The Human Element: Addressing Human Adversaries in Security Domains
Total Page:16
File Type:pdf, Size:1020Kb
The Human Element: Addressing Human Adversaries in Security Domains by James Pita A Dissertation Presented to the FACULTY OF THE USC GRADUATE SCHOOL UNIVERSITY OF SOUTHERN CALIFORNIA In Partial Fulfillment of the Requirements for the Degree DOCTOR OF PHILOSOPHY (COMPUTER SCIENCE) December 2012 Copyright 2012 James Pita Acknowledgments An individual and special thank you belongs to my adviser Milind Tambe. I cannot begin to thank you enough for your steadfast effort, determination, and dedication to each of your students. Not only are you the exemplar of what an adviser should be, but you are genuinely cherished by anyone who has had the pleasure to work with you. You have made this experience altogether remarkable due to your outstanding guidance and more importantly your sincere friendship. I would also like to thank my committee members for helping to guide my research and think beyond it: Jonathan Gratch, Richard John, Sarit Kraus, Stacy Marsella, and Nicholas Weller. I would particularly like to thank Sarit Kraus for her unparalleled insights, guidance, and assistance throughout my career and Richard John for helping me to expand my understanding of experi- mental approaches. Furthermore, I would like to thank my co-authors over the years: Bo An, Har- ish Bellamane, Shane Cullen, Manish Jain, Richard John, Christopher Kiekintveld, Sarit Kraus, Jun-young Kwak, Reuma Magori-Cohen, Rajiv Maheswaran, Janusz Marecki, Thanh Nguyen, Fernando Ordo´nez,˜ Praveen Paruchuri, Christopher Portway, Shyamsunder Rathi, Michael Scott, Eric Shieh, Erin Steigerwald, Milind Tambe, Jason Tsai, Craig Western, Rong Yang, and Zhengyu Yin. Your dedicated efforts, assistance, guidance, and hard work made this experience exception- ally better. ii Beyond my mentors and collaborators, I would like to thank CREATE, the Los Angeles World Airport (LAWA) police, and the Transportation Security Administration for giving me the opportunity to work on real-world problems that have a direct impact on the community. A special thank you to Erroll Southers for tirelessly promoting ARMOR as a viable approach for critical security problems, Ernest Cruz for his countless hours developing the original ARMOR software package, and Shane Cullen and Erin Steigerwald for their efforts in developing the GUARDS system. I also want to thank my colleagues at USC and the greater TEAMCORE community. You have all helped make these past years a special experience for me and I will never forget all the times we have shared and all the help and guidance you have given me. A special thanks goes to Janusz Marecki for all the laughs and advice over the years. I would also like to thank God for this tremendous opportunity. Finally, more than thank you goes to my mother Diane Pita, father Eugene Pita, and brother Michael Pita. Thank you for a lifetime of support in everything and anything that I do. Without your unconditional love and support I would not have been able to get where I am today. Thank you for making me push my limits, explore the world around me, and expand my horizons. Thank you for all the sacrifices you have made to get me here and for your never ending guidance, effort, support, and love. Thank you for being the cornerstone of my life. iii Table of Contents Acknowledgments ii List of Figures vii Abstract ix Chapter 1: Introduction 1 1.1 Problem Addressed . .1 1.2 Contributions . .4 1.2.1 COBRA/MATCH . .5 1.2.2 Security Circumvention Games . .8 1.3 Guide to Thesis . 10 Chapter 2: Background 11 2.1 Stakelberg Games . 11 2.2 Bayesian Stackelberg Games . 13 2.3 Strong Stackelberg Equilibrium . 15 2.4 DOBSS and Baseline Algorithms . 16 2.4.1 DOBSS . 17 2.4.2 UNIFORM . 20 2.4.3 MAXIMIN . 21 2.5 BRQR . 21 2.6 Security Stackelberg Games . 23 2.7 Los Angeles International Airport . 26 2.8 Human Subjects . 28 Chapter 3: Related Work 32 3.1 Computing Optimal Stackelberg Equilibria . 32 3.1.1 Efficient Solutions to general Bayesian Stackelberg games . 32 3.1.2 Efficient Solutions for Large-Scale Security Games . 35 3.2 Computing Robust Strategies . 37 3.3 Addressing Suboptimal Decisions . 38 iv Chapter 4: COBRA Algorithm 42 4.1 Key Ideas . 44 4.1.1 Bounded Rationality . 44 4.1.2 Anchoring Theory . 45 4.2 Robust Algorithm . 48 4.2.1 COBRA(0, )................................ 48 4.2.2 COBRA(α, 0)................................ 50 4.2.3 COBRA(α, )................................ 51 4.2.4 Complexity . 52 4.3 Equivalences Between Models . 53 4.4 Experiment Purpose, Design, and Results . 56 4.4.1 Purpose of this Study . 56 4.4.2 Experimental Design . 57 4.4.2.1 Participants . 58 4.4.2.2 Reward Structure . 58 4.4.2.3 Observability Conditions . 60 4.4.2.4 Algorithms and Parameters . 62 4.4.2.5 Experimental Procedure . 66 4.4.3 Experimental Results . 68 4.4.3.1 Key Observations . 70 4.4.3.2 Statistical Significance . 71 4.4.3.3 Analysis of Results . 74 4.4.4 Handling Observational Uncertainty . 78 4.4.5 Runtime Results . 85 Chapter 5: MATCH Algorithm 87 5.1 MATCH Algorithm . 89 5.2 Experiment Purpose, Design, and Results . 95 5.2.1 Purpose of this Study . 95 5.2.2 Experimental Design . 96 5.2.2.1 Participants . 97 5.2.2.2 Reward Structure . 98 5.2.2.3 Experimental Procedure . 100 5.2.3 Results for Original Structures . 103 5.2.4 Results for New Reward Structures . 104 5.3 Analysis . 105 5.4 λ-Re-estimation . 108 5.5 Runtime Results . 110 Chapter 6: Security Circumvention Games 112 6.1 TSA Security Challenges . 114 6.1.1 Modeling the TSA Resource Allocation Challenges . 114 6.1.1.1 Defender Strategies . 115 6.1.1.2 Attacker Actions . 116 6.1.2 Compact Representation for Efficiency . 117 v 6.1.2.1 Threat Modeling for TSA . 117 6.1.2.2 Compact Representation . 119 6.2 Evaluation . 122 6.2.1 Security Policy Analysis . 122 6.2.2 Runtime Analysis . 124 Chapter 7: Conclusions 127 7.1 Summary . 127 7.2 Future Work . 130 Bibliography 133 Appendix A: Statistical Significance Tests 139 A.1 Statistical Significance Tests for COBRA . 139 A.2 Statistical Significance Tests for MATCH . 140 Appendix B: Reward Structures 141 Appendix C: Strategies 160 Appendix D: Expected Rewards for COBRA Experiments 197 Appendix E: Expected Response Percentages for COBRA Experiment 199 Appendix F: Strategies for varying α in COBRA(α,2.5) 200 Appendix G: Experimental Instructions 204 G.1 Material for COBRA Experiments . 204 G.2 Material for MATCH Experiments . 207 G.2.1 Obvious Games . 207 G.3 Experiment Instructions . 208 vi List of Figures 2.1 LAX Security . 27 4.1 Game Interface . 62 4.2 Single Observation . 62 4.3 Average leader expected value . 69 4.4 Unobserved condition - Expected average reward . 80 4.5 Strategy entropy for varying α values . 81 4.6 Average expected values for varying α under the unlimited observation condition 82 4.7 Comparing runtimes . 86 5.1 Game Interface . 96 5.2 1-Norm Scatter Plots . 99 5.3 Original reward structures . 103 5.4 Scatter Plot of Results . 107 5.5 Re-estimated Reward Structures . 110 5.6 Runtime results . 111 6.1 Policy Analysis: Increasing resources for 10 areas with 3 security activities per area123 6.2 X-axis: Areas, Y-axis: Runtime . 126 6.3 Runtime: Increasing resources for 10 areas with 3 security activities per area . 126 vii G.1 Game Interface . 204 G.2 Single Observation . 205 viii Abstract Recently, game theory has been shown to be useful for reasoning about real-world security set- tings where security forces must protect critical assets from potential adversaries. In fact, there have been a number of deployed real-world applications of game theory for security (e.g., AR- MOR at Los Angeles International Airport and IRIS for the Federal Air Marshals Service). Here, the objective is for the security force to utilize its limited resources to best defend their critical assets. An important factor in these real-world security settings is that the adversaries involved are humans who may not behave according to.