Stochastic bounds for two-layer loss systems

This paper studies multiclass loss systems with two layers of servers, where each server at the first layer is dedicated to a certain customer class, while the servers at the second layer can handle all customer classes. The routing of customers follows an overflow scheme, where arriving customers are preferentially directed to the first layer. Stochastic comparison and coupling techniques are developed for studying how the system is affected by packing of customers, altered service rates, and altered server configurations. This analysis leads to easily computable upper and lower bounds for the performance of the system.Comment: Revised conten

Malware in the Future? Forecasting of Analyst Detection of Cyber Events

There have been extensive efforts in government, academia, and industry to anticipate, forecast, and mitigate cyber attacks. A common approach is time-series forecasting of cyber attacks based on data from network telescopes, honeypots, and automated intrusion detection/prevention systems. This research has uncovered key insights such as systematicity in cyber attacks. Here, we propose an alternate perspective of this problem by performing forecasting of attacks that are analyst-detected and -verified occurrences of malware. We call these instances of malware cyber event data. Specifically, our dataset was analyst-detected incidents from a large operational Computer Security Service Provider (CSSP) for the U.S. Department of Defense, which rarely relies only on automated systems. Our data set consists of weekly counts of cyber events over approximately seven years. Since all cyber events were validated by analysts, our dataset is unlikely to have false positives which are often endemic in other sources of data. Further, the higher-quality data could be used for a number for resource allocation, estimation of security resources, and the development of effective risk-management strategies. We used a Bayesian State Space Model for forecasting and found that events one week ahead could be predicted. To quantify bursts, we used a Markov model. Our findings of systematicity in analyst-detected cyber attacks are consistent with previous work using other sources. The advanced information provided by a forecast may help with threat awareness by providing a probable value and range for future cyber events one week ahead. Other potential applications for cyber event forecasting include proactive allocation of resources and capabilities for cyber defense (e.g., analyst staffing and sensor configuration) in CSSPs. Enhanced threat awareness may improve cybersecurity.Comment: Revised version resubmitted to journa

Achievable Performance in Product-Form Networks

We characterize the achievable range of performance measures in product-form networks where one or more system parameters can be freely set by a network operator. Given a product-form network and a set of configurable parameters, we identify which performance measures can be controlled and which target values can be attained. We also discuss an online optimization algorithm, which allows a network operator to set the system parameters so as to achieve target performance metrics. In some cases, the algorithm can be implemented in a distributed fashion, of which we give several examples. Finally, we give conditions that guarantee convergence of the algorithm, under the assumption that the target performance metrics are within the achievable range.Comment: 50th Annual Allerton Conference on Communication, Control and Computing - 201

Optimisation of stochastic networks with blocking: a functional-form approach

This paper introduces a class of stochastic networks with blocking, motivated by applications arising in cellular network planning, mobile cloud computing, and spare parts supply chains. Blocking results in lost revenue due to customers or jobs being permanently removed from the system. We are interested in striking a balance between mitigating blocking by increasing service capacity, and maintaining low costs for service capacity. This problem is further complicated by the stochastic nature of the system. Owing to the complexity of the system there are no analytical results available that formulate and solve the relevant optimization problem in closed form. Traditional simulation-based methods may work well for small instances, but the associated computational costs are prohibitive for networks of realistic size. We propose a hybrid functional-form based approach for finding the optimal resource allocation, combining the speed of an analytical approach with the accuracy of simulation-based optimisation. The key insight is to replace the computationally expensive gradient estimation in simulation optimisation with a closed-form analytical approximation that is calibrated using a single simulation run. We develop two implementations of this approach and conduct extensive computational experiments on complex examples to show that it is capable of substantially improving system performance. We also provide evidence that our approach has substantially lower computational costs compared to stochastic approximation