Soft Computing Techniques Help Assign Weights to Different Factors in Vulnerability Analysis

Transcription

1 Soft Coputing Techniques Help Assign Weights to Different Factors in Vulnerability Analysis Beverly Rivera 1,2, Irbis Gallegos 1, and Vladik Kreinovich 2 1 Regional Cyber and Energy Security Center RCES 2 Coputational Science Progra University of Texas at El Paso 500 W University El Paso, TX 79968, USA barivera@inersutepedu, irbisg@utepedu, vladik@utepedu Abstract The ain objective of vulnerability analysis is to select the alternative which is the least vulnerable To ake this selection, we ust describe the vulnerability of each alternative by a single nuber then we will select the alternative with the sallest value of this vulnerability index Usually, there are any aspects of vulnerability: vulnerability of a certain asset to a stor, to a terrorist attack, to hackers attack, etc For each aspect, we can usually gauge the corresponding vulnerability, the difficulty is how to cobine these partial vulnerabilities into a single weighted value In our previous research, we proposed an epirical idea of selecting the weights proportionally to the nuber of ties the corresponding aspect is entioned in the corresponding standards and requireents This idea was shown to lead to reasonable results In this paper, we provide a possible theoretical explanation for this epirically successful idea I FORMULATION OF THE PROBLEM Need for vulnerability analysis When it turns out that an iportant syste is vulnerable to a stor, to a terrorist attack, to hackers attack, etc we need to protect it Usually, there are any different ways to protect the sae syste It is therefore desirable to select the protection schee which guarantees the largest degree of protection within the given budget The corresponding analysis of different vulnerability aspects is known as it vulnerability analysis; see, eg, [2], [8], [11], [12], [13], [14] Vulnerability analysis: reinder Aong several possible alternative schees for protecting a syste, we ust select a one under which the syste will be the least vulnerable As we have entioned, there are any different aspects of vulnerability Usually, it is known how to gauge the vulnerability v i of each aspect i Thus, each alternative can be characterized by the corresponding vulnerability values (v 1,, v n ) Soe alternatives results in saller vulnerability of one of the assets, other alternatives leave this asset ore vulnerable but provide ore protection to other assets To be able to copare different alternatives, we need to characterize each alternative by a single vulnerability index v an index that would cobine the values v 1,, v n corresponding to different aspects: v f(v 1,, v n ) If one of the vulnerabilities v i increases, then the overall vulnerability index v ust also increase (or at least reain the sae, but not decrease) Thus, the cobination function f(v 1,, v n ) ust be increasing in each of its variables v i Vulnerability analysis: iportant challenge While there are well-developed ethods for gauging each aspect of vulnerability, there is no well-established way of cobining the resulting values v 1,, v n into a single criterion v f(v 1,, v n ) Usually, vulnerabilities v i are reasonably sall; so ters which are quadratic (or of higher order) in v i can be usually safely ignored As a result, we can expand the (unknown) function f(v 1,, v n ) in Taylor series in v i and keep only linear ters in this expansion As a result, we get a linear dependence v c 0 + c i v i for soe coefficients c i Coparison between different alternatives does not change if we subtract the sae constant c 0 fro all the cobined values: v < v if and only if v c 0 < v c 0 Thus, we can safely assue that v 0 0 and v c i v i Siilarly, coparison does not change if we re-scale all the values, eg, divide the by the sae constant c i This is equivalent to considering a new (re-scaled) cobined function c i v i f(v 1,, v n ) v i, c i v i where def c i c j j1 For these new weights, we have 1

2 The fact the function ust be increasing iplies that 0 The iportant challenge is how to copute the corresponding weights Heuristic solution In [4], [15], [17], we proposed an epirical idea of selecting the weights proportionally to the the frequency with which the corresponding aspect is entioned in the corresponding standards and requireents This idea was shown to lead to reasonable results Reaining proble and what we do in this paper A big proble is that the above approach is purely heuristic, it does not have a solid theoretical explanation In this paper, we provide a possible theoretical explanation for this epirically successful idea II POSSIBLE THEORETICAL EXPLANATION Main idea We consider the situation in which the only inforation about the iportance of different aspects is how frequently these aspects are entioned in the corresponding docuents In this case, the only inforation that we can use to copute the weight assigned to the i-th aspect is the frequency f i with which this aspect is entioned in the docuents In other words, we take F (f i ), where F (x) is an algorith which is used to copute the weight based on the frequency Our goal is to forulate reasonable requireents on the function F (x) and find all the functions F (x) which satisfy this requireent First requireent: onotonicity The ore frequently the aspect is entioned, the ore iportant it is; thus, if f i > f j, we ust have F (f i ) > F (f j ) In atheatical ters, this eans that the function ust be increasing Second requireent: the weights ust add up to one Another natural requireent is that for every cobination of frequencies f 1,, f n for which f i 1, the resulting weights ust add up to 1: F (f i ) 1 We are now ready to forulate our ain result Proposition 1 Let F : [0, 1] [0, 1] be an increasing function for which n f i 1 iplies n F (f i ) 1 Then, F (x) x Coent So, it is reasonable to use the frequencies as weights This justifies the above epirically successful heuristic idea Proof 1 Let us first prove that F (1) 1 This follows fro our ain requireent when n 1 and f 1 1 In this case, the requireent F (f i ) 1 leads to F (f 1 ) F (1) 1 2 Let us prove that F (0) 0 Let us consider n 2, f 1 0, and f 2 1 Then, f i 1 and therefore, F (f i ) F (0) + F (1) 1 Since we already know that F (1) 1, we thus conclude that F (0) 1 F (1) Let us prove that for every 2, we have F 1 Let us consider n and Then, and therefore, f 1 f n 1 f i 1 F (f i ) F We thus conclude that F Let us prove that for every k, we have ( ) k F k Let us consider n k + 1, f 1 k and f 2 f k+1 1

3 Then, and therefore, F (f i ) F We already know that f i 1 ( ) ( ) k 1 + ( k) F 1 F 1 Thus, we have ( ) k F 1 ( k) F 1 ( k) 1 k The stateent is proven 5 We have already proven that for every rational nuber r, we have F (r) r To coplete the proof, we need to show that F (x) x for every real nuber fro the interval [0, 1], not only for rational nubers Let x be any real nuber fro the interval (0, 1) Let x 0x 1 x 2 x n, x i {0, 1}, be its binary expansion Then, for every n, we have l n def 0x 1 x n x u n def l n + 2 n As n tends to infinity, we have l n x and u n x Due to onotonicity, we have F (l n ) F (x) F (u n ) Both bounds l n and u n are rational nubers, so we have F (l n ) l n and F (u n ) u n Thus, the above inequality takes the for l n F (x) u n In the liit n, when l n x and u n x, we get x F (x) x and thus, F (x) x The proposition is proven Possible fuzzy extension Our current analysis is aied at situations when we are absolutely sure which aspects are entioned in each stateent In practice, however, standards and docuents are written in natural language, and a natural language is often iprecise ( fuzzy ) As a result, in any case, we can only decide with soe degree of certainty whether a given phrase refers to this particular aspect A natural way to describe such degrees of certainty is by using fuzzy logic, technique specifically designed to capture iprecision of natural language; see, eg, [6], [10], [19] In this case, instead of the exact frequency f i which is defined as a ratio n i N between the nuber n i of entions of the i-th aspect and the total nuber N of all entions we can use the ratio µ i N, where µ i is a fuzzy cardinality of the (fuzzy) set of all entions of the i-th aspects which is usually defined as the su of ebership degrees ( degrees of certainty) for all the words fro the docuents III TOWARDS A MORE GENERAL APPROACH What we did: reinder In the previous section, we proved that if we select the i-th weight depending only only on the i-th frequency, then the only reasonable selection is F (x) x A ore general approach Alternatively, we can copute a pre-weight F (f i ) based on the frequency, and then we can noralize the pre-weights to ake sure that they add up to one, ie, take F (f i) F (f k ) k1 Reaining proble In this ore general approach, how to select the function? What we do in this section In this section, we describe reasonable requireents on this function, and we describe all possible functions which satisfy these requireents First requireent: onotonicity Our first requireent is that aspects which are entioned ore frequently should be given larger weights In other words, if f i > f j, then we should have F (f i) > F (f j) F (f k ) F (f k ) k1 k1 Multiplying both sides of this inequality by the su F (f k ), k1 we conclude that F (f i ) > F (f j ), ie, that the function should be onotonic Second requireent: independence fro irrelevant factors Let us assue that we have four aspect, and that the i-th aspect is entioned n i ties in the corresponding docuent In this case, the frequency f i of the i-th aspect is equal to n i f i n 1 + n 2 + n 3 + n 4 Based on these frequencies, we copute the weights, and then select the alternative for which the overall vulnerability is the sallest possible w 1 v 1 + w 2 v 2 + w 3 v 3 + w 4 v 4 In particular, we ay consider the case when for this particular proble, the fourth aspect is irrelevant, ie, for which v 4 0 In this case, the overall vulnerability is equal to w 1 v 1 + w 2 v 2 + w 3 v 3 On the other hand, since the fourth aspect is irrelevant for our proble, it akes sense to ignore entions of this aspect, ie, to consider only the values n 1, n 2, and n 3 In this approach, we get new values of the frequencies: f i n i n 1 + n 2 + n 3

4 Based on these new frequencies f i, we can now copute the new weights, and then select the alternative for which the overall vulnerability is the sallest possible w 1 v 1 + w 2 v 2 + w 3 v 3 The resulting selection should be the sae for both criteria As we have entioned, the optiizing proble does not change if we siply ultiple the objective function by a constant So, if w i λ for soe λ, these two objective functions lead to the exact sae selection In this case, the trade-off between each two aspects is the sae: However, if we have a different trade-off between individual criteria, then we ay end up with different selections Thus, to ake sure that the selections are the sae, we ust guarantee that w j Substituting the forulas for the weights into the expression for the weight ratio, we can conclude that F (f i) F (f j ) Thus, the above requireent takes the for F (f i ) F (f j ) F (f i) F (f j ) One can check that the new frequencies f i can be obtained fro the previous ones by ultiplying by the sae constant: f i n i n 1 + n 2 + n 3 n 1 + n 2 + n 3 + n 4 n i n 1 + n 2 + n 3 n 1 + n 2 + n 3 + n 4 where we denoted k f i, k def n 1 + n 2 + n 3 + n 4 n 1 + n 2 + n 3 Thus, the above requireent takes the for F (k f i ) F (k f j ) F (f i) F (f j ) This should be true for all possible values of f i, f j, and k Once we postulate that, we arrive at the following result Proposition 2 An increasing function F : [0, 1] [0, 1] satisfies the property F (k f i ) F (k f j ) F (f i) F (f j ) for all possible real values k, f i, and f j if and only if C f for soe > 0 Coents Proof The previous case corresponds to 1, so this is indeed a generalization of the forula described in the previous section If we ultiply all the values F (f i ) by a constant C, then the noralizing su is also ultiplied by the sae constant, so the resulting weights do not change: F (f i) C f i f i F (f k ) C fk k1 k1 fk k1 Thus, fro the viewpoint of application to vulnerability, it is sufficient to consider only functions f 1 First, it is easy to check that for all possible values C and > 0, the function C f is increasing and satisfies the desired property So, to coplete our proof, we need to check that each increasing function which satisfies this property has this for 2 The desired property can be equivalently reforulated as F (k f i ) F (f i ) F (k f j) F (f j ) This equality holds for all possible values of f i and f j This eans that the ratio F (k f) does not depend on f, it only depends on k Let us denote this ratio by c(k) Then, we get ie, equivalently, F (k f) c(k), F (k f) c(k) 3 Since k f f k, we have F (k f) F (f k), ie, c(k) c(f) F (k) Dividing both sides by c(k) c(f), we conclude that c(f) F (k) c(k) This equality holds for all possible values of f and k This eans that the ratio c(f)

5 does not depend on f at all, it is a constant We will denote this constant by C Fro the condition c(f) C, we conclude that C c(f) So, to prove our results, it is sufficient to find the function c(f) 4 Substituting the expression C c(f) into the forula F (k f) c(k), we get C c(k f) c(k) C c(f) Dividing both sides of this equality by C, we conclude that c(k f) c(k) c(f) Let us use this equality to find the function c(f) 5 For k f 1, we get c(1) c(1) 2 Since c(k) 0, we conclude that c(1) 1 6 Let us denote c(2) by q Let us prove that for every integer n, we have c(2 1/n ) q 1/n Indeed, for f 2 1/n, we have thus, f f f (n ties) 2, q c(2) c(f) c(f) (n ties) (c(f)) n Therefore, we conclude that indeed, c(f) 2 1/n 7 Let us prove that for every two integers and n, we have Indeed, we have Therefore, we have c(2 /n ) q /n 2 /n 2 1/n 2 1/n ( ties) c(2 /n ) c(2 1/n ) c(2 1/n ) ( ties) (c(2 1/n ) We already know that c(2 1/n ) q 1/n ; thus, we conclude that The stateent is proven c(2 /n ) (q 1/n ) q /n 8 So, for rational values r, we have c(2 r ) q r Let us denote def log 2 (q) By definition of a logarith, this eans that q 2 Thus, for x 2 r, we have q r (2 ) r 2 r (2 r ) x So, for values x for which log 2 (x) is a rational nuber, we get c(x) x Siilarly to the proof of Proposition 1, we can use onotonicity to conclude that this equality c(x) x holds for all real values x We have already proven that F (x) C c(x), thus we have F (x) C x The proposition is proven IV POSSIBLE PROBABILISTIC INTERPRETATION OF THE ABOVE FORMULAS Forulation of the proble In the above text, we justified the epirical forula F (x) x without using any probabilities since we do not know any probabilities that we could use here However, in the ideal situation, when we know the exact probability of every possible outcoe and we know the exact consequences of each outcoes, a rational decision aker should use probabilities naely, a rational decision aker should select an alternative for which the expected value of the utility is the largest; see, eg, [3], [7], [9], [16] Fro this viewpoint, it would be nice to show that the above heuristic solution is not only reasonable in the above abstract sense, but that it actually akes perfect sense under certain reasonable assuptions about probability distributions What we do in this section In this section, on the exaple of two aspects v 1 and v 2, we show that there are probability distributions for which the weights should be exactly equal to frequencies Towards a foral description of the proble Let us assue that the actual weights of two aspects are w 1 and w 2 1 w 1 Let us also assue that vulnerabilities v i are independent rando variables For siplicity, we can assue that these two variables are identically distributed In each situation, if the first vulnerability aspect is ore iportant, ie, if w 1 v 1 > w 2 v 2, then the docuent entions the first aspect If the second vulnerability aspect is ore iportant, ie, if w 1 v 1 < w 2 v 2, then the docuent entions the second aspect In this case, the frequency f i with which the first aspect is entioned is equal to the probability that the first aspect is ost iportant, ie, the probability that w 1 v 1 > w 2 v 2 : f 1 P (w 1 v 1 > w 2 v 2 ) We would like to justify the situation in which f i, so we have w 1 P (w 1 v 1 > w 2 v 2 ) This equality ust hold for all possible values of w 1 Analysis of the proble and the resulting solution The desired equality can be equivalently reforulated as ( v1 P > w ) 2 w 1 v 2 w 1 Since w 2 1 w 1, we get ( v1 P > 1 w ) 1 w 1 v 2 w 1 To siply coputations, it is convenient to use logariths: then ratio becoe a difference, and we get where we denoted P (ln(v 1 ) ln(v 2 ) > z) w 1, z def ln ( 1 w1 w 1 )

6 Let us describe w 1 in ters of z Fro the definition of z, we conclude that e z 1 w 1 w 1 1 w 1 1 Thus, and So, we conclude that 1 w e z, w e z P (ln(v 1 ) ln(v 2 ) > z) e z The probability of the opposite event ln(v 1 ) ln(v 2 ) z is equal to one inus this probability: P (ln(v 1 ) ln(v 2 ) z) e z ez 1 + e z This eans that for the auxiliary rando variable ξ def ln(v 1 ) ln(v 2 ), the cuulative distribution function F ξ (z) def P (ξ z) is equal to F ξ (z) ez 1 + e z This distribution is known as a logistic distribution; see, eg, [1], [5], [18] It is known that one way to obtain a logistic distribution is to consider the distribution of ln(v 1 ) ln(v 2 ), where v 1 and v 2 are are independent and exponentially distributed Thus, the desired forula f i (ie, F (x) x) corresponds to a reasonable situation when both vulnerabilities are exponentially distributed ACKNOWLEDGMENTS This work was supported by the University of Texas at El Paso Regional Cyber and Energy Security Center (RCES) supported by the City of El Paso s Planning and Econoic Developent division This work was also supported in part by the National Science Foundation grants HRD and HRD (Cyber-ShARE Center of Excellence) and DUE REFERENCES [1] N Balakrishnan, Handbook of the Logistic Distribution Marcel Dekker, New York, 1992 [2] Departent of Energy, Electricity Subsector Cybersecurity Capability Maturity Model (ES-C2M2), Version 10, 2012, available at [3] P C Fishburn, Nonlinear Preference and Utility Theory, John Hopkins Press, Baltiore, Maryland, 1988 [4] I Gallegos et al, Syste, Method and Apparatus for Assessing a Risk of one or More Assets within an Operational Technology Infrastructure, US Patent No 61/725,474, 2012 [5] N L Johnson, S Kotz, and N Balakrishnan, Continuous Univariate Distributions, Vol 2, Wiley, New York, 1995 [6] G Klir and B Yuan, Fuzzy Sets and Fuzzy Logic, Prentice Hall, Upper Saddle River, New Jersey, 1995 [7] R D Luce and R Raiffa, Gaes and Decisions: Introduction and Critical Survey, Dover, New York, 1989 [8] National Electric Sector CyberSecurity Organization Resource (NESCOR), Electric Sector Failure Scenarios and Ipact Analyses, Version 10, 2012, available at [9] H T Nguyen, V Kreinovich, B Wu, and G Xiang, Coputing Statistics under Interval and Fuzzy Uncertainty, Springer Verlag, Berlin, Heidelberg, 2012 [10] H T Nguyen and E A Walker, A First Course in Fuzzy Logic, Chapan and Hall/CRC, Boca Raton, Florida, 2006 [11] National Institute of Standard and Technology (NIST), Guide for Mapping Types of Inforation and Inforation Systes for Security Categories, NIST Special Publication , Volue 1, Revision 1, 2008 [12] National Institute of Standard and Technology (NIST), Guide for Conducting Risk Assessent, NIST Special Publication , Revision 1, 2011 [13] National Institute of Standard and Technology (NIST), Guide to Industrial Control Systes (ICS) Security, NIST Special Publication , 2011 [14] National Institute of Standard and Technology (NIST), Security and Privacy Controls for Federal Inforation Systes and Organizations, NIST Special Publication , Revision 4, 2012 [15] L Perez, Regional Cyber and Energy Security (RCES) Center 2012 Annual Progress Report Year 1, El Paso, Texas, June 2013, available as clerk/agenda/ / cpdf [16] H Raiffa, Decision Analysis, McGraw-Hill, Colubus, Ohio, 1997 [17] Regional Cyber and Energy Security (RCES) Center at the University of Texas at El Paso, Developing a Fraework to Iprove Critical Infrastructure Cyber Security, National Institute for Standards and Technology (NIST) Report, April 2013, available as coents/rces center pdf [18] D J Sheskin, Handbook of Paraetric and Nonparaetric Statistical Procedures, Chapan & Hall/CRC, Boca Raton, Florida, 2011 [19] L A Zadeh, Fuzzy sets, Inforation and Control, 1965, Vol 8, pp