Target-Hardening Decisions Based on Uncertain Multiattribute Terrorist Utility

Transcription

1 CREATE Reearch Archive Publihed Article & Paper Target-Hardening Deciion Baed on Uncertain Multiattribute Terrorit Utility Chen Wang Univerity of Wiconin - Madion, cwang37@wic.edu Vicki M. Bier Univerity of Wiconin Madion, bier@engr.wic.edu Follow thi and additional work at: Recommended Citation Wang, Chen and Bier, Vicki M., "Target-Hardening Deciion Baed on Uncertain Multiattribute Terrorit Utility" (211). Publihed Article & Paper. Paper Thi Article i brought to you for free and open acce by CREATE Reearch Archive. It ha been accepted for incluion in Publihed Article & Paper by an authorized adminitrator of CREATE Reearch Archive. For more information, pleae contact gribben@uc.edu.

2 Deciion Analyi Vol. 8, No. 4, December 211, pp in ein INFORMS INFORMS hold copyright to thi article and ditributed thi copy a a courtey to the author(). Additional information, including right and permiion policie, i available at Target-Hardening Deciion Baed on Uncertain Multiattribute Terrorit Utility Chen Wang, Vicki M. Bier Department of Indutrial and Sytem Engineering, Univerity of Wiconin Madion, Madion, Wiconin 5376 cwang37@wic.edu, bier@engr.wic.edu} We preent a game-theoretic model to explore how uncertainty about terrorit preference can affect optimal reource allocation for infratructure protection. We conider a dynamic game with incomplete information, in which the defender chooe how to allocate her defenive reource, and then an attacker chooe which target to attack according to a multiattribute utility function. Our model contruct a prior ditribution repreenting both defender uncertainty about the attacker weight on the variou attribute in the attacker utility function and alo defender ignorance about unoberved attribute that may be important to the attacker but have not been identified by the defender. The incorporation of unoberved attribute i a novel feature of our model and allow every target to have a poitive prior probability of being attacked when the defender i ufficiently uncertain about the attacker preference. In a dynamic environment, the defender then ha an opportunity to jointly update her knowledge about both the attribute weight and unoberved attribute in a Bayeian manner, baed on actual (or attempted) attack oberved in a previou period of the game. In general, defender uncertainty ha a greater impact on defenive reource allocation in our model than in much of the previou work. Key word: game theory; multiattribute utility; Baye method; homeland ecurity; uncertainty Hitory: Received on January 8, 21. Accepted on September 15, 211, after 1 reviion. Publihed online in Article in Advance October 28, Introduction Learning about terrorit goal and motivation can help defender protect the mot attractive target and avoid wated effort. In fact, that i one of the primary reaon for gathering intelligence about potential attacker in the firt place. Intelligence and warning have been identified a one of ix critical miion area in the firt National Strategy for Homeland Security (U.S. Department of Homeland Security 22). Recently, there ha alo been emerging interet in the interface between intelligence analyi and rik analyi (e.g., Willi 27, Bracken et al. 28, Baker et al. 29). Thi paper explore how bet to repreent defender uncertainty about terrorit preference, conidering attacker adaptability, multiattribute attacker objective, and the poibility of defender learning. Becaue of the trategic nature of terrorit threat, numerou reearcher have ued game theory to tudy reource-allocation deciion for protecting potential target againt terrorim; ee, for example, the review by Sandler and Siqueira (29) and Guikema (29). Uing the aumption of rationality, game theory focue on the relationhip between terrorit and defender, with both being aumed to make optimal choice baed on their available reource and knowledge. Generally, a equential game with two player (a defender and an attacker) i conidered. A typical model aume that the defender move firt to allocate her defenive reource among potential target; then the attacker oberve the allocation and chooe an attack action (e.g., Brown et al. 26, Powell 27a, Bier et al. 27). Although ome model allow continuou choice for both player (e.g., Major 22, Siqueira and Sandler 26, Zhuang and Bier 27), Sandler and Sigueira (29) note that the number of continuou variable i generally limited. Therefore, to emphaize the defender ide of the reource-allocation problem, reearcher often aume continuou defender deciion but dicrete attacker choice (e.g., Bier et al. 27, 28). 286

3 Wang and Bier: Target-Hardening Deciion Under Uncertainty Deciion Analyi 8(4), pp , 211 INFORMS 287 INFORMS hold copyright to thi article and ditributed thi copy a a courtey to the author(). Additional information, including right and permiion policie, i available at Much pat work i baed on game of complete information, in which the payoff function of the participant are fully known to each other. However, Bier (27, p. 67) point out that uncertainty about terrorit goal and value play an important role in contemporary dicuion of terrorim, and hence i important to capture in a model of the optimal defenive allocation. The importance of uncertainty about terrorit characteritic for reource-allocation deciion i alo dicued by Farrow (28). Early exploration of game-theoretic model with incomplete information focued on the defender uncertainty about attacker capacitie (e.g., the total reource available to the attacker). For example, Lapan and Sandler (1993) modeled the defender ubjective aement of the attacker capacity by a continuou probability ditribution; by contrat, Brown et al. (26) conducted a wort-cae cenario analyi over all poible value of the attacker capacity. Later reearcher have extended interet to defender uncertainty about attacker preference among potential target. For example, Bier et al. (27) repreented uch uncertainty through probability ditribution repreenting the defender belief about attacker target valuation; in thi model, the probability of an attack on a given target can be determined endogenouly, in light of any defenive invetment. Some reearcher have alo tudied the effect of attacker uncertainty. For example, Powell (27b) allowed defender to have private information about the vulnerability of potential target, wherea the attacker oberved only a probability ditribution for the vulnerability of each target. Zhuang et al. (21) aumed dicrete defender type that are not fully known to the attacker, and allowed the defender to implement deceptive ignal to milead the attacker. Mot of the above model do not explicitly explore how the defender optimal reource allocation vary in the face of her uncertainty level. However, ome exploratory effort have been made in thi regard. For example, Bier et al. (28) aumed that attacker target valuation follow a Rayleigh ditribution, and took the coefficient of variation a a meaure of defender uncertainty. Similarly, Jeneliu et al. (21) aumed that the defender aement of attacker target valuation i ubject to error that follow a Gumbel ditribution. Interetingly, the reult of Jeneliu et al. (21) how a ignificant impact of uncertainty on the optimal reource allocation, wherea the reult in Bier et al. (28) how little impact of uncertainty. However, the reult by Bier et al. (28) do indicate that different meaure of target attractivene can yield ignificantly different optimal budget allocation, uggeting that a ingle univariate meaure of attractivene may be inadequate to capture the full effect of defender uncertainty. To explore the impact of defender uncertainty about terrorit preference on defenive reource-allocation deciion, more realitic multiattribute terrorit objective function may therefore be preferable, uch a thoe developed by Beitel et al. (24) and Rooff and John (29). Uncertainty alo evolve over time, and Bayeian method can capture uch change. For example, Lapan and Sandler (1993) allow the defender to update her knowledge about the attacker capability in a Bayeian manner by oberving the attacker hitorical action; Sticha et al. (25) and Jha (29) ue dynamic Bayeian network to update defender belief about the attacker propenity to attack. In contrat, Zhuang et al. (21) model two type of attacker learning, in which the attacker can oberve both the defender ignal and the actual reult of pat attack in a dynamic environment. In thi paper, we conider a dynamic game with incomplete information, in which the defender firt chooe how to allocate her defenive reource, and then an attacker chooe which target to attack according to hi target preference repreented by a multiattribute utility function. Inpired by Jeneliu et al. (21), we incorporate unoberved attribute (which may be important to the attacker but have not been identified by the defender) into the attacker multiattribute utility function. The defender uncertainty about attacker preference i then modeled by a ubjective ditribution repreenting both defender uncertainty about the attacker weight on the variou known attribute and alo defender ignorance about any unoberved attribute. Our model allow the defender and attacker to have different objective, a oppoed to a zero-um game where they have oppoed objective. Moreover, we allow the defender to update her knowledge about attacker preference in a Bayeian manner, baed on actual (or attempted) attack oberved in a previou period of the game.

4 Wang and Bier: Target-Hardening Deciion Under Uncertainty 288 Deciion Analyi 8(4), pp , 211 INFORMS INFORMS hold copyright to thi article and ditributed thi copy a a courtey to the author(). Additional information, including right and permiion policie, i available at We believe that our model allow for a more realitic repreentation of defender uncertainty about attacker preference than previou work uing univariate attacker utility function without unoberved attribute (e.g., Bier et al. 27, 28). A uch, it could pave the way for the ue of game-theoretic method (which have hitorically been viewed a not yet ready for prime time ) in upporting real reourceallocation deciion. 2. Model 2.1. Baic Model Our baic model i a two-period dynamic (repeated) game with incomplete information, where each period i a equential game in which the defender play firt. The firt period of the game look like the one-period game propoed in Bier et al. (27), with ome minor modification. Nature firt draw a type for the attacker from a prior ditribution f. The attacker oberve thi type, but the defender know only the ditribution f. In the firt period, the defender decide on how to allocate her defenive reource among a heterogeneou collection of potential target, where c 1 f repreent the firt-period allocation choen in the face of the ditribution f. The attacker then oberve the defenive allocation, chooe whether to attack, and, if making an attack, chooe an attack target; a 1 c 1 repreent the attacker deciion and target choice (if any). An attack may turn out to be either a ucce or a failure. In the econd period, the defender oberve the target of any (ucceful or failed) attack, update the prior ditribution f over attacker type to obtain a poterior ditribution f a 1, and make a new reourceallocation deciion baed on that ditribution. The defender new allocation i c 2 [f a 1 ], to which the attacker repond with a new attack deciion and target choice a 2 c 2. See Figure 1 for the correponding game tree. Knowing or auming that the attacker would play hi bet repone to any given defenive allocation, the defender would wih to chooe her allocation to effectively protect againt attack, deter attack, or deflect attack to le important target. However, with uncertainty about the attacker utility function, the defender cannot predict the attacker bet Figure 1 Firt-period game Second-period game Game Tree Nature Defender Attacker Defender Attacker Draw attacker type from the ditribution f Oberve f, but not attacker type; decide on 1t-period allocation c 1 (f ) Oberve 1t-period allocation c 1 ; decide on 1t-period attack a 1 (c 1 ) Oberve attack a 1, and update f to f (a 1 ); decide on 2nd-period allocation c 2 [f (a 1 )] Oberve 2nd-period allocation c 2 ; decide on 2nd-period attack a 2 (c 2 ) repone for ure; therefore, the defender i aumed to minimize her total expected diutility. In principle, a traditional game-theoretic model would conider the long-term total expected utility/diutility for both period; i.e., the defender and attacker would chooe their firt-period action taking into account their econd-period payoff. However, in thi paper, we aume a myopic attacker and defender for reaon of implicity. Thi aumption could alo be realitic if the attacker and defender change from one period to the next (e.g., becaue of turnover in the leaderhip of attacker group and election of a new adminitration in the defender country). In the firt period, the (myopic) defender objective i to minimize the total expected diutility from an attack, taking into account the threat (quantified by the probabilitie of attack on the variou target), the vulnerability (quantified by the ucce probabilitie of thoe attack, a a function of the allocation of defenive reource), and the conequence (quantified by the defender valuation of the target). The defender optimization problem i thu given by min L c h i c p c i v i.t. c i B c where i n number of target, c i defender reource allocation to target i, c c 1 c n defender reource allocation to the n target, B defender total budget, v i defender valuation of target i, p c i ucce probability of an attack on target i a a function of the budget allocated to target i, h i c probability of an attack on target i, L c total expected diutility to the defender.

5 Wang and Bier: Target-Hardening Deciion Under Uncertainty Deciion Analyi 8(4), pp , 211 INFORMS 289 INFORMS hold copyright to thi article and ditributed thi copy a a courtey to the author(). Additional information, including right and permiion policie, i available at A in Bier et al. (28), we aume that the ucce probability of an attack on target i i an exponential function of the defender invetment in that target, p c i e c i, where i the cot effectivene of defenive invetment. For example, at 2, if the c i are meaured in million of dollar, then every million dollar of defenive invetment will reduce the ucce probability of an attack by about 2%. For convenience, we introduce a target to repreent no attack, in which cae the defender uffer no lo, v, and the attacker gain only a reerve utility of u. For example, u could repreent the cot of an attack (which would be aved by the attacker if no attack i launched). In thi model, h c repreent the probability that no attack will happen. Moreover, we aume that the defender never allocate reource to target ; i.e., c. Therefore, p c 1, enuring that if the attacker launche no attack, he will obtain the reerve utility u for ure. The attacker i aumed to oberve the defender reource allocation c and then chooe a target to attack according to a multiattribute utility function with three attribute, of which attribute 1 and 2 are aumed to be obervable by the defender (although of coure more attribute could be conidered). We aume that the attacker utility i linear in each of the variou attacker attribute. We alo aume additive independence among the attribute. The attacker deciion i then to chooe an attack target to maximize hi utility function: where max I i 1 i n i I i p c i u i.t. I i 1 u i A i1 x 1 + A i2 x 2 + i x 3, the attacker utility of target i; A ij attacker utility of target i on attribute j j 1 2, where A ij take value in [ 1], with 1 repreenting the bet poible value of the jth attribute and repreenting the wort poible value; i utility of the unoberved attribute for target i; x x 1 x 2 x 3, attacker weight on the three attribute, where x j for j 1 2 3, and 3 j1 x j 1; I i 1 if target i i attacked and otherwie. i The A ij repreent the attacker ingle-attribute utilitie (not the actual attribute value) over the two attribute that are known to the defender. In addition, inpired by Jeneliu et al. (21), we introduce the error term i to repreent the effect of any additional attribute that are unoberved by the defender but may nonethele be important to the attacker. For convenience, we alo define 1 n a a vector repreenting the utilitie of the unoberved attribute for the n target. In thi paper, the i for each target are modeled a random variable taking on value in [ 1]. Therefore, the attacker utility u i for target i will be between and 1 for all i. Note that i a contant, not a random variable, and A j u i the attacker reerve utility Defender Uncertainty About Attacker Preference To pecify the defender uncertainty about attacker target valuation, we repreent the attacker type by the attribute weight x and unoberved attribute, and allow them to be uncertain (a they will be to the defender). Auming that the attribute weight x and the i are independent of each other, the joint ditribution of the x j and i for a given attacker type i given by f x g x 1 x 2 x 3 3 q i i where g x 1 x 2 x 3 i the joint probability denity function (PDF) for the attribute weight x, and q i i i the PDF for the utility of the unoberved attribute i for target i. In thi model, we aume that the attribute weight x follow the Dirichlet ditribution a given by j1 g x 1 x 2 x 3 Dirichlet j1 j 3 j1 x j 1 j where z tz 1 e t dt j > for j 1 2 3; 3 j1 j; x j for j 1 2 3; and x j1 x j. In thi cae, the mean and variance of the x j are given by E x j j / and Var x j j j / 2 1 +, repectively, and the covariance are given by Cov x j x j j j /

6 Wang and Bier: Target-Hardening Deciion Under Uncertainty 29 Deciion Analyi 8(4), pp , 211 INFORMS INFORMS hold copyright to thi article and ditributed thi copy a a courtey to the author(). Additional information, including right and permiion policie, i available at The Dirichlet ditribution ha the deired property of enuring that the weight um to one. Moreover, changing the value of the parameter in the Dirichlet ditribution while holding the expected value of the attribute weight contant enable u to vary the extent of the defender uncertainty by changing a ingle parameter, with larger value of correponding to maller level of uncertainty. Auming that the defender ha no prior knowledge of the unoberved attribute, we model the utilitie of the unoberved attribute i for each target a independent, identically beta ditributed random variable in the firt-period game; i.e., q i i Beta 1 2 for i 1 n where 1 > and 2 >. To how the effect of the unoberved attribute explicitly, let be the contribution of the unoberved attribute to the average overall variance of attacker target utilitie (a a multiple of the average variance due olely to the known attribute), a given by 1/n n Var u i 1/n n Var u i i E i 1/n n Var u i i E i n Var u i n Var u i i E i n Var u i i E i Specifically, the average overall variance of attacker target utilitie, 1/n n Var u i, i equal to (1 + ) time the average variance due olely to the known attribute, 1/n n Var u i i E i. (Note that mut be nonnegative, with larger value of correponding to higher defender uncertainty, i.e., more impact of the unoberved attribute.) Becaue the attribute weight x and the i are independent, the numerator of the above expreion can be expanded and implified a follow: Var u i Var u i i E i E u 2 i E2 u i E u 2 i i E i E 2 u i i E i E u 2 i E u 2 i i E i E A i1 x 1 + A i2 x 2 + i x 3 2 E A i1 x 1 + A i2 x 2 + E i x 3 2 E i x 3 2 E E i x 3 2 E x 2 3 Var i n Var where Var Var i for i 1 n. Taking advantage of the fact that Var x j j j / for j 1 2, and Cov x 1 x / 2 1 +, the denominator of the expreion for can in turn be expanded to yield Var u i i E i Var A i1 x 1 + A i2 x 2 + E i 1 x 1 x 2 Ai1 E i 2 Var x 1 + A i2 E i 2 Var x A i1 E i A i2 E i Cov x 1 x 2 } ( Ai1 E i A i2 E i A i1 E i A i2 E i 1 2 } ) n 2 j1 j A ij E i 2 n 2 j1 j A ij E i Thu, the multiplier can be expreed in the form n Var n 2 j1 j A ij E i 2 n 2 j1 j A ij E i 2 (1) To enure that the average expected attacker utility of each target remain the ame with or without the unoberved attribute, we alo chooe E i n A i1 1 + n A i2 2 n for all i 1 n. Note that the i are identically and independently beta ditributed, with mean (2)

7 Wang and Bier: Target-Hardening Deciion Under Uncertainty Deciion Analyi 8(4), pp , 211 INFORMS 291 INFORMS hold copyright to thi article and ditributed thi copy a a courtey to the author(). Additional information, including right and permiion policie, i available at E i 1 / and variance Var i E i 1 E i / for all i 1 n. Subtituting E i ] and Var i ] into Equation (1) and (2), we get n A i1 1 + n A i2 2 n n ( ) 2 n 2 j1 j A ij n 2 ( 2 j1 j ( A ij )) 2 } Thu, we can olve for the parameter 1 and 2 decribing the ditribution of the attacker unoberved attribute to match any deired level of uncertainty. Note alo that varying the um while keeping the ratio 1 / unchanged will allow u to change the extent of defender uncertainty about the unoberved attribute without affecting the average expected attacker utility. We how reult for different value of the multiplier in The Firt-Period Game Baed on the defender prior ditribution a decribed above, we can ae the defender ubjective probability of an attack on a given target in the firtperiod game. Auming that both the defender and attacker are olving myopic (one-period) optimization problem, the probability that target i will be attacked in the firt period i given by } h i c 1 P attack on i c 1 P p c 1 i u i max p c 1 k u k k n for a given et of reource allocation c 1 c1 1 c1 N. Similarly, the probability that no target will be attacked in the firt period i given by h c 1 P no attack c 1 P u max p c 1 k u k k1 n For illutrative purpoe, we firt conider a twotarget cae for implicity and derive the following analytic reult; ee Appendix A for the derivation of attack probabilitie for the two-target cae, and Appendix B for proof of propoition. More complex numerical reult are preented in 3. Propoition 1. The probability of an attack on any given target in either period of the game i nonincreaing in the level of defenive reource allocated to it, if expenditure on other target are kept unchanged. } In other word, the more the defender invet in protecting a target, the le attractive it i to the attacker, and the le likely it i to be attacked. Propoition 2. If the defender ha a ufficiently large budget, he can enure that any target he chooe ha a probability arbitrarily cloe to one of being attacked in the firt-period game by defending the other target. Thu, for example, with an adequate budget, the defender can effectively deter attack againt the more valuable target by deflecting attack to the leat valuable target. Moreover, the above propoition alo implie that if the budget i large enough, the defender can render attack arbitrarily unlikely by deflecting the attacker to target (no attack). Propoition 3. When the probability ditribution of the weight x 3 and the utilitie i for the unoberved attribute put nonzero ma on every value in [, 1], then all target will have nonzero attack probabilitie. Moreover, thi will remain true after any finite defenive invetment. Thi ugget that the model with unoberved attribute may perform well in the event of urprie (e.g., an attack on a target that would appear to be of low attractivene baed on the known attribute). In contrat, a model without unoberved attribute could fail in the event of an attack on an unattractive target, epecially one that wa previouly predicted to have a zero probability of being attacked. Unfortunately, determining the optimal allocation in the firt-period game analytically i difficult. However, we illutrate the impact of defender uncertainty on the nature of the optimal defenive reource allocation by two example. Later, we preent a third example to illutrate the impact of defender uncertainty on the optimal defender expected diutility. (Note that the derivation in Example 1 aume that the attacker attribute weight follow a normalized Weibull ditribution rather than a Dirichlet ditribution, becaue the normalized Weibull ditribution ha a cloed-form cumulative probability function; ee Appendix C. However, we believe that the nature of the reult i likely to hold more generally.) Example 1. Conider a imple two-target, twoattribute cae without unoberved attribute. For implicity, we et u. We aume that target 1 i more valuable to the defender (v 1 > v 2 ), and target 1 core

8 Wang and Bier: Target-Hardening Deciion Under Uncertainty 292 Deciion Analyi 8(4), pp , 211 INFORMS INFORMS hold copyright to thi article and ditributed thi copy a a courtey to the author(). Additional information, including right and permiion policie, i available at higher on the firt attacker attribute A 11 > A 21 but lower on the econd attacker attribute A 12 < A 22. For implicity, we aume that A 11 A 22 v 1 and A 12 A 21 v 2. Conider the cae where target 2 i expected to be ubtantially more attractive to the attacker; in particular, we aume that the expected weight on the firt attacker attribute i le than e B A 22 A 12 / A 11 A 12 + e B A 22 A 21, o that even when pending the entire budget on target 2, the defender till expect target 2 to be more attractive than target 1 to the attacker. In addition, we aume that the total budget B i le than 1/ ln v 1 ln v 2, o that pending the entire budget on target 1 will till leave an attack on target 1 more damaging to the defender than an attack on target 2 e B v 1 > v 2. 1 In thi cae, the optimal allocation to target 1 will increae a the level of defender uncertainty about attacker preference increae. When the defender i quite certain that target 2 i more attractive to the attacker, he will pend more on target 2, but a he become more uncertain about the attacker preference, he will begin to invet more in target 1, which i the more valuable target to her. Example 2. Conider a imple two-target, twoattribute cae with one known attribute and one unoberved attribute. For implicity, we et the reerve utility to u and the defender valuation of target 1 to v 1 1. Suppoe alo that target 1 i more attractive to the attacker on the known attribute (A 11 > A 21 ); pecifically, we aume that A 11 1 and A 21. Moreover, let the weight x 1 for the known attribute and the utilitie of the unoberved attribute 1 and 2 all be independently uniformly ditributed on [ 1]. Let the total budget be given by B 1, and let the cot effectivene of defenive invetment be given by 1 For thi cae, the attack probabilitie can be derived in cloed form (ee Appendix E), which help implify the determination of the optimal reource allocation. Figure 2 how the optimal defenive reource allocation to target 2 a a function of the defender valuation of target 2. 1 Thee condition were identified by olving the firt-order condition uing the implicit-function theorem, a dicued in Appendix D. Figure 2 Optimal Defenive Reource Allocation for Example 2 Optimal allocation to target 2 (%) % Defender valuation of target 2 A we might expect, the optimal allocation to target 2 i increaing in the defender valuation v 2. Furthermore, although target 2 i not attractive at all to the attacker on the known attribute, the optimal defenive reource allocation to thi target can till be moderately high (even above 5%) if the target i ufficiently important to the defender, becaue of hedging in the face of uncertainty about the unoberved attribute. With perfect information about attacker preference, the defender will allocate her reource to equalize the attacker utilitie among all defended target, becaue otherwie, any defenive reource pent protecting a le attractive target will be wated. In that cae, the optimal allocation depend only on the attacker valuation. However, the example above how that when the defender i uncertain about the attacker preference, the optimal allocation depend not only on the attacker (expected) utilitie, but alo on the defender own target valuation. Moreover, Example 2 ugget that with unoberved attribute, even a target that i believed to be of little value to the attacker may till receive ignificant invetment, to protect againt the poibility that thi target may be attractive to the attacker on ome unoberved attribute(). The impact of defender uncertainty about attacker preference on her equilibrium (optimal) expected diutility i complicated. On the one hand, high level

9 Wang and Bier: Target-Hardening Deciion Under Uncertainty Deciion Analyi 8(4), pp , 211 INFORMS 293 INFORMS hold copyright to thi article and ditributed thi copy a a courtey to the author(). Additional information, including right and permiion policie, i available at of uncertainty create the likelihood that ome defenive reource will be wated protecting target that are not highly attractive to the attacker. On the other hand, high level of certainty may not be beneficial, if the defender expect that the attacker will chooe a target that i of high value to her. We illutrate the impact of defender uncertainty on the optimal defender expected diutility in the following example. Example 3. Conider a cae imilar to Example 2, with target 1 being more attractive to the attacker on the known attribute (A 11 1 and A 21 ), except that we let the weight on the known attribute (x 1 ) be a contant intead of a random variable. The more weight we put on the known attribute, the more certain the defender i about the attacker preference for target 1 over target 2. Figure 3 how the relationhip between the defender optimal expected diutility and her certainty level about the attacker preference (repreented by the weight x 1 on the known attribute) for different combination of the defender target valuation v 1 v 2. A mentioned above, two factor affect the defender optimal expected diutility a the level of defender certainty about attacker preference increae: one i the reduced potential for wating reource by protecting the wrong target and the other i whether the more attractive target to the attacker i alo more valuable to the defender. When target 1 i le valuable to the defender than target 2 (v 1 v 2, above the diagonal dahed line), the defender optimal expected diutility will be nonincreaing a the defender become more confident that target 1 i attractive to the attacker, becaue thi i the le valuable target to the defender, and the higher level of certainty allow the defender to concentrate her defenive reource on the attacker preferred target. By contrat, when the defender value target 1 more than target 2 (v 1 > v 2, below the diagonal), thee factor work in oppoite direction. Higher certainty till allow the defender to concentrate her defenive reource, but now alo increae the chance of an attack on the more damaging target. Depending on how much target 1 i preferred by the defender when v 1 > v 2, the defender optimal expected diutility can be nonincreaing in her certainty level, nonmonotonically related to her level of certainty, or increaing Figure 3 Defender valuation of target 2, v Effect of Defender Certainty on Equilibrium Expected Diutility _ Defender valuation of target 1, v 1 + Increaing certainty lead to increaing diutility _ Increaing certainty lead to nonincreaing diutility Increaing certainty ha a nonmonotonic effect on diutility in her certainty level (when the ratio of v 1 to v 2 i ufficiently large) Bayeian Updating In the econd period, auming that an attack (or attempted attack) on target i ha occurred in the firt period, the defender can update her knowledge about the attacker attribute weight and the utilitie of the unoberved attribute for each target through Bayeian updating. For reource allocation c 1 in the firt period and c 2 in the econd period, the probability that target i will be attacked in the econd period if target k wa attacked in the firt period i given by h i c1 c 2 P attack on i given c 2 attack on k given c 1 l i c 2 x l k c 1 x f x dx d where l k c x } i the likelihood that an attack on target k will occur given the value of x, and c. Note that for pecific value of x, and c, thi likelihood will generally be either or 1, which make the poterior ditribution of the attacker attribute weight

10 Wang and Bier: Target-Hardening Deciion Under Uncertainty 294 Deciion Analyi 8(4), pp , 211 INFORMS INFORMS hold copyright to thi article and ditributed thi copy a a courtey to the author(). Additional information, including right and permiion policie, i available at and unoberved attribute a truncated verion of the prior ditribution, excluding all value that are inconitent with the oberved attacker choice in the firtperiod game. Note that the attribute weight x and the utilitie of the unoberved attribute are updated jointly. Moreover, after the update, the probability ditribution for the unoberved attribute i will generally no longer be either identical or independent. In 3, we preent ample application illutrating the effect of Bayeian updating on the defender knowledge about attacker preference. 3. Sample Application We now apply our model to ample data for three urban area: New York City (NYC), the Boton area (including part of New Hamphire), and Houton. Thoe citie are all among the urban area in the United State with the highet expected damage from terrorim, according to Willi et al. (25). In thi ection, we aume that the defender valuation of thee citie are given by the expected property loe from Willi et al. (25). We conider two known attacker attribute (a in Bier et al. 28): airport departure and average daily bridge traffic. We aume that the defender know the value of thoe attribute (a hown in Table 1) but i uncertain about how much weight the attacker put on each one. Table 1 alo how the budget allocated to the three citie by the Urban Area Security Initiative (UASI) for fical year 29 (U.S. Department of Homeland Security 29). In particular, we conduct two-way comparion involving two city pair: NYC Houton and Boton Houton. In the firt pair, NYC i overwhelmingly more attractive to the attacker, becaue it core better on both attribute. The two citie in the econd Table 1 Expected Terrorim Loe, Attribute Value, and UASI Budget Allocation Expected property Air Average daily 29 UASI loe, v i departure, A i1 bridge traffic, A i2 allocation, c i Urban area ($ million) (1,) Utility (1,) Utility ($ million) NYC Boton Houton pair are roughly comparable in attractivene, with Boton coring higher on average daily bridge traffic, wherea Houton core higher on airport departure. Effect of unoberved attribute other than air departure and bridge traffic are alo conidered. For example, if the attacker care about damaging the oil indutry, Houton could be a more attractive target than New York City. We aume that the attribute weight follow the Dirichlet ditribution with parameter 1 2, and 3, where 1 and 2 correpond to the attacker weight on air departure (A i1 ) and bridge traffic (A i2 ), repectively, and 3 reflect the weight of any unoberved attacker attribute ( i. We et 1 / 2 4, which mean the defender believe that the weight on airport i four time a large a the weight on bridge for the attacker. We aume that the utilitie of the unoberved attribute i for the two target are independent and identically ditributed and have a prior beta ditribution ( 1 2 in the firt-period game. We alo vary the contribution of the unoberved attribute to the overall defender uncertainty, through our choice of ditribution parameter a decribed in 2.2. We conider three cae (low, medium, and high impact of unoberved attribute), correponding to 2 (implying that the unoberved attribute have an effect imilar to that of the le weighted oberved attribute), 1 (in which the unoberved attribute contribute half of the overall defender uncertainty), and 9 (in which the unoberved attribute contribute 9% of the overall defender uncertainty). We alo conider two level of total budget: a high value of $1 million (cloe to the UASI invetment in New York City in 29) and a low value of $1 million (which i le than the UASI allocation to any of the three citie in 29). The cot effectivene of defenive invetment i aumed to be 2 throughout thi ection. We model the problem of defenive reource allocation between two target a a tochatic global optimization problem on a bounded onedimenional variable (i.e., the level of reource allocated to the firt target). We adopt the netedpartition method (Shi and Ólafon 2) to olve the reulting optimization problem. We have alo ued the neted-partition method to efficiently olve two-dimenional (three-target) and three-dimenional

11 Wang and Bier: Target-Hardening Deciion Under Uncertainty Deciion Analyi 8(4), pp , 211 INFORMS 295 INFORMS hold copyright to thi article and ditributed thi copy a a courtey to the author(). Additional information, including right and permiion policie, i available at (four-target) problem. However, more powerful computational tool are needed to deal with larger number of target The Firt-Period Game Figure 4 how the impact of defender uncertainty about both the attribute weight and the unoberved attribute on the optimal reource allocation in the firt-period game. Moreover, Figure 5 how the optimal probabilitie of an attack on Houton in the firtperiod game, to aid in undertanding and interpreting the optimal reource allocation preented in Figure 4. Firt, conider Figure 4(a) and (b) and 5(a) and (b), howing reult for New York City and Houton. Note that New York City i diproportionally more valuable to the defender than Houton to the attacker. If the defender were to make New York and Houton Figure 4 Optimal Allocation in the Firt-Period Game a a Function of Defender Certainty Optimal allocation to Houton (%) Optimal allocation to Houton (%) (a) NYC v. Houton; mall budget o Optimal allocation to Houton (%) Defender certainty ( ) Defender certainty ( ) (c) Boton v. Houton; mall budget equally attractive to the attacker, then the attacker would preumably chooe randomly which of the two to attack. However, becaue the defender care much more about New York than about Houton, the defender would rather acrifice Houton than New York, and o would prefer to invet ufficiently in New York City to make it le attractive than Houton. How much le attractive the defender want New York City to be will depend on two factor: (1) how uncertain the defender i about the attacker aet valuation (with high uncertainty leading the defender to pend even more on New York, to make ure that it become le attractive than Houton) and (2) how much more valuable NYC i to the defender (with large difference in valuation again leading the defender to pend more on New York). With a mall budget, the defender invet almot Optimal allocation to Houton (%) Defender certainty ( ) Defender certainty ( ) (b) NYC v. Houton; large budget (d) Boton v. Houton; large budget

12 Wang and Bier: Target-Hardening Deciion Under Uncertainty 296 Deciion Analyi 8(4), pp , 211 INFORMS Figure 5 Optimal Attack Probabilitie in the Firt-Period Game (a) NYC v. Houton; mall budget (b) NYC v. Houton; large budget INFORMS hold copyright to thi article and ditributed thi copy a a courtey to the author(). Additional information, including right and permiion policie, i available at Attack probability on Houton Attack probability on Houton o Defender certainty ( ) Defender certainty ( ) (c) Boton v. Houton; mall budget Attack probability on Houton Attack probability on Houton Defender certainty ( ) Defender certainty ( ) excluively in the protection of New York rather than Houton, becaue even when all the money i pent on New York (Figure 4(a)), New York will till be quite attractive to the attacker (with an attack probability of roughly.3 at low level of defender certainty, a hown in Figure 5(a)) becaue of the defender budget limitation. In contrat, in the highbudget cae, only approximately 6% of the total $1 million i allocated to New York City at optimality (Figure 4(b)), which i adequate to make New York City highly unlikely to be attacked in the firt-period game (a hown in Figure 5(b)). We now conider the city pair of Boton veru Houton (ee Figure 4(c) and (d) and 5(c) and (d)). The optimal allocation to Houton in the firt-period game i increaing in the level of defender certainty (d) Boton v. Houton; large budget about the attribute weight (Figure 4(c) and (d)). The effect of uncertainty on the defender optimal reource allocation i more pronounced in the lowbudget cae (Figure 4(c)) than the high-budget cae (Figure 4(d)). Specifically, conider the low-budget cae where the defender put moderate emphai on the unoberved attribute (i.e., 1 in Figure 4(c) and 5(c)). Here, Boton i aumed to be more valuable to the defender, wherea Houton i believed to be more attractive to the attacker baed on the known attribute value and the expected attribute weight. At high level of certainty about the attribute weight (correponding to high value of, the defender i confident that Boton i relatively unlikely to be attacked even without any defenive invetment. Thu, pending only about 2% of her total

13 Wang and Bier: Target-Hardening Deciion Under Uncertainty Deciion Analyi 8(4), pp , 211 INFORMS 297 INFORMS hold copyright to thi article and ditributed thi copy a a courtey to the author(). Additional information, including right and permiion policie, i available at budget on Boton will be adequate to make Boton quite ecure (with a le than 1% chance of being attacked), o the ret of the budget can be allocated to Houton to reduce the diutility from the more likely propect of an attack on Houton. By contrat, at low level of certainty about the attribute weight (correponding to low value of, the defender i le confident about which target will be attacked, and therefore need to invet ufficient reource (nearly 6% of the defenive invetment) in protecting Boton to enure that it till ha a low probability of being attacked. Now conider the effect of the unoberved attribute on the optimal defenive allocation. When the defender believe that unoberved attribute (other than airport and bridge) are highly weighted by the attacker (e.g., 9), he cannot reliably predict which target will be more attractive to the attacker. In that ituation, her own valuation of the target play an influential role in her optimal deciion, epecially when the defenive budget i low. For example, conider the city pair Boton veru Houton for the cae of a mall budget (a hown in Figure 4(c)). Becaue Boton i more valuable to the defender, Boton receive ignificantly more defenive reource at optimality when 9 than when 2. We now explore how the defender expected diutility depend on her uncertainty about the attacker preference. Figure 6 repreent the impact of defender uncertainty on the defender optimal expected diutility (in term of expected property loe, in million of dollar) for Boton veru Houton in the firt-period game; reult for NYC veru Houton are imilar. Not urpriingly, high budget lead to lower expected loe. Moreover, in thi particular cae, becaue Boton and Houton are comparably attractive to the attacker in term of the two known attribute, a the defender become more confident about her prior etimate (correponding to larger value of and lower value of ), he can expect to loe le at optimality, becaue the added certainty reduce the need to defend both target The Second-Period Game Our model allow the defender to update her prior knowledge in a Bayeian manner by oberving the attacker choice in the firt-period game. In Figure 7, we how the effect of Bayeian updating for Figure 6 Expected diutility ($ million) Expected diutility ($ million) Optimal Expected Diutility for Boton v. Houton in the Firt-Period Game (a) Boton v. Houton; mall budget Defender certainty ( ) (b) Boton v. Houton; large budget Defender certainty ( ) o Boton veru Houton in the econd-period game, if an actual or attempted attack i oberved by the defender in the firt-period game. Reult are hown for 2 and 9. Note, a tated previouly, the attribute weight (x) and the utilitie of the unoberved attribute ( ) are updated jointly. Firt conider the cae where Houton wa attacked in the firt-period game (ee line of diamond in Figure 7). Becaue Houton i aumed to be le valuable to the defender, it wa optimally left to be attacked with high probability in the firt period (a hown in Figure 5(c) and (d)). Therefore, oberving an attack on Houton doe not provide much new knowledge about attacker preference and hardly change the optimal reource allocation. Converely,

14 Wang and Bier: Target-Hardening Deciion Under Uncertainty 298 Deciion Analyi 8(4), pp , 211 INFORMS Figure 7 Effect of Bayeian Updating on Optimal Allocation for Houton v. Boton in the Second-Period Game 1 (a).2; mall budget 1 (b).2; large budget INFORMS hold copyright to thi article and ditributed thi copy a a courtey to the author(). Additional information, including right and permiion policie, i available at Optimal allocation to Houton (%) Optimal allocation to Houton (%) t 2nd; Houton attacked 2nd; Boton attacked Optimal allocation to Houton (%) Defender certainty ( ) Defender certainty ( ) (c) 9; mall budget Optimal allocation to Houton (%) Defender certainty ( ) Defender certainty ( ) an attack on Boton (ee line of olid dot in Figure 7) would repreent a urprie, becaue Boton wa previouly believed to be ufficiently well protected to be of little interet to the attacker. Therefore, uch an attack lead to a ignificant change between the defender prior and poterior reource allocation, with le reource being allocated to Houton in the econd-period game. Furthermore, defender updating regarding attacker preference lead to more dramatic change in the econd-period optimal reource allocation when the defender i initially le ure about the attacker attribute weight (i.e., for lower level of. Alo, higher uncertainty about the unoberved attribute ( 9; Figure 7(c) and (d)) lead to greater change in the optimal defenive reource allocation through (d) 9; large budget Bayeian updating than lower uncertainty ( 2; Figure 7(a) and (b)). A we can expect, thee effect are much more pronounced with a mall budget (Figure 7(a) and (c)) than a large budget (Figure 7(b) and (d)). 4. Concluion and Direction for Future Reearch By uing multiattribute terrorit utility function (rather than the kind of ingle-attribute objective function that have been ued in mot pat work (e.g., maximize fatalitie or maximize economic loe ), we were able to achieve a more realitic repreentation of defender uncertainty about attacker preference. Our dynamic model alo allow the

15 Wang and Bier: Target-Hardening Deciion Under Uncertainty Deciion Analyi 8(4), pp , 211 INFORMS 299 INFORMS hold copyright to thi article and ditributed thi copy a a courtey to the author(). Additional information, including right and permiion policie, i available at defender to update her knowledge in a Bayeian manner by oberving a previou (actual or attempted) attack. The magnitude of the defender budget ha a ignificant effect on her optimal defenive reource allocation. When the budget i ufficiently large, the defender can effectively deter attack againt the target that are mot valuable to her, and the reulting optimal allocation are not highly enitive to the level of defender uncertainty. However, with carce reource, it become impoible for the defender to adequately protect the target that are mot valuable to her in the face of ignificant uncertainty about which target are likely to be attacked. One potentially worthwhile extenion to thi paper would be to conider nonmyopic player who care about long-term payoff, rather than jut the immediate payoff in the current period of the game. For example, a nonmyopic attacker may want to attack a le attractive target in the firt tage of the game, to milead the defender about hi real preference. Becaue uch deception may caue the defender not to protect the target of greatet interet to the attacker, the attacker may benefit from ending uch a deceptive ignal (Zhuang et al. 21). Similarly, a nonmyopic defender may chooe reource-allocation deciion in the firt period that increae her ability to oberve the attacker preference, if the cot of deceiving the attacker i not catatrophic. Moreover, in condition of high uncertainty about terrorit preference, the defender may want to ave reource for later period, when her invetment may be more effective becaue of the availability of greater information about attacker preference (not necearily from oberving actual attack). Another important extenion to our model would be to ditinguih between long-term invetment and hort-term expene in defenive reource-allocation deciion. In our current model, any defenive invetment in the firt period i aumed to evaporate by the econd period. However, in reality, the effect of long-term invetment i generally cumulative, although it may deteriorate lowly over time. Our model could in principle be extended to treat longterm capital invetment differently from hort-term expene, and potentially identify the optimal tradeoff between them. Overall, we believe that our work provide an important building block for extending pat gametheoretic model of optimal defenive reource allocation from imple toy problem or tory problem to more realitic multiattribute attacker objective function uch a thoe in Beitel et al. (24) and Rooff and John (29). However, more powerful computational tool are till needed to quantify our model in cae with larger number of potential target. Acknowledgment Thi reearch wa upported by the U.S. Department of Homeland Security through the National Center for Rik and Economic Analyi of Terrorim Event under Grant 27-ST However, any opinion, finding, and concluion or recommendation in thi document are thoe of the author and do not necearily reflect view of the U.S. Department of Homeland Security. Appendix A. Derivation of Attack Probabilitie for the Two-Target Cae Firt, we conider a two-target, two-attribute cae with no unoberved attribute. For a given defenive reource allocation c 1 to target 1, the attack probability on target 1 i given by h 1 c 1 P e c 1 u 1 e B c 1 u 2 P e c 1 A 11 x + A 12 1 x e B c 1 A 21 x + A 22 1 x } P e c 1 A 11 A 12 e B c 1 A 21 A 22 x e c 1 A 12 + e B c 1 A 22 } Note that x i a random variable taking on value in [, 1]. Then we conider a two-target, two-attribute cae with one known attribute and one unoberved attribute. For a given defenive reource allocation c 1 to target 1, the attack probability on target 1 i given by h 1 c 1 P e c 1 u 1 e B c 1 u 2 P e c 1 A 11 x x e B c 1 A 21 x x } P e c 1 A 11 x e B c1 A 21 x e c x + e B c1 2 1 x } <x<1 P e c 1 A 11 e B c1 x A 21 1 x e c e B c 1 2 } Note that x 1 and 2 are independent random variable taking on value in [ 1].