statistical process design for arc welding parameter optimization based on desirability

194 Pages·2012·1.69 MB·English

by  Afful-dadzie Anthony

ROBUST OPTIMAL MAINTENANCE POLICIES AND CHARTS FOR CYBER
VULNERABILITY MANAGEMENT
Dissertation
Presented in Partial Fulfillment of the Requirements for
the Degree Doctor of Philosophy
in the Graduate School of The Ohio State University
By
Anthony Afful-Dadzie, B.S., MPhil., M.A.
Graduate Program in Industrial and Systems Engineering
The Ohio State University
2012
Dissertation Committee:
Theodore T. Allen, Advisor
David D. Woods
Clark Mount-Campbell
© Copyright by
Anthony Afful-Dadzie
2012
ABSTRACT

Cyber-attacks are considered the greatest domestic security threat in the United
States and among the greatest international security threats. Hypothetically, every
personal computer connected to the internet and many other types of devices could be
attacked. Many organizations scan all their computers monthly and system
administrators attempt to reduce or eliminate vulnerabilities, while juggling other
demands on their time.
In the first part of this dissertation, we present data from three organizations
about both vulnerabilities and remedial actions. We also synthesize sixty-seven
articles relating to industrial engineering and operations research (IEOR) and cyber
vulnerabilities. We conclude that persistent and critical vulnerabilities result in a large
fraction of successful attacks. We then describe the activities and decisions faced by
the system administrators and staff members who may be relied on for manual
activities that address persistent and critical vulnerabilities.
The resulting findings establish an important decision-support role for IEOR
contributions to mitigating cyber threat. Also, by analyzing the 67 articles in the
ii
Science Citation Index on IEOR topics and cyber vulnerabilities, we are able to
identify potential gaps in the existing literature.
The second part of the dissertation discusses robust maintenance and
monitoring techniques for managing cyber vulnerability. One challenge hindering the
effective application of existing models is the scarcity of available data partly because
of security concerns. We propose a method based on Markov Decision Processes
(MDP) for the generation and graphical evaluation of relevant maintenance policies
for cases with limited data availability. The proposed method also provides an
estimate of the cost benefit of collecting additional data. Both Bayesian and non-
Bayesian formulations of the transition probabilities and cost models of the MDP are
considered. We apply the proposed method to a real world cyber vulnerability dataset
and generate specific guidance and cost predictions. We also illustrate the relevance of
the proposed method to general Markov Decision Process modeling using a numerical
example involving three levels of data scarcity.
Currently, the number of known cyber vulnerabilities continues to increase
exponentially. This complicates the application of control charting which might
otherwise be used for monitoring and evaluating the quality level of cyber systems.
We describe the challenge and propose residual demerit charts for monitoring quality
levels of organizational computer networks.
A tangential issue is the comparison of Bayesian and non-Bayesian control
charts. Bayesian control charts permit the user to include expert knowledge about a
iii
system. However, the fair evaluation of such systems is complicated by the potential
mismatch between built-in assumptions (fitting prior), including about the direction of
the shift, and method evaluation assumptions (the sampling prior). We end the second
part of the dissertation by providing a comparison between the two types of charting
methods and conclude that non-directional non-Bayesian methods generally remain
competitive.
The final part of the dissertation summarizes all results for the layperson and
information technology (IT) system administrator. The general results uncovered are
described and cases are used to illustrate the practical relevance of the technical
methods.

iv
Dedicated to my mother, Mary Afful

v
ACKNOWLEDGMENTS

I would like to express my sincere gratitude to my adviser, Theodore Allen for
his guidance and assistance throughout the course of this work. His encouragement
and inspiration have been greatly helpful and he is the co-inventor of all related
technology. Theodore Allen is also the co-author for all related work. Also, I would
like to thank Michael Zazon and Kimiebi Akah for their collaboration, insights, and
encouragement. They are co-authors for Chapter 2 relating to the literature review and
the agenda for research. Chengjun Hou provided helpful syntheses of control charting
related literature and useful discussions.
In addition, I would like to thank Hui Xiong and Soo Ho Lee for their support
and encouragement. David Woods and Clark Mount-Campbell have provided insights
and support through serving on the doctoral committee. Alex Morison, Matthieu
Branlat, and Robert Knake have all provided context and information helpful for
problem statement selection. Special thanks go to the unidentified stakeholders from
the three organizations that shared their data and recollections with us. Finally, I wish
to thank my family for their immense support both financially and spiritually during
my stay at Ohio State.

vi
VITA

2004 ........................................................................ B.S. Agricultural Engineering,
KNUST, Kumasi, Ghana

2006 ....................................................................... M.Phil.,
University of Cambridge,
Cambridge, UK

2011 ....................................................................... M.A. Economics,
The Ohio State University,
Columbus, Ohio, U.S.A

vii
FIELDS OF STUDY

Major Field: Industrial and Systems Engineering
Primary Area: Operations Research
Secondary Area: Applied Statistics and Economics

viii
TABLE OF CONTENTS

ABSTRACT .................................................................................................................. ii
ACKNOWLEDGMENTS ........................................................................................... vi
VITA ............................................................................................................................ vii
TABLE OF CONTENTS ............................................................................................ ix
LIST OF TABLES ...................................................................................................... xii
LIST OF FIGURES ................................................................................................... xiv
Chapter 1 ....................................................................................................................... 1
Introduction .................................................................................................................. 1
1.1 Plan ....................................................................................................................... 1
1.2 Problem Statements and Outline .......................................................................... 4
1.3 References ............................................................................................................ 6
Chapter 2 ....................................................................................................................... 8
Cyber Vulnerabilities and Industrial Engineering and Operations Research: A
Literature Review and Agenda For Research ........................................................... 8
2.1 Introduction .......................................................................................................... 8
2.2 Vulnerability Data from Three Organizations .................................................... 10
2.2.1 The Nessus Dataset ...................................................................................... 10
2.2.2 Persistently Critical Hosts, Manual Actions, and Roles for IEOR .............. 14
2.3 Manual Maintenance Actions and Associated Causes ....................................... 15
2.3.1 Descriptions of Maintenance Actions .......................................................... 16
2.3.2 Descriptions of the Causes Associated with the Maintenance Actions ....... 18
2.4 Review of the IEOR Literature Relating to Cyber Vulnerabilities .................... 21
2.4.1 Specific Queries ........................................................................................... 22
2.5 Literature Review Results .................................................................................. 24
2.5.1 The Overall Cyber Vulnerability Literature ................................................ 24
2.5.1 The Cyber Vulnerability Literature Related to IEOR Topics...................... 26
2.6 Conclusions and Future Work ............................................................................ 30
ix