Entropy 2012, 14, 571-580; do:10.3390/e14030571 Artcle OPEN ACCESS entropy ISSN 1099-4300 www.mdp.com/journal/entropy Beneft-Cost Analyss of Securty Systems for Multple Protected Assets Based on Informaton Entropy Jngjng Da 1, Rumn Hu 1,2, *, Jun Chen 1 and Qng Ca 1 1 2 Natonal Engneerng Research Center for Multmeda Software, Wuhan Unversty, Wuhan 430072, Chna; E-Mals: danada2002@gmal.com (J.D.); chenj@whu.edu.cn (J.C.); caqng75@gmal.com (Q.C.) School of Computer, Wuhan Unversty, Wuhan 430072, Chna * Author to whom correspondence should be addressed; E-Mal: hrm1964@163.com. Receved: 18 January 2012; n revsed form: 27 February 2012 / Accepted: 29 February 2012 / Publshed: 14 March 2012 Abstract: Ths artcle proposes a quanttatve rsk assessment for securty systems whch have multple protected assets and a rsk-based beneft-cost analyss for decson makers. The proposed methodology conssts of fve phases: dentfcaton of assets, securty unt and ntruson path, securty unt effectveness estmaton, ntruson path effectveness estmaton, securty system rsk assessment and beneft-cost estmaton. Key nnovatons n ths methodology nclude ts use of effectveness entropy to measure the degree of uncertanty of a securty system to complete a protecton task, and the fact t measures rsk lke nformaton theory measures the amount of nformaton. A notonal example s provded to demonstrate an applcaton of the proposed methodology. Keywords: securty system; effectveness estmaton; entropy; multple assets; beneft-cost 1. Introducton Physcal securty systems are deployed to prevent or mtgate loss of valuable assets (e.g., property or lfe) [1]. Accordng to the Department of Homeland Securty Natonal Infrastructure Protecton Plan of Unted States, bene t-cost analyss s the hallmark of homeland securty decson makng [2]. Beneft-cost analyss requres quantfcaton of the rsk after and before mplementaton of a rsk reducton strategy. The basc theory of rsk evaluaton for securty systems s stll lackng n Chna. Scentsts manly rely on qualtatve assessments of management scence to determne the rsk of the
Entropy 2012, 14 572 system [3 6]. However, f an evaluaton system does not have a deep, comprehensve understandng of the securty system, rsk evaluaton based on management scence wll result n devatons. On an nternatonal scope, scentsts have made some sgnfcant progress on the basc theory for rsk evaluaton of securty systems. In 1970s, the U.S. Department of Energy s Sanda Natonal Laboratores [7] frst ntroduced the basc concepts of physcal protecton systems. At that tme, t proposed the dea that ths system can be appled to the feld of nuclear facltes protecton. Subsequently, the U.S. Department of Energy put forward a model of adversary sequence dagram (ASD) [8]. Ths model can dentfy defcences n physcal protecton systems by analyzng how hypothetcal adversares mght acheve ther objectves through varous barrers. The model dentfed the weakest path n a physcal protecton system where an opponent has the hghest probablty of attackng the system. Subsequently, the U.S. Department of Energy put forward a comprehensve path analyss model based on sngle-path analyss that has a sgnfcant lmtaton n that only one adversary attack path s analyzed [9]. The top ten weakest paths wll be found from among hundreds of probable attack paths. In 2007, Garca [10] gave an ntegrated approach for desgnng physcal securty systems. The measure of effectveness employed for a physcal protecton system s the probablty of nterrupton, whch s defned as the cumulatve probablty of detecton from the start of an adversary path to the pont determned by the tme avalable for response. Hcks et al. [11] presented a cost and performance analyss for physcal protecton systems at the desgn stage. Ther system-level performance measure s rsk, whch they defne as follows: Rsk = P(A) [1 P(E)] C where, P(A) s Probablty of Attack, P(E) s Probablty of System Effectveness, = P(I) P(N), P(I) s Probablty of Interrupton, P(N) s Probablty of Neutralzaton, C s Consequence. Ther dscusson of the cost-performance tradeoff s lmted and heavly weghted toward cost as a drver n the decson [1]. Fscher and Green [12] present a qualtatve rsk analyss approach to rankng threats usng a probablty/crtcalty/vulnerablty matrx. Cost effectveness s dscussed as a possble measure of system evaluaton. Oak Rdge Natonal Laboratory [13] establshed a CSG (Combnaton Sold Geometry) model, whch s a powerful descrptve model faclty. Ths model s based on the use of mage processng, dstrbuted computng, geometrc aspects of technology, usng computer-aded desgn methods to establsh facltes n three-dmensonal smulaton model. Ths three-dmensonal smulaton model s close to the actual nstallatons of the model, calculated by dedcated software; the system can do the most detaled analyss. Those researches are manly focused on the rsk evaluaton of securty system by usng probablty statstcs methods and smulaton methods. Probablstc statstcs methods experment wth small statstcal samples of events to get the probablty of attack of a securty system and make debatable assumptons about fxed values for detecton and delay elements [14]. These methods only descrbe scenaros of one asset, and don t extend to collocated assets [14]. In practce, there are many securty systems that protect multple assets, such as museums or schools. Rsk assessment for securty systems for multple assets s needed. Smulaton experments are appled to assess the effectveness of securty systems must establsh completely dfferent facltes models for dfferent facltes, so the complexty of computaton s very large and the development process s extremely complex. The hstorcal data on attacks s lmted. There are enormous uncertantes n rsk evaluaton of securty systems. The most uncertan s the threat tself [15]. A number of researchers have used bounded ntervals [16], game theory [17 19], exogenous dynamcs [20], to characterze uncertanty n
Entropy 2012, 14 573 terrorsm rsk analyss. There s some mportant recent lterature consderng both adaptve and non-adaptve threats [18,21]. Despte the fact a contrbuton on ths ssue s not wthn the scope of ths artcle, we take the poston that credble expert opnon can compensate for the lack of data to support quanttatve rsk assessments and only consder non-adaptve threats. The prmary objectve of ths artcle s to reference the Informaton Theory of Shannon. Lke nformaton entropy, we use entropy to measure the effectveness uncertanty degree of a securty system s protecton capablty wth regard to protecton of multple assets. Wth a smple llustratve example, we demonstrate the applcaton of securty system rsk assessment and beneft-cost estmaton wth dfferent strateges. 2. Beneft-Cost Estmaton of Securty Systems Based on Informaton Entropy Ths secton develops a quanttatve rsk assessment for securty systems and beneft-cost estmaton for decson makes when the securty system protects multple assets. The proposed rsk-based beneft-cost estmaton method for securty system conssts of fve phases (Fgure 1). Fgure 1. Rsk-based beneft-cost estmaton for decson maker. 2.1. Identfy Assets, Securty Unt and Intruson Path The frst phase begns by dentfyng the key assets whch need protecton and a complete set of plausble ntruson paths leadng to each key asset. Each ntruson path begns at the outsde permeter of a securty system snce t s the frst lne that must be crossed by an ntruder to gan access to a protected asset [22]. A sequence of dscrete securty unts composes an ntruson path. Securty unts have protecton capablty; they may be ether a barrer or a path. The securty system s abstracted nto a securty network dagram whch s shown n Fgure 2. We make some assumptons as follows: (1) Attackers start from the outsde and treat one of protected assets as a target of attack; (2) There exsts at least one path can get to the protected asset; (3) All unts n the path have protecton capablty values; the attacker needs to pay a cost to pass through the securty unt. 2.2. Securty Unt Effectveness Assessment Entropy s a state functon whch was proposed to solve the quantty problem of the second law of thermodynamcs by French scentst Rudolf Clausus n 1865 [23]. Later, entropy became a measure of dsorder or uncertanty about system after Austran physcst Boltzmann s statstcal nterpretaton [24].
Entropy 2012, 14 574 Fgure 2. The securty network dagram. In 1948, Amercan scentst Shannon used nformaton entropy to represent the average uncertanty of an nformaton source and the amount of nformaton s a measure of uncertanty that s mssng before recepton [25]. Informaton entropy s often obtaned from a gven probablty dstrbuton p = {p } of messages or symbols. For a random varable X wth n outcomes {x : = 1,,n}, the Shannon entropy, a measure of uncertanty and denoted by H(X), s defned as: H( X) p( x )log p( x ) (1) n 1 b where p(x ) s the probablty mass functon of outcome x. Due to the source uncertanty, nformaton entropy s used to measure the amount of nformaton n nformaton theory [26]. Smlar to nformaton theory, we use entropy to measure the degree of effectveness uncertanty of the protecton capablty of a securty system. The value of effectveness s measured by the degree of protecton capablty that reduces the uncertanty of the securty system. In a securty system, the effectveness s usually measured by the rato of completon of a task. The larger the rato of completon protecton task, the less the uncertanty assocated wth the effectveness of the securty system s. That means the hgher the effectveness of the securty system, the lower the degree of falures to accomplsh a protecton task wll be. Suppose a unt has n-factors for a certan protecton task. The rato s 1 when fully meetng the task. The rato s 0 when absolutely not meetng the task. The rato of n factors on a unt can be expressed as R ( = 1,2,,n), the weght of each factor s ( = 1,2,,n). For a partcular task, the protecton effectveness of one unt j can be determned as: n 1 U j log ( j 1, 2,, m; 1, 2,, n) (2) 1 R 1
Entropy 2012, 14 575 where U j s the protecton effectveness of unt j. R s the degree of accomplshng a protecton task of factor. 1 R s the degree of fal to accomplsh protecton task of factor. As dfferent factors have dfferent mpacts on the securty system protecton effectveness, denotes the effect weght of n factor-, and 1. 1 2.3. Intruson Path Effectveness Assessment The hgher the performance of the unt protecton, the greater cost the attacker must pay through the unt, so we defne unt cost as the value of unt protecton effectveness. The value of unt cost denoted by CU ( )( j 1,2,, m) s equal to the unt effectveness: j We assumed that there are k unts U ( j 1,2,, k) CU ( ) U ( j 1,2,, m) (3) j j n a path, C Path( U, U,, U ) ( 1,2,, k) 1 2 denotes the path cost. The value of the path cost s equal to the sum of unt costs. C PathU (, U,, U) CU ( ) CU ( ) CU ( ) ( 1,2,, k) (4) 2.4. Securty System Rsk Assessment 1 2 1 2 DHS (U.S. Department of Homeland Securty) uses reasonable worst-case condtons to assess terrorsm rsks because ntellgent adversares can choose crcumstances where targets are vulnerable and consequences are maxmzed. The worst-case condton of a securty system s ntellgent adversares who can choose the most vulnerable paths to each asset and destroy all assets. The most vulnerable path s the mnmum cost of ntruson paths for each asset. So the protecton effectveness for each asset can be determned as: E asset Mn C Path1 C Path2 C Path n ( ) ( ), ( ),, ( ) (5) The value of rsk of the securty system can be defned as follows, based on the rsk defnton of securty system that Hcks proposed: Rsk P( A) P( r) C (6) where P(A) s the probablty of attack aganst a crtcal asset durng the tme frame of the analyss whch can be assessed by experts. C s consequence, P(r) s the probablty of successful attack, that s also called the probablty of protecton nvaldaton. In ths formula, P(r) s related to the protecton effectveness of securty system. The hgher the protecton effectveness, the lower the probablty of successful attack P(r). The relatonshp between the two concepts can be expressed as: ( ) log 1 Easset (7) Pr () Suppose a securty system has n protected assets, so the rsk of securty system can be determned as: n 1 Rsk P( A) C E( asset ) 1 e (8)
Entropy 2012, 14 576 where E( asset ) s the protecton effectveness value of asset, PA ( ) s the probablty of attack for asset, t can be determned as the annual rate of occurrence of attack, C s the value of the protecton asset. 2.5. Beneft-Cost Estmaton Bene t-cost analyss determnes the cost effectveness of proposed countermeasures and consequence mtgaton strateges for reducng the rsk assocated wth an asset or portfolo of assets. The bene t-to-cost rato for a gven nvestment alternatve can be calculated as: Beneft Rsk after appled strategy Rsk before appled strategy (9) Cost Cost of strategy 3. An Applcaton of a Museum Scenaro To llustrate a smple applcaton of the proposed method, consder the notonal museum wth two key ancent porcelan assets as shown n Fgure 3. Note that all values used throughout ths example are purely notonal. Fgure 3. Dagram of securty system n a museum scenaro. 3.1. Identfy Assets, Securty Unt and Intruson Path There are two assets n ths example. Consder the example where the adversary ntends to sabotage the target as shown n Fgure 2, there are two paths to the asset 1. Path one: The adversary ntends to
Entropy 2012, 14 577 penetrate the vehcle entrance A, travel to the approprate room, force open the door C, destroy the protected asset 1. Path two: The adversary ntends to penetrate the staff entrance B, travel to room, force open the door C, and destroy the protected asset 1. There are two paths to the asset 2. Path one: the adversary ntends to penetrate the vehcle entrance A, travel to the room, force open the door D, destroy the protected asset 2. Path two: the adversary ntends to penetrate the staff entrance B, travel to room, force open the door D, and destroy the protected asset 2. The protecton unts of each ntruson path are shown n Table 1. Table 1. The protecton unts of each ntruson path. Intruson Path Protecton element of Unt 1 Protecton element of Unt 2 Path 1 for asset 1 Vehcle entrance A Door C Path 2 for asset 1 Staff entrance B Door C Path 1 for asset 2 Vehcle entrance A Door D Path 2 for asset 2 Staff entrance B Door D 3.2. The Protecton Effectveness of Securty Unt A securty system s a complex confguraton of detecton, delay, and response elements [27]. So suppose each unt has three factors for the protecton task: detecton, delay and response. Detecton s the dscovery of an adversary acton whch must be followed by an assessment of the alarm to verfy whether there s an actual ntruson. Delay s the functon of slowng down adversary progress durng an ntruson to gve the guards more tme to respond. Response s the actons taken by the response force to prevent adversary success [28]. The rato s 1 when the protecton task s fully met. The rato s 0 when the task s absolutely not met. The effect weghts of each factor are the same. The rato of each factors on a unt are shown n Table 2. From Equaton (2), the effectveness of each unt can be determned as lsted n Table 2. Table 2. The effectveness for each unt. Unt Detecton Delay Response Effectveness Vehcle entrance A 0.7 0.8 0.9 0.74 Staff entrance B 0.8 0.8 0.6 0.60 Door C 0.9 0.6 0.8 0.70 Door D 0.7 0.6 0.9 0.64 3.3. The Protecton Effectveness of an Intruson Path From Equaton (4), the effectveness of each ntruson path can be determned as Table 3. Table 3. The effectveness for each ntruson path. Intruson Path Effectveness Path 1 for asset 1 1.44 Path 2 for asset 2 1.30 Path 1 for asset 1 1.38 Path 2 for asset 2 1.24
Entropy 2012, 14 578 3.4. The Rsk Assessment of the Securty System From Equaton (5), the effectveness of the securty system can be calculated: Easset ( 1) 1.30, E( asset2) 1.24. Suppose that the annual rate of occurrence of attack for the asset 1 s 0.6 and for asset 2 t s 0.4, so PA ( ) 1 0.6, PA ( ) 2 0.4. The value of the asset 1 s 100,000 dollars, the value of the asset 2 s 200,000 dollars so C 1 = 100,000, C 2 =200,000. From Equaton (8), the rsk for each asset can be shown as n Table 4. Table 4. The rsk of each asset. Parameter = 1 = 2 E( asset ) 1.30 1.24 PA ( ) 0.6 0.4 C 100,000 200,000 Rsk 1.6 10 4 2.32 10 4 From Equaton (8), the rsk he rsk of the museum securty system can be calculated as Rsk = 3.92 10 4. 3.5. Beneft-Cost Estmaton To reduce the total rsk assocated wth ths securty system, three countermeasure strateges were consdered: frst, mprove the response factor of Staff entrance B to 0.7. Second, mprove the delay factor of Door C to 0.7. Thrd, mprove the detecton factor of Door D to 0.8. Suppose that the costs for each strategy are the same, that s 1,000 dollars. The hgher beneft-cost value means the better the strategy s. From the beneft-cost value of each strategy n Table 5, we can know that strategy 1 and strategy 2 are the same, and the thrd strategy s better than the frst and second strategy. 4. Conclusons Table 5. The beneft-cost value for each strategy. Strategy Rsk Reducton Value Beneft-Cost Value 1 3 10 3 30 2 3 10 3 30 3 1.4 10 3 1.4 10 2 Ths artcle proposes a quanttatve rsk analyss method and beneft-cost estmaton for securty systems that must protect multple assets. Followng four steps of development, ncludng usng effectveness entropy to measure the degree of uncertanty of the securty system, and measurng rsk lke nformaton theory measures the amount of nformaton, a general formula for securty system rsk assessment was obtaned. Beneft-cost estmaton analyses the relatonshp between proposed countermeasure strateges for reducng rsk and cost. As the envronments of securty system are more complex n general, the proposed model s not comprehensve enough to analyze all the factors. As an exploraton of beneft-cost estmaton of securty systems, ths method can help securty system
Entropy 2012, 14 579 techncal staff to carry out quanttatve rsk assessment of securty systems whch have multple protected assets and make decsons about the choce of countermeasure strateges. Acknowledgments Thanks for the assstance from Natonal Scence Foundaton of Chna (61170023), the major natonal scence and technology specal projects (2010ZX03004-003-03), Natonal Nature Scence Foundaton of Chna (No. 60832002) and Natonal Natural Scence Foundaton of Chna (61172173). We would also lke to thank knowledgeable revewers for ther constructve and thoughtful comments. References and Notes 1. Graves, G.H. Analytcal foundatons of physcal securty system assessment. Ph.D. Thess, Texas A&M Unversty: College Staton, TX, USA, August 2006. 2. US Department of Homeland Securty. Natonal nfrastructure protecton plan. Avalable onlne: http://www.dhs.gov/xlbrary/assets/nipp_plan.pdf (accessed on 20 February 2009). 3. Chen, Z.H. Research and practce of effectveness evaluaton of securty system (n Chnese). Chna Securty & Protecton 2007, 11, 16 20. 4. Sun, Y.-H.; L, S.-J.; L, B. Quanttatve assessment of physcal protecton system for nuclear power plant (n Chnese). Nuclear Power Engneerng 2009, 30, 20 25. 5. Wu, Q.; Yan, L.L. The rsk assessment model for enterprse securty (n Chnese). Safety & Securty Technology 2010, 10, 10 14. 6. L, J.-S. Inqury on the desgn of museum buldng securty preventon system (n Chnese). Shanx Archtecture 2011, 37, 29. 7. Bennett, H.A. The EASI approach to physcal securty evaluaton; SAND76-0500; Sanda Labs.: Albuquerque, NM, USA, 1 January 1977; pp. 1 35. 8. Chapman, L.D.; Harlan, C.P. EASI estmate of adversary sequence nterrupton on an IBM PC; SAND-85-1105; Sanda Labs.: Albuquerque, NM, USA, 1 October 1985; pp. 1 66. 9. Matter, J.C. SAVI: APC-based vulnerablty assessment program; SAND 88-1279; Sanda Labs.: Albuquerque, NM, USA, 1 July 1988; pp. 1 19. 10. Garca, M.L. Desgn and Evaluaton of Physcal Protecton Systems; Butterworth-Henemann: Burlngton, MA, USA, 2007. 11. Hcks, M.J.; Snell, M.S.; Sandoval, J.S.; Potter, C.S. Physcal protecton systems Cost and performance analyss: A case study. IEEE Aero. Electron. Syst. Mag. 1999, 14, 9 13. 12. Fscher, R.J.; Green, G. Introducton to Securty, 7th ed.; Elsever: Boston, MA, USA, 2004. 13. Shen, N. Desgn and development of physcal protecton system. Master Thess, Chna Insttute of Atomc Energy, Bejng, Chna, July 2003. 14. Cummngs, M.C.; Mcgarvey, D.C.; Vnch, P.M. Homeland securty rsk assessment. Volume. Methods, technques, and tools. RP05-024-01a. Homeland Securty Insttute: Arlngton, VA, USA, 16 June 2006; pp. 1 160. 15. Keeney, R.L. Modelng values for ant-terrorsm analyss. Rsk Anal. 2007, 27, 585 596. 16. Nkoofal, M.; Zhuang, J. Robust allocaton of a defensve budget consderng an attacker s prvate nformaton. Rsk Anal. 2011, do:10.1111/j.1539-6924.2011.01702.x.
Entropy 2012, 14 580 17. Golalkhan, M.; Zhuang, J. Modelng arbtrary layers of contnuous level defenses n facng wth a strategc attacker. Rsk Anal. 2011, 31, 533 547. 18. Zhuang, J.; Ber, V.M. Balancng terrorsm and natural dsasters Defensve strategy wth endogenous attack effort. Oper. Res. 2007, 55, 976 991. 19. Zhuang, J., Ber, V.M.; Alagoz, O. Modelng secrecy and decepton n a multple-perod attackerdefender sgnalng game. Eur. J. Oper. Res. 2010, 203, 409 418. 20. Hausken, K.; Zhuang, J. The tmng and deterrence of terrorst attacks due to exogenous dynamcs. Eur. J. Oper. Res. 2011, do:10.1057/jors.2011.79. 21. Hao, M.; Jn, S.; Zhuang, J. Robustness of optmal defensve resource allocatons n the face of less than fully ratonal attackers. In Proceedngs of the 2009 Industral Engneerng Research Conference, Mam, FL, USA, 30 May 3 June 2009; pp. 886 891. 22. Fsscher, R.J.; Green, G. Introducton to Securty, 7th ed.; Elsever: Burlngton, MA, USA, 2004. 23. Clausus, R. The Mechancal Theory of Heat Wth Its Applcatons to the Steam Engne and to Physcal Propertes of Bodes; John van Voorst: London, UK, 1986. 24. Sandler, S.I. Chemcal and Engneerng Thermodynamcs, 3rd ed.; Wley: New York, NY, USA, 1999. 25. Shannon, C.E. A mathematcal theory of communcaton. Bell Syst. Tech. J. 1948, 27, 379 423, 623 656. 26. Golan, A.; Maasoum, E. Informaton theoretc and entropy methods: An overvew. Economet. Rev. 2008, 27, 317 328. 27. Daves, S.J.; Mnon, R.R. Securty Supervson: Theory and Practce of Asset Protecton, 3rd ed.; Butterworth-Henemann: Jordan Hll, Oxford, UK, 2008. 28. Rco, G.; Beasley, J.S. Physcal protecton systems: Concepts, analyss, and practce n the ET classroom. Avalable onlne: http://spacegrant.nmsu.edu/nmsu/2006/rco.pdf (accessed on 27 September 2006). 2012 by the authors; lcensee MDPI, Basel, Swtzerland. Ths artcle s an open access artcle dstrbuted under the terms and condtons of the Creatve Commons Attrbuton lcense (http://creatvecommons.org/lcenses/by/3.0/).