condition 2, namely its failure, renders entire infrastructure unavailable; also, failures of individual systems are uncorrelated with others. The following theorem provides a single, simplified expression for the expected capacity under these conditions.

Expected capacity under asymmetric network correlations: Under Conditions 1–4, the expected capacity is given by:

Under Part (ii) of Condition 2, Equation (1) in the proof of Theorem 1 simplifies to the equation: for . Thus, we have , which provides the expression for . ☐

This condition indicates that lower and higher composite multiplier lead to lower expected capacity. Typically, the composite gain-cost is negative (e.g., for sum-form) since it is minimized by the provider; thus, its lower value is more negative and has a higher magnitude. Furthermore, larger values of also lead to lower expected capacity. In particular, the condition , called the faster than linear growth of , leads to lower expected capacity. This seems counter-intuitive since faster improvement in due to the increase in leads to lower expected capacity, but note that it only characterizes the states that satisfy NE conditions.

4.3. Sum-Form and Product-Form Utility Functions

The NE conditions for sum-form and product-form utilities are derived by equating the corresponding derivatives to zero, which yields the following conditions, respectively: for for the provider.

We now derive estimates for at NE using partial derivatives of the cost and failure correlation functions to infer qualitative information about their sensitivities to different parameters.

Under Conditions 1, 3 and 4, estimates of the survival probability of system where for for

Our proof is based on deriving NE conditions separately for sum-form and product-form utility functions and then comparing them to identify their common structure and the difference terms. At NE, for the sum-form, we have:

Then, using the equation in Condition 3 and from Condition 4, we have:

Under the condition or , we have , and hence, we obtain: for . Similarly, for the product-form, we have:

Then, using the equation in Condition 3 and from Condition 4, we have:

Then, we have: for .

Consider the survival probability of the infrastructure; under the asymmetric network condition, we have and , which imply that the condition or is not satisfied; hence, the above formula cannot be used directly since the denominator . Instead, using in Condition 1, we obtain , which implies:

Then, the NE condition for the sum-form is given by:

Similarly, for the product-form, we obtain, which completes the proof. ☐

The estimates above provide sensitivity information about the corresponding survival probabilities with respect to various parameters; note that the estimates may not necessarily lie within [0,1]. In particular, they qualitatively relate to the corresponding aggregate correlation function and its derivative, and also to . These dependencies are identical for both sum-form and product-form utility functions. Indeed, the difference between the two formulae is captured by the single term , which is proportional to the derivative term in both cases. The main difference is that is an increasing function of , whereas does not depend on . Furthermore, the dependence on is different for these two terms. Since and , the role of in the former is played by in the latter. Typically, is chosen as a constant in the sum-form, and is a function of and .

We now consider that network failure renders the entire infrastructure unavailable, and the failure of individual systems is uncorrelated with others given by Condition 2. The following theorem provides a single, simplified expression for the expected capacity under these conditions.

Asymmetric network correlations: Under Conditions 1–4, the expected capacity is given by: where for

Under Part (ii) of Condition 2, Equations (2) and (3) in Theorem 3 simplify to the same equation for and . Thus, we have , which provides the expression for . ☐

For the sum-form, indicates that higher gain leads to a lower number of operational components. For the product form, indicates that higher survival probability of the network leads to a lower number of operational components. The dependence on is similar in both cases, namely faster than linear leads to a lower number of available component, and vice versa. The dependence on is somewhat different due to its presence in the denominator for the product-form, even though appears in the numerator in both forms.

The expressions of for the composite utility are simpler due to the generality of the composite gain-cost and composite multiplier, which are complex by themselves in that the sum-form and product-form are subsumed by them as indicated in Table 1. Typically, the composite gain-cost is negative (e.g., for the sum-form) since it is minimized by the provider; thus, its lower value is more negative and has a higher magnitude. Furthermore, larger values of also lead to lower expected capacity. In particular, the condition , called the faster than linear growth of , leads to lower expected capacity. This seems counter-intuitive since faster improvement in due to the increase in leads to lower expected capacity, but note that it only characterizes the states that satisfy NE conditions.

5. Multi-Site Server Infrastructure

A distributed cloud computing infrastructure consisting of N sites, each with servers at site i, , has been studied by using separate cyber and physical models for each site in [2]. Here, we expand this model to incorporate both cyber and physical aspects of the HVAC of a site, namely its mobile phone app and cooling tower located outside the facility. The sites are connected over a wide-area network , as shown in Figure 1. The components of the network include routers, each of which manages connections as shown in Figure 2.

Figure 1

Cloud computing infrastructure with N server sites.

Figure 2

Network of a multi-site cloud server infrastructure.

This infrastructure is subject to a variety of cyber and physical attacks on its components. Cyber attacks on the servers may be launched remotely over the network since the servers are accessible to users. Meanwhile, routers are located at geographically-separated sites, and access to them is limited (to network administrators), so they are not as easily accessible over the network. Cyber attacks on routers require different techniques and represent different costs to the attacker compared to server attacks. Furthermore, this infrastructure is subject to physical attacks in the form of fiber cuts, which require a proximity access by the attacker. Cutting the network fibers that connect server sites to routers will disconnect the entire site, making it inaccessible to the users. Such attacks may also be launched on the network fibers between routers at different locations on the network.

The infrastructure provider may employ a number of reinforcements to protect against attacks, including replicating the servers and routers to support fail-over operations and installing physically-separated redundant fiber lines to the sites and between router locations. These measures could require significant costs and hence must be strategically chosen.

5.1. System-Level Correlations

The cyber and physical aspects of a site can be represented by using two finer sub-models and that correspond to the cyber and physical model, respectively. Similarly, those of the network are represented by and , which are the cyber and physical models, respectively, as illustrated in Figure 3. Let and represent the cyber and physical components of , which correspond to the number of components of and , respectively, such that . Let and denote the number of cyber and physical components that are reinforced, respectively, such that . Similarly, and denote the number of cyber and physical components that are attacked, respectively, such that . The relationships between these system-level models can be captured using refined versions of the aggregate correlation function as follows. For the wide-area network, we have: which reflects that a cyber attack on a router will disrupt all of its connections, thereby illustrating the amplification effect of these cyber attacks. For the server sites, we have a similar effect due to physical fiber attacks denoted by label reflected by: which indicates that at site , the fiber disruption will disconnect all of its servers. Similarly, the cyber attack on the site’s HVAC app denoted by label leads to: which indicates that at site , the HVAC disruption will affect all of its servers. In the limiting case, each component can be represented as a singleton sub-model such that and . Here, and indicate if the component represented by is reinforced and attacked, respectively.

Figure 3

Representation of the cloud computing infrastructure.

5.2. Component-Level Correlations

We now consider a special case where the attacker and provider choose the components of a constituent system to attack and reinforce, respectively, according to a uniform distribution. Corresponding to the site physical model , , there are non-reinforced fiber connections, where for , and otherwise. Similarly, there are non-reinforced servers. If a cyber component (i.e., a server) is reinforced, it will survive a cyber attack, but can be brought down indirectly by a fiber attack. Then, the probability that a cyber-reinforced component survives fiber attacks is approximated by: where the normalization constant is appropriately chosen.

On the other hand, if a cyber component is not reinforced, it can be brought down by either a direct cyber attack or indirectly through a fiber attack. Thus, we approximate the survival probability of a cyber component at site i as: which reflects the additional lowering of the survival probability in inverse proportion to the level of cyber attack . Under the independence of component attacks and reinforcements, the survival probability of the cyber sub-model is given by: which in turn provides:

Using the above formulae, for cyber model of site , we have:

It is interesting to note that the system multiplier function does not depend on the cyber reinforcement term even though it corresponds to . The function, however, depends on the physical reinforcement term .

Under the statistical independence of cyber and physical attacks, for the cyber and physical sub-models, namely, and , respectively, we have the following generalization of Equation (4): or equivalently:

By differentiating the equation with , we obtain:

Then, by noting that , we obtain: which enables us to approximate by .

Consider that the HVAC sub-model of site i is further decomposed into cyber and physical singleton sub-models represented by and , respectively. Then, we have: which corresponds to a cyber attack on and defense of the HVAC app. Similarly, we have: which corresponds to a physical attack on and defense of the HVAC cooling tower.

5.3. Expected Capacity Estimates

We now consider the capacity of the infrastructure under reinforcements and attacks on components of , which can be further partitioned into the corresponding values of sub-systems of .

5.3.1. Sum-Form and Product-Form

Based on the estimates from Section 4.3, for the expected capacity of the sub-models of , the dependence on and is more direct, and it is qualitatively similar for both sum-form and product-form, since the term appears in the denominator. Then, we obtain the following expected capacity estimates: for the sum-form, and for the product form,

In both cases, the multipliers , and are positive, and it is reasonable to assume the condition , as described above. Thus, the expected capacity decreases with the number of cyber attacks . The opposite trend is true with respect to , which implies no effect if the number of reinforced components is at least as large as the number of component attacks, and otherwise, the expected capacity increases with the difference. In both cases, the dependence on the number of servers at site i is qualitatively similar in that the expected capacity increases proportional to its logarithm.

The term that corresponds to site can be further refined by decomposing into its sub-models, which provides insight into their individual effects. The impact of the HVAC control app at site i is reflected in its corresponding term: obtained from Equation (5), which shows that reinforcing the app, that is , nullifies the amplification effect of since for both sum-form and product-form utility functions. Such an analysis can be carried out for other critical components of the sites to gain information on which components to reinforce for higher utility. In particular, reinforcing the site fiber routes will have a similar effect on nullification, but server reinforcements will have somewhat lesser impact.

5.3.2. Composite Utility Functions

We now obtain the following expected number of servers for the composite utility functions,

In the equation, is positive, and it is reasonable to assume that , since at NE, and the survival probability of entire infrastructure does not decrease with . Thus, the expected capacity decreases with , and the opposite is true with respect to , as discussed in the previous section. In both cases, the dependence on the number of servers at site i is qualitatively similar in that the expected capacity increases proportional to its logarithm, also as in the previous section. As in sum-form and product-form utility functions, the term: can be decomposed using sub-models of site i to assess the impacts of its parts, in particular its components. For the HVAC app at site i, we have the corresponding term: which shows that reinforcing the HVAC app nullifies the amplification by factor , even under the more general utility function since does not appear in the dependent term . Furthermore, such an analysis can be carried out for other components, and in a limiting case, each component can be modeled as a singleton sub-model, in which case their attack and reinforcement variables are Boolean.

The dependencies considered here for the sub-models are quite simple as a result of the statistical independence and uniform distributions of reinforcements and attacks. Even under such simple conditions, the detailed NE conditions are quite complex to characterize, but they do provide qualitative insights into the effects of underlying parameters.

6. Conclusions

We consider a class of infrastructures with multiple systems, wherein the communications network plays an asymmetric role by providing the critical connectivity between them. By utilizing correlations at the system- and component-level, we formulated the problem of ensuring the infrastructure survival as a game between an attacker and a provider, by using composite utility functions that generalize the sum-form and product-form utility functions. We derived Nash equilibrium conditions in terms of composite gain-cost and composite multiplier, which provide compact expressions for individual system survival probabilities and also the expected number of operational components. This paper presented a unified account of partial results that were separately developed for: sum-form utility functions [5] and under asymmetric network conditions [1]; product-form utility functions [8]; composite utility functions [2]; composite utility functions under asymmetric network conditions [3]; and detailed derivations for multi-site cloud server infrastructure [4]. These results extend previous results on interconnected systems [30,32] and cyber-physical infrastructures [31] by using the composite utility functions. We presented a comprehensive treatment of the three utility functions, including more illustrative details of the sum-form and product-form utility functions. For multi-site cloud infrastructures, we explicitly related the correlation functions and system multiplier functions to the infrastructure parameters, which in turn provided us insights into the estimates for system survival probabilities and the expected capacity. In particular, by employing sub-models of the sites, the effect of parts of the system on the expected capacity could be inferred by using the corresponding multiplier functions.

The formulation studied in this paper can be extended to include cases where targeted attacks and reinforcements of specific individual components are explicitly represented. The system models here incorporate the same level of detail in that they all consist of components, and it would be of future interest to incorporate varying levels of detail in them, for example by replacing components with the recursively-defined systems. The utility functions considered in this paper do not explicitly use the capacity term. Instead, they are driven by the infrastructure level considerations by using , which in turn leads to expressions for the capacity that involve other terms that contribute to . It is of future interest to compare this formulation to ones whose utility functions contain the expected capacity term in place of infrastructure survival probability terms. Another future direction is to consider the simultaneous cyber and physical attacks on multiple systems and components and sequential game formulations of this problem. Performance studies of our approach using more detailed models of cloud computing infrastructure, smart energy grid infrastructures and high-performance computing complexes would be of future interest.