Use of Multi-attribute Utility Functions in Evaluating Security Systems

Transcription

1 LLNL-TR Use of Mult-attrbute Utlty Funtons n Evaluatng Seurty Systems C. Meyers, A. Lamont, A. Sherman June 30, 2008

2 Ths doument was prepared as an aount of work sponsored by an ageny of the Unted States government. Nether the Unted States government nor Lawrene Lvermore Natonal Seurty, LLC, nor any of ther employees makes any warranty, expressed or mpled, or assumes any legal lablty or responsblty for the auray, ompleteness, or usefulness of any nformaton, apparatus, produt, or proess dslosed, or represents that ts use would not nfrnge prvately owned rghts. Referene heren to any spef ommeral produt, proess, or serve by trade name, trademark, manufaturer, or otherwse does not neessarly onsttute or mply ts endorsement, reommendaton, or favorng by the Unted States government or Lawrene Lvermore Natonal Seurty, LLC. The vews and opnons of authors expressed heren do not neessarly state or reflet those of the Unted States government or Lawrene Lvermore Natonal Seurty, LLC, and shall not be used for advertsng or produt endorsement purposes. Ths work was performed under the auspes of the U.S. Department of Energy by Lawrene Lvermore Natonal Laboratory n part under Contrat W-7405-Eng-48 and n part under Contrat DE-AC52-07NA27344.

3 Use of Mult-attrbute Utlty Funtons n Evaluatng Seurty Systems Carol Meyers, Alan Lamont, and Alan Sherman Lawrene Lvermore Natonal Laboratory Introduton In analyzng seurty systems, we are onerned wth protetng a buldng or falty from an attak by an adversary. Typally, we address the possblty that an adversary ould enter a buldng and ause damage resultng n an mmedate loss of lfe, or at least substantal dsrupton n the operatons of the falty. In response to ths settng, we mplement seurty systems nludng deves, proedures, and falty upgrades desgned to a) prevent the adversary from enterng, b) detet and neutralze hm f he does enter, and ) harden the falty to mnmze damage f an attak s arred out suessfully. Although we have ast ths n terms of physal proteton of a buldng, the same general approah an be appled to non-physal attaks suh as yber attaks on a omputer system. A rgorous analyt proess s valuable for quanttatvely evaluatng an exstng system, dentfyng ts weaknesses, and proposng useful upgrades. As suh, n ths paper we desrbe an approah to assess the degree of overall proteton provded by seurty measures. Our approah evaluates the effetveness of the ndvdual omponents of the system, desrbes how the omponents work together, and fnally assesses the degree of overall proteton aheved. Ths model an then be used to quantfy the amount of proteton provded by exstng seurty measures, as well as to address proposed upgrades to the system and help dentfy a robust and ost effetve set of mprovements. Wthn the model, we use multattrbute utlty funtons to perform the overall evaluatons of the system. Bakground to the Analyt Problem In evaluatng a seurty system, ertan sets of seurty measures must work together. Generally, dfferent seurty system omponents an ether omplement or ompensate eah other. In the omplementary ase, two or more seurty measures must work together to provde an effetve seurty funton. For example, to prevent an adversary from enterng a falty, there must be barrers around the falty (suh as fenes or walls) that make t dffult to enter the falty exept through authorzed entry ponts. In addton, there must also be effetve authorzaton heks at those entry ponts to ensure that an unauthorzed person annot smply walk n. These measures omplement eah other and have the form of an AND ondton n a fault tree analyss. Other measures ompensate for eah other and nstead have the form of an OR ondton; for example, an adversary wthn the buldng mght be deteted by an eletron sensor, OR he mght be deteted by an alert employee. Combnng over both senaros, ths leads to a fault tree struture for the evaluaton funton: a seres of AND and OR ondtons that measure the overall possblty of preventng or mtgatng the damage aused by an adversary.

4 The standard fault tree model s a probablst model n whh the AND and OR ondtons are hard ondtons: a ondton ompletely fals or sueeds dependng on whether or not the orrespondng sub-ondtons fal or sueed. The multattrbute utlty framework an be used as a generalzaton for a fault tree analyss. It an be albrated to provde ether hard AND and OR ondtons or soft AND and OR ondtons, suh that there may be partal suess or falure for a set of ondtons. The ablty to model soft ondtons s espeally useful when the data are too subtle, omplex, or dffult to obtan for a full probablst analyss. In ts extreme, the multattrbute utlty model an redue to a fault tree, but t s also suffently general to avod the lmtatons of suh analyses. As an llustraton of ths stuaton, suppose two omponents work together as an AND ondton. In a fault tree analyss wth hard ondtons, the falure of one omponent would mean the falure of the entre funton. Wth soft ondtons, the falure (or absene) of one omponent mght severely degrade, but not elmnate, the overall effetveness. In a preedng example, t was ponted out that external barrers should be used wth authorzaton heks at the entrane ponts n order to have effetve aess ontrol; however, f there were very weak authorzaton heks, the funton would not be entrely mpared. Casual authorzaton heks oupled wth strong external barrers are onsderably better than no aess ontrols at all. Multattrbute utlty theory an apture ths preferene, whle a strt probablst method annot. In what follows, we begn by outlnng the general multplatve form of a multattrbute utlty funton. We dsuss when suh forms are useful and how they are represented algebraally. We also show how multplatve forms an be used to model both ompensatory and omplementary nteratons, and how they may be albrated to represent both hard and soft AND and OR ondtons. For eah nteraton, we dsuss the full and weak arhetypal representatons that are used n prate, as well as the asymptot utlty behavor assoated wth eah representaton. We then ntrodue the addtve form of the utlty funton, whh s a speal ase that s ntermedate between the AND and OR ases. We dsuss the algebra representaton of suh forms and when they may be approprate n prate. We next represent the spetrum of multplatve forms n terms of the range of a partular parameter. We dsuss tehnques for eltng suh parameters and albratng utlty funtons n general. We onlude by addressng renormalzaton tehnques that an be useful n the eltaton of strongly omplementary nteratons. Throughout the paper, our fous s on albraton tehnques of the quk and drty varety, whh avod the stran on tme and resoures assoated wth a full utlty albraton whle retanng muh of the rgor and formalsm. Ths paper s ntended as a supplement to a standard treatment of multattrbute utlty theory, as an be found n Keeney and Raffa []. The theory and funtons n ths paper have been developed over years of pratal researh at Lawrene Lvermore Natonal Laboratory and other nsttutons. Multattrbute Utlty Funtons for Seurty Systems Utlty funtons are used to evaluate the desrablty of a set of ondtons, and to ompare the desrablty of one set of ondtons to another. Ths an be straghtforward when there s a sngle overall onsderaton, suh as the total ost of a projet; however, n other ases the 2

5 evaluaton may nvolve several ssues at one. For nstane, we mght be onerned wth both the ost of a projet and the total tme to ompleton. In ths ase, there s a tradeoff: a deson maker mght prefer a somewhat hgher ost n order to have a shorter ompleton tme. Multattrbute utlty has been developed to provde a formal struture for preferenes that an nlude more than one ondton (or attrbute) at one. The ore of multattrbute utlty theory s the use of a pragmat aggregaton funton for ombnng the sngle-utlty funtons from eah of the system omponents. The general expresson of ths aggregaton s a multplatve form. Suh forms allow for an nteraton or synergy between the omponents under onsderaton, just as we desre n the evaluaton of seurty systems. We now present the algebra representaton of the multplatve form, followed by a dsusson of how suh forms an be used to represent ompensatory and omplementary nteratons between omponents. The addtve form, a speal ase n whh eah of the omponents s treated separately, s dsussed later. Algebra Representaton In assessng a system, we break the seurty systems n the falty down nto bas omponents and address the ondtons of the ndvdual omponents. Suh omponents an nlude tems suh as eletron sensors, the tranng and plaement of personnel, the ablty to respond to alarms, and the strength of barrers. Eah omponent s gven a sore, denoted x. The present dsusson does not fous on how ths s aheved (for further nformaton, see Keeney and Raffa []). The sore x s based on objetve, observable ondtons (suh as how many people are n an area, how frequently sensors are tested and mantaned, and how long t would take an adversary to break a lok). Ths sore does not neessarly dretly reflet the effetveness of that omponent. Eah sore s then translated nto a ratng of the omponent usng the orrespondng sngle attrbute utlty funton, U (x ). The determnaton of these sngle attrbute utlty funtons s part of the overall assessment proess. Here, Usng these sngle attrbute funtons, the mult-attrbute utlty funton s of the form: U(x,x 2,...,x n ) [+ Kk U (x )]. K U (x ) the sngle-attrbute utlty value for attrbute wth sore x (ranges from 0 to ), k a parameter from the tradeoff for omponent (whh we address later), for all, and K a normalzaton onstant, ensurng that the utlty values are saled over the omponent range spae between 0 and. A useful representaton of the funton s obtaned by settng Kk for all, whh leads to the followng form: U(x,x 2,...,x n ) [+ U (x )]. [+ ] 3

6 In ths, we are also usng the fat that the parameter K [ + ], whh we obtan by observng that the greatest value the numerator an aheve s exatly equal to [ + ]. Salng by ths fator of K ensures that the overall utlty funton s between 0 and. We an llustrate the behavor of the utlty funton usng a smple ase of two varables. In ths stuaton, the utlty funton an be smplfed as: U(x,x 2 ) (+ U (x ))(+ U (x )) (+ )(+ 2 ) Usng the fat that Kk, ths an be rewrtten as: U( x, x 2 ) k U (x ) + k 2 U 2 (x 2 ) + Kk k 2 U (x )U 2 (x 2 ). We an address some of the bas haratersts of the utlty funton by examnng ths last equaton. The frst two terms of the expresson provde a lnear nteraton between the overall utlty and the sngle-attrbute utlty funtons. The last term s a multplatve nteraton term. The settngs of the k s and K determne how these lnear and multplatve terms nterat. In general, the value of K an be negatve, postve, or approah 0 (a sngularty n the multplatve equaton ours f K s exatly equal to 0). In addton, the sum of the k s an be less than, equal to, or greater than. The values of K and the k s are not ndependent. In the ase where eah of the omponent utltes s at ther maxmum value of, the overall utlty s, gvng the relaton: k + k 2 + Kk k 2. From ths relaton, and the fat that the k s are postve, we an dedue that f K equals 0, the sum of the k s ; f K s negatve, the sum of the k s > ; and f K s postve, the sum of the k s <. Varetes of Interatons As the value of K ranges from negatve, to 0, to postve, the overall utlty funton an reflet three dfferent types of nteratons between ndvdual omponents. We outlne eah of these. In the ompensatory ase, performane of one omponent an make up for the lak of performane by other omponents. In the extreme, the deson maker mght thnk, If just one of these omponents s at ts best level, then I m set. In the omplementary ase, a good performane by one omponent s less mportant than balaned performane aross the omponents. In the extreme, the deson maker mght thnk, If just one of these omponents s at ts worst level, then the whole system s knd of bad. In the addtve ase the performane of one omponent does not nterat wth the value of the other omponents. 4

7 In what follows, we llustrate ases where the omponents all have equal values. Ths assumpton s not true n general, but an be reasonable n many applatons sne attrbute ranges an often be saled to aheve smlar weghts (see [] for detals). Compensatory Case We now dsuss the struture of ompensatory nteratons, both qualtatvely and algebraally. In the two-omponent ase, a ompensatory relatonshp means that a hgh utlty on one omponent an partally ompensate for a low utlty on the other. Fgure llustrates a strongly ompensatory ase. If we examne the upper left orner of the graph, where x 0 and x 2, we see that the utlty s slghtly greater than 0.9, n spte of the fat that x s at ts lowest level. Thus, the fat that x 2 s at a hgh level almost ompletely ompensates for the fat that x s at ts lowest level. We also note that beause the so-utlty urves are onave, the overall utlty mproves slowly as x s mproved from 0. Compensatory, U 0.5 U(X2) 2 (x 2 ) U(X) U (x ) Fgure : Iso-utlty urves for ompensatory ase. The parameters and 2 have been set equal to a value of -0.9, whh makes ths a strongly ompensatory ase. Strong Compensatory Case The strong ompensatory ase an be thought of as a strong OR, where the overall utlty evaluates to f any of the omponents utlty funtons evaluate to. Algebraally, ths nteraton s obtaned when - for all omponents. Ths orresponds to a utlty funton of the type: 5

8 U ( x, x2,..., xn ) [ U ( x )]. Note that f any of the utlty funtons U (x ), then the entre utlty funton evaluates to. Ths mples that a sngle omponent at ts best level auses the entre utlty funton to be at ts best level. Weak Compensatory Case In many applatons, the assumptons of the full ompensatory ase are too restrtve. The weak ompensatory ase represents a more moderate verson of the ompensatory ase. In ths ase, the best performane of a sngle omponent partally ompensates for poor performane by the other omponents. Ths an be thought of as a weak OR, where the overall utlty aheves at least a ertan ntermedate value f any of the sngle-varable utlty funtons evaluate to. Algebraally, suh an nteraton s obtaned when - < < 0 for all. Ths orresponds to utlty funtons of the type: [ + U U ( x, x2,..., xn ) ( + ) n ( x )]. The Arhetypal Weak Compensatory ase s obtaned when -.5 for all omponents. Asymptotally, f one omponent s utlty funton evaluates to and all other omponents utlty funtons evaluate to zero, the overall utlty s equal to.5 as the number of omponents goes to nfnty. Ths s less extreme than the full ompensatory ase, where the overall utlty would be equal to. Algebraally: U ( x, x 2..., x n ) (.5)() (.5) n.5 as n. n Ths arhetypal ase an be approprate n stuatons where there s a ompensatory nteraton between the omponents, but the strong ompensatory ase s deemed too extreme. Other weak ompensatory varants an be obtaned by modfyng the value of that s hosen. For the values - < < -.5, we an obtan a stronger ompensatory nteraton. Smlarly, for the values -.5 < < 0, we an obtan a weaker ompensatory nteraton. Whh varety s approprate for the problem n onsderaton s determned va eltaton and dsourse wth the deson-maker. In general, gven a value of between - and 0, the asymptot behavor of a weak ompensatory utlty funton on the soluton (,0, 0) tends to: 6

9 U ( x, x2..., xn ) ( + ) ( + ) n as n. Ths formula an be used to hoose other values of that result n stronger and weaker ompensatory nteratons, as approprate. Graphally, the hoe of affets the mnmum utlty that an be obtaned n ths ase as follows: U - 0 Fgure 2: Mnmum Utlty Guaranteed as a Funton of Value. Ths graph an also help analyze the senstvty of the observed results and how they depend on the hosen value. Complementary Case Two omponents have a omplementary relatonshp when they renfore eah other, or when both are needed to perform a funton. Fgure 3 llustrates a strong omplementary nteraton. Examnng the upper left orner at x 0 and x 2, we see the utlty s qute low at about 0.4, even though one of the omponents s at full value. In omplementary ases suh as ths, the so-utlty urves are onvex. Consequently, as x s mproved from 0, the utlty mproves rapdly. 7

10 Complementary, U 2 (x 2 ) U (x ) Fgure 3: Iso-utlty urves for omplementary ase. The parameters and 2 have been set equal to a value of 5, whh makes ths a strongly omplementary ase. Analogous to the ompensatory ase, there are two man varetes of omplementary nteratons: the strong omplementary ase and the weak omplementary ase. Strong Complementary Case In a strong omplementary ase, the worst performane by one omponent entrely anels out the performane of the other omponents. Ths an be thought of as a strong AND, where the overall utlty evaluates to 0 f any of the omponents utlty funtons evaluate to 0. Algebraally, ths knd of nteraton s obtaned when for all omponents. Ths orresponds to a utlty funton of the type: U ( x, x2,..., xn ) U( x ) U 2 ( x2 )... U ( x n n Note that f any omponent utlty funton U (x ) 0, then the entre utlty funton evaluates to 0. Ths mples that a sngle omponent at ts worst level auses the entre utlty funton to be at ts worst level. Thus the performane of a sngle omponent s less mportant than balaned performane aross dfferent omponents. Weak Complementary Case Oasonally the assumptons of the full omplementary ase an be too extreme. In ertan stuatons, as desrbed n the ntroduton, t s desrable to have at least a partal sense of progress as ndvdual omponent utlty values are mproved. For suh stuatons, the weak omplementary ase represents a more moderate verson of the omplementary ase. In ths ). 8

11 nstane, a sngle omponent at ts worst level partally anels out the performane of the other omponents. Ths an be thought of as a weak AND, where the overall utlty aheves at most a ertan ntermedate value f any of the omponents utlty funtons evaluate to 0. Algebraally, suh an nteraton s obtaned when 0 < < for all. Ths orresponds to utlty funtons of the type: [ + ( )] U x U ( x, x2,..., xn ). n ( + ) The Arhetypal Weak Complementary ase s obtaned when for all omponents. Asymptotally, f one omponent s utlty funton evaluates to 0 and all other omponents utlty funtons evaluate to, the overall utlty s equal to.5 as the number of omponents goes to nfnty. Ths s less extreme than the full omplementary ase, where the overall utlty would be equal to 0. Algebraally: U ( x, x 2..., x n ).5 (2) (2) n n as n. Ths arhetypal ase s used when there s a omplementary nteraton between the omponents, but the strong omplementary ase s deemed too severe. Smlar to the ompensatory ase, weak omplementary varants an be obtaned by modfyng the value of that s hosen. For the values 0 < <, we an obtan a weaker omplementary nteraton. Smlarly, for the values < <, we an obtan a stronger omplementary nteraton. Whh varety s approprate s determned va eltaton wth the deson-maker. In general, gven a value of between 0 and, the asymptot behavor of a weak omplementary utlty funton on the soluton (0,,,) tends to: U ( x, x 2..., x n ) ( + ) ( + ) + n n as n. Ths formula an be used to hoose other values of that result n stronger and weaker omplementary nteratons, as approprate. Graphally, the hoe of affets the maxmum utlty that an be obtaned as demonstrated n Fgure 4. Agan ths graph an be used to help analyze the senstvty of the results and dependene on the value. 9

12 U.5 0 Fgure 4: Maxmum Utlty Obtanable as a Funton of Value. Addtve Case The addtve ase s a speal ase where there s no nteraton between the omponents. Here, the total utlty s smply the weghted sum of the utltes of the ndvdual omponents. Fgure 5 shows the so-utlty urves for an addtve ase. In ths example, the k s are equal and sum to. Examnng the upper left orner, at x 0 and x 2 we see that the overall utlty s 0.5. Ths reflets that we only get redt for x 2, and there s no penalty for the fat that x 0. Note that the utlty s 0.5 n ths ase beause the k s are equal. More generally, n the addtve ase the utlty of the orner wll depend on the rato of the k s. Addtve, 2 --> U 2 (x 2 ) U (x ) Fgure 5: Addtve ase. The parameters and 2 approah a value of

13 Addtve forms are approprate for systems n whh the omponents to be evaluated exhbt lttle nteraton wth eah other. Heurstally, the overall utlty of a system an be expressed as the sum of ts parts. If the utlty of one suh omponent evaluates to zero, then the full utlty value annot be aheved, but at the same tme t does not dmnsh the ontrbutons of the other omponents. The addtve form s also used n stuatons where the ranges of omponent performane (best level to worst level) are not too broad or extreme. In suh ases, the lmtatons of the addtve form are not as pronouned as when omponents an evaluate to greatly dfferent levels, and the smpler addtve form may be preferred. The addtve form s a speal ase of the general mult-attrbute utlty funton. The general funton approahes the addtve form as the value of the s (and hene, also the value of K) approah 0. The bas utlty funton for an addtve form s as follows: U x, x,..., x ) k U ( x ) + k U ( x ) k U ( 2 n n n ( xn where k, k 2,, k n are nonnegatve onstants suh that k k k. + 2 n Ths form s known as addtve beause the k terms represent a relatve weghtng of the varous omponents, and the overall utlty s obtaned by takng a weghted sum of the ndvdual utlty funtons. Summary of Cases In the prevous setons, we observed how the values of, k, and K hosen for a multplatve form an nfluene the behavor of the form both qualtatvely and algebraally. The followng table summarzes the relatonshps between these three values, and what knd of nteraton eah ombnaton represents. ) Value of K Sum of the k s Value of s Type of Interaton Negatve >.0 Negatve ompensatory Approahes zero.0 Approahes zero addtve Postve <.0 Postve omplementary Table : Relatonshps between the values of, k, and K, and the type of nteraton represented. Ths table an be used to understand the nterplay between these three quanttes and how suh algebra parameters an be used to represent dfferent relatonshps between omponents of a system.

14 Further llustratng ths phenomenon, Fgure 6 addresses the ranges of possble values and how eah of these translates nto ompensatory, omplementary, or addtve ases. The full and weak versons of eah ase are detaled, as well as the arhetypal representatve of eah ase. Full Compensatory Case Arhetypal Weak Compensatory Case Addtve Case Arhetypal Weak Complementary Case Full Complementary Case Weak Compensatory Cases Weak Complementary Cases Fgure 6: Spetrum of values for and the resultng nteratons between omponents. Note that as the value of approahes zero, the nteraton terms represent less weght n the utlty funton. Hene n the lmt, the multplatve form approahes an addtve form. Fgure 7 shows the mpat of the values on the utlty value at the orner pont of the utlty funton where x 0 and x 2. When the s approah -, the value at the orner pont approahes. In ths ase, the fat that x 2 s at ts hghest level ompletely ompensates for the fat that x s at ts lowest level. Ths ase orresponds to the hard OR n a fault tree analyss. At the other extreme, as the s go to nfnty, the utlty at the orner pont approahes 0 (the graph s trunated here at 3.5). Ths orresponds to the hard AND where both omponents must perform well to aheve funtonalty. As the s approah 0, the funton beomes addtve and the utlty value of the orner pont goes to 0.5, ndatng the two attrbutes have no nteraton. 2

15 .0 Utlty at orner pont (0, ) as a funton of parameter, assumng Compensatory Complementary 0.0 Addtve Fgure 7: Utlty at the orner pont (0,) as a funton of the parameter, assumng the s are equal. Calbratng the Funton We now address approahes for eltng the values of for the forms that we have dsussed. Our goal s to provde both ntuton for how the forms are strutured and an exposton of a smple ase. The albraton proedure onssts of two man omponents: frst, we determne the type of nteraton (omplementary, ompensatory, or addtve) evdened by the attrbutes under queston, and next, we assess the strength (strong or weak) of that nteraton. In what follows, we assume for the sake of exposton (as n the rest of the doument) that all attrbutes are equally weghted. As before, ths assumpton s usually reasonable n prate, beause attrbute ranges an often be saled to aheve smlar weghts. Determnng the Type of Interaton One way to determne the knd of nteraton between two attrbutes s as follows. Suppose that {x, x 2 } represents the state of the attrbutes n a gven stuaton, and (U (x ), U 2 (x 2 )) represents ther orrespondng utltes. We then onsder tradeoffs of the form n Fgure 8: 3

16 Lottery. Lottery 2..5 (, 0).5 (, ).5 (0, ).5 (0, 0) Fgure 8: Lotteres used to determne the knd of nteraton between attrbutes. In Lottery, there s a 50% hane of attrbute beng at ts hghest level and attrbute 2 at ts lowest, and a 50% hane of attrbute beng at ts lowest level and attrbute 2 at ts hghest. In Lottery 2, there s a 50% hane of both attrbutes beng at ther hghest levels, and a 50% hane of both beng at ther lowest levels. If the deson maker prefers Lottery to Lottery 2, then we nfer that that the nteraton s ompensatory. Here, havng one attrbute at ts best level an make up for a low level on the other attrbute. Conversely, f the deson maker prefers Lottery 2 to Lottery, we onlude the nteraton s omplementary. Ths s beause havng ether attrbute at ts lowest level s nearly as panful as havng both attrbutes at ther lowest levels. Fnally, f the deson maker vews the lotteres as equally preferable, we say the attrbutes are addtve. In ths stuaton, there s lttle nteraton between the attrbutes and both alternatves are equally appealng. Determnng the Strength of the Interaton We now address how to determne the strength of the nteraton, for attrbutes exhbtng omplementary or ompensatory relatonshps. (For attrbutes n the addtve ase, ths fator does not apply.) To assess the strength of a ompensatory relatonshp, the deson maker should ompare the soluton (, 0) to the soluton (, ). If both of these alternatves are nearly equally preferable, then the attrbutes exhbt a strong ompensatory relatonshp. Thus, a strong ompensatory form ( approahes -) should be used. If nstead (, ) s preferred to (, 0) (whh n turn s preferred to (.5,.5), as mpled by the tradeoff n the prevous seton), then the attrbutes dsplay a weak ompensatory relatonshp. For most purposes, t s then suffent to use the arhetypal weak ompensatory form ( -.5). (If a stronger or weaker weak ompensatory form s desred, equatons of the type found at the end of the seton on ompensatory forms an help determne an approprate value for the parameters.) To determne the strength of a omplementary relatonshp, the soluton (, 0) should be ompared to the soluton (0, 0). If both of these alternatves are preferred equally by the deson maker, then the attrbutes exhbt a strong omplementary relatonshp. Hene a strong omplementary form ( approahes, although a value of, say, 5 or greater does represent a strongly omplementary relatonshp) should be used. If (, 0) s preferred to (0, 0) (whh are both preferred less than (.5,.5), as mpled by the tradeoff n the prevous seton), then the attrbutes have a weak omplementary relatonshp. In most stuatons, we may then use the arhetypal weak omplementary form ( ). (If a stronger or weaker weak omplementary 4

17 form s desred, equatons suh as those found at the end of the seton on omplementary forms an help determne an approprate value for the parameters.) Determnng the Rato of the s When They Are Not Equal Compensatory Case When the s are not equal, wthout loss of generalty we an assume that the soluton (, 0) s preferred to the soluton (0, ). If we an determne that the soluton (u, 0) s equally preferred to (0, ), then we an set the rato as: 2 u. To determne the values of the s, we start by assgnng the term wth the largest absolute value n the group of attrbutes beng aggregated to the arhetypal value (e.g., -.5 for the weak ase). We then use the ratos to determne the values of the other terms. Normalzaton Issues Extremely omplementary ases an oasonally be dffult to elt, beause they requre the deson maker to perform assessments where one omponent s always at ts worst level. Often tmes deson makers an be unomfortable relatng to omponents at ther worst levels, and as suh they may fnd t hard to make meanngful omparsons. A method of dealng wth ths stuaton s to renormalze the values, n suh a way that all omplementary ases an be assessed usng omponents at ther best levels. We brefly desrbe one suh renormalzaton that has the utltes gong from - to 0 nstead of 0 to : that s, u u. In the renormalzaton, values are onverted nto a new parameter as follows: + In ths new unverse, the ranges for ompensatory and omplementary nteratons have hanged. Spefally, Compensatory nteratons orrespond to a range of - < < 0, and Complementary nteratons orrespond to a range of 0 <. Now to obtan an approprate anellaton of terms, one omponent n the ompensatory ase must always be at ts best level. Ths an make eltatons a lot easer to perform The renormalzaton also alters the ranges of full and weak ases as follows. (Note that n prate, the term s never set exatly equal to n the full omplementary ase, as t auses a sngularty n the transformaton between and values. A value of.9999 would suffe.) 5

18 The Full ompensatory ase orresponds to -. Weak ompensatory ases orrespond to - < < 0. The Arhetypal weak ompensatory ase orresponds to -. The Full omplementary ase orresponds to. Weak omplementary ases orrespond to 0< <. The Arhetypal weak ompensatory ase orresponds to.5. Determnng the Rato of the s When They Are Not Equal Complementary Case When the s are not equal, wthout loss of generalty we an assume that the soluton (0, -) s preferred to the soluton (-, 0). If we an determne that the soluton (u, 0) s equally preferred to (0, -), then we an set the rato as: 2 u To determne the values of the s, we assgn the term wth the largest absolute value n the group of attrbutes beng aggregated to the arhetypal value (e.g.,.5 for the weak ase). We then use the ratos to determne the values of the other terms. Fnally, we an use the relaton to translate the terms bak to terms.. Conludng Remarks Ths paper has overed the struture and funton of multattrbute utlty funtons appled to the evaluaton of seurty systems. In partular, we have addressed the ompensatory, omplementary, and addtve varants of suh forms, whh as far as we know have never prevously been treated wth ths partular level of tehnal detal. We have provded a pture of how hangng parameter values affet the nterpretaton of the aggregaton beng performed, and how deson maker belefs may be used to dentfy the best hoe of a multplatve form. We have also addressed how suh parameters may be obtaned through the eltaton of experts, as well as when renormalzatons of the parameter spae may ad n ertan varetes of eltatons. Our hope s to provde a sold theoretal bass for future prattoners of multattrbute utlty theory n the area of seurty systems evaluaton. Referenes [] R. Keeney and H. Raffa. Desons wth Multple Objetves: Preferene and Value Tradeoffs. John Wley & Sons, New York, NY,