19. path interruption analysis - sandia.gov19. path interruption analysis abstract. this session...

The Twenty-Sixth International Training Course 19-1

19. Path Interruption Analysis

Abstract. This session begins by describing the principles behind Path Interruption Analysis. It describes how models of Physical Protection System (PPS) performance may be based on the interrelation of three system functions: detect, delay, and response. A path is defined as an ordered series of actions against a target, which, if completed, results in successful theft or sabotage. The timing relationships between security functions and the adversary attack are then described on a timing diagram. The principle of timely detection is discussed next, along with its performance measure, Probability of Interruption (PI). This measure, PI, is shown to be superior to the use of minimum path delay or minimum Probability of Detection along the path, as PI depends on timely detection, that is, detection that occurs early enough along the path that the response force can arrive in time to interrupt the adversary before they complete their mission. The input for the PI model requires (1) detection inputs as probabilities that the total detection function will be successful, (2) delay inputs as mean times for each element, and (3) a value for the PPS Response Time from the security response plans. The output is the Probability of Interruption, or the probability of intercepting the adversary before any theft or sabotage occurs. The session describes how to calculate PI for a single path, first by identifying the last timely sensing opportunity along the path, the Critical Detection Point, and then by using this information and Probability of Detection in a formula for PI. An example is then covered showing how to evaluate various detection, delay, and response force improvements with respect to PI. Finally, the purpose of Path Interruption Analysis is then explained, namely to determine what the minimum PI is across all targets, threats, and facility operating conditions to determine if time after detection is sufficient to respond and interrupt the attack before the adversary completes his task timeline. However, use of a single path-level model for PI can be inadequate to determine this minimum PI if the facility has too many paths to analyze, all by hand; thus, it may be necessary to use other more automated software tools, such as MP VEASI (Multipath Very-simplified Estimate of Adversary Sequence Interruption), to evaluate all possible paths to determine which are the most vulnerable.

19.1 Introduction

Discussion of basic aspects of Path

Interruption Analysis

This section of the course discusses the following basic features of the Path Interruption Analysis approach to the design of PPSs:

Basic security functions of detection, delay, and response Concept of the adversary path Timing relationship between the intruder and the PPS Measures of security effectiveness for paths The purpose of Path Interruption Analysis

19.2 Basic Physical Protection System Model

PPS System Functions

The module titled Design of Physical Protection Systems presented the development of a basic PPS model, which is based on the defense-in-depth concept. Three system functions were identified: Detection. A system function that includes:

– Intrusion Sensing: sensing the presence of an intrusion into a protected region of a site (to include discrimination from authorized presences),

– Alarm Communications: communicating that information over an

Define Physical Protection System Requirements

19-2 The Twenty-Sixth International Training Course

alarm communications system to an alarm station, and – Alarm Assessment: assessing the nature of the intrusion as either an

intrusion or as a false or nuisance alarm. Delay. A system function intended to slow adversaries down, to

lengthen the time required before they can complete their mission (theft or sabotage). If active delay elements are used, the delay function would include command, control, and communications sub functions.

Response. A system function performed by a response force responsible for interrupting and neutralizing intruders before they can complete their mission. As described in the module “Introduction to the Design of Physical Protection Systems,” section 7.2, effective interruption must include both effective response communications (to let the response force know where to deploy) and deployment of the response forces; it may also include muster and preparation time for the response forces.

Measures of Effectiveness for

PPS System Functions

As described in earlier lectures, these functions have associated measures of effectiveness: Detection: Detection has two measures of effectiveness:

o Probability of Detection, PD. Recall that PD can be divided into a Probability of Sensing, PS, and a Probability of Assessment, PA using the following formula:

PD = PS×PA

o Detection time: The time between when a sensor creates an

alarm and the time that that alarm is properly assessed. Delay: Delay has one measure of effectiveness, namely the time that

the adversary is slowed down while they counter the protection feature providing this function.

Response: The response has several measures of effectiveness:

o The time of and probability of communications between those who assess alarms and the response forces.

o The time to carry out other response functions, such as mustering, deploying, and finally, interrupting the adversaries. The sum of the communications and other times is typically called the PPS Response Time.

o The probability that the Response Force can neutralize the intruder, given that interruption occurred.

Need for Systems-

Level Effectiveness Measures

These measures describe how well each of the three functions perform, and in some cases describe how well sub-functions under each function perform. They do not provide a picture of how well the entire system performs. Thus, while these measures provide insight into how well detection, delay, or response performs, they do not give insight on how much detection, delay or response is needed. To answer this question—how much of each function is enough—requires us to create systems-level effectiveness measures. Historically, it has



proved to be useful to consider two systems-level metrics:

What is the Probability of Interruption, PI, that is, what is the probability sensing occurs early enough that the response force can arrive in time to interrupt the adversary? This probability depends upon Probabilities of Detection for sensors, detection times for alarm systems, delay times, and response force probability of communications and response force times.

What is the Probability of Neutralization, PN, that is, what is the probability that the response force can neutralize the adversary, given that interruption occurred?

The following sections introduce the concepts and mathematics behind calculating the Probability of Interruption (PI). While Probability of Neutralization (PN) is not discussed until a later section, this section discusses how PI and PN combine to form what is called Probability of System Effectiveness, PE. PE represents the probability that all functions work properly; thus, it is the final, most important system-level effectiveness measure.

19.3 Adversary Path and Calculation of Probability of Interruption, PI

Adversary Path To evaluate how well the detection, delay, and response functions are performed in Path Interruption Analysis, we need some way to describe adversary actions against the PPS. The concept used is that of the adversary path. An adversary path is a time-ordered sequence of path elements, areas, and a target task that the adversary must complete to achieve theft or sabotage. Figure 19-1 illustrates a single sabotage path of an adversary who wishes to destroy a pump in a high security area. Each element, area, and target in a path consists of a number of detection and delay components (see Figure 19-2) that require the adversary to complete a series of actions to defeat them. For example, the door element provides delay because it has hardness and provides detection due to sensors installed on it being triggered by the adversary attempting to defeat the door. Note that “offsite” is an area where the adversary encounters little or no security; thus no components are shown in Figure 19-2 for that area.



Figure 19-1. An Adversary Path

Element /Area Delay Component Detection Component

Fence 1 Fence Fabric Fence Sensor

Protected Area Time Required to Cross Area Security Patrol

Outer Door 1 Door Hardness Sensors on Door

Building Interior Time Required to Cross Area Security Patrol

Surface 2 (Wall) Wall Hardness Personnel Hear Noise

Vital Area Time Required to Cross Area Employees hear attacks

Destroy Pump Time Required to Sabotage Target Loss of Pump

Figure 19-2. Delay and Detection Components along the Path

Knowing the sequence of actions the adversary is trying to perform, we can overlay the timeline of PPS functions alongside the entire adversary timeline on the same timing diagram (see Figure 19-3) to see whether response can interrupt the adversary before they complete their task.



Figure 19-3. PPS Timing Diagram

PPS Timing

Diagram Explanation

To help explain the diagram, the following descriptions are provided: First Sensing is the first alarm that results in a correct assessment of the

intrusion and communication to the response force. – T0 is the time of first sensing

Detection Time is the time required to complete the detect function (see Figure 19-2). – TA is the time the detect function is successfully completed

Response Force Time is the time required to complete the response function. – TI is the time required for the response force to muster, prepare,

travel, and deploy a sufficient number of response personnel to interrupt the adversary from completing his task

PPS Response Time is the sum of the Detection and Response times. Adversary Task Time Remaining After First Sensing for a given sensing

opportunity is the time on the adversary timeline between that sensing opportunity until the adversary completes their task.

Adversary Task Time is the total amount of time required for an adversary to complete all tasks required to accomplish theft or sabotage.

Begin Action is the point in time when an adversary actually begins his task by intruding into a controlled (e.g., alarmed) area from the Offsite Area.

Task Complete and TC is that point in time when an adversary’s task will be completed.

The differences between PPS Response Time and Adversary Task Time Remaining After First Sensing is sometimes referred to as the cumulative path delay deficiency when PPS Response Time > Adversary Task Time Remaining After First Sensing, or the difference is referred to as the time remaining after interruption (TRI) when the PPS Response Time < Adversary Task Time Remaining After First Sensing.



Cumulative Path Delay Deficiency

Clearly, in order for the PPS to accomplish its objective, TI must occur before TC. It is equally clear that the first sensing leading to an assessment should occur as early as possible and T0 (as well as TA and TI) should be as far to the left on the time axis as possible.

Principle of Timely Detection

The principle of timely detection is based on the concept that detection based on sensing at a sensing opportunity does not contribute to effective security unless the Adversary Task Time Remaining After First Sensing at that sensing opportunity exceeds the PPS Response Time. Figure 19-4 shows that sensing at sensing opportunities 3 and 4 occur too late to achieve interruption; thus, these two sensing opportunities are not timely, while the first or second sensing opportunities are timely as the Adversary Task Time Remaining After First Sensing at these opportunities exceeds the PPS Response Time.

Adversary Task Time

CT

FirstSensing

T0

PPS Response Time

Adversary Task Time Remaining After First Sensing

Detection Time

Ad

vers

ary

De

tect

ed

Response Force Time

Adversary Begins Task

Adversary Completes Task

Time

Arr

ive

too

lat

e

Sensing Opportunities

Adversary Task Time

CT CT

FirstSensing

FirstSensing

T0

T0

PPS Response Time

Adversary Task Time Remaining After First Sensing

Detection Time

Ad

vers

ary

De

tect

ed

Response Force Time

Adversary Begins Task

Adversary Completes Task

Time

Arr

ive

too

lat

e

Sensing Opportunities

Figure 19-4. Example of PPS Timing Diagram When Sensing is Not Timely

Relationship of PPS Timing Diagram

with Probability of Interruption

The PPS timing diagrams in Figures 19-3 and 19-4 can be related to the calculation of Probability of Interruption: Probability of Interruption is just the probability that sensing occurs early enough on the PPS timing diagram that assessment and response force activities (e.g., communications and deployment) occur before the adversary force can complete its mission. Thus, the Probability of Interruption, PI, is just the probability that sensing occurs at a timely detection sensing opportunity. In Figure 19-4 it depends on sensing at the first or second sensing opportunity as these are the only sensing opportunities that are timely.



19.4 Comparison of PI with Other Measures of Security Effectiveness for Paths

Security Effectiveness

measures for Paths

This section discusses and compares three potential measures of effectiveness that address how well security performs along an adversary path:

Minimum Delay Minimum Cumulative Probability of Detection Minimum Timely Detection/Probability of Interruption

19.4.1 Delay Model

Compare Minimum Cumulative Time

Delay to PPS Response Time

One measure of PPS effectiveness is the comparison of the minimum cumulative time delay along an adversary path (Tmin) to the PPS Response Time (TPRT) as defined in Figure 19-3. This is illustrated in Figure 19-5 where the length of each bar is intended to illustrate the length of time associated with a particular adversary task time, tai, for the ith task.

Figure 19-5. Minimum Path Delay as a measure of PPS effectiveness

Calculate Total Delay Time

In terms of individual PPS elements, total minimum delay time, Tmin, for some set of elements is calculated as a sum of the element delays. So we have:

minT i1

m

ait

where m is the total number of delay elements along the path of concern and tai is the time delay1 provided by ith element. And, for an effective PPS, the following condition must hold true (where TPRT is the response force time):

1 Use of the minimum delay here will provide a conservative approach. As noted earlier, it would also be possible to use other measures, such as a median or average delay value.



TT PRT min

The disadvantage of this measure is that no consideration of detection is involved. As has been shown, delay without prior detection is not meaningful (except possibly as a deterrent, an effect which we are not modeling) because the response force must be alerted in order to deploy and interrupt the adversary. However, unless Tmin is greater than TPRT, the PPS has no chance of success.

19.4.2 Detection Model

Detection System Performance

Another measure of effectiveness is the cumulative probability of detecting the adversary before their mission is completed. An effective protection system must provide a high probability of detection. To assess detection system performance, then, we must turn to some basic probability theory. First some definitions: Two events are independent if the occurrence or nonoccurrence of one

event in no way affects the probability of occurrence of the other. Two events are mutually exclusive if the occurrence of one precludes the

occurrence of the other. – The symbol indicates the union (and/or) of two sets, the symbol

indicates the intersection (and) of two sets, and the letter P or function notation P() is used to indicate probability.

A useful basic statistical relationship governing independent but non-mutually exclusive events, En, states that:

P E1E2 En 1 1 P E1 1 P E2 1 P En In terms of PPS elements, this law applies to the minimum cumulative detection probability, Pmin, for some set of sensors as:

m

iDiPP

1min

11

where m is the total number of detection elements along the path of concern and DiP is the minimum detection probability provided by ith element.

And, for an effective PPS, the following condition must hold true:

minP acceptableP

Acceptable

Probability of Detection

The acceptable probability of detection value, Pacceptable, must be established as part of the system requirements. The disadvantage of this measure is that no consideration of delay is involved. Detection without sufficient subsequent delay is not meaningful; the response force may have insufficient time to interrupt the adversary.



19.4.3 Critical Detection Point Models

Integrate Detection Probability with System Timing

Neither minimum path delay nor minimum probability of detection provides a complete model of system behavior along some adversary path. As noted earlier, some means must be provided to integrate sensor behavior with system timing considerations. Such a measure of effectiveness would take into account and combine measures like Tmin, TPRT and Pmin, and will be referred to as timely detection. The basic concept of timely detection is that the adversary detection will be counted only if there is enough time remaining after that sensing opportunity for the response force to deploy and prevent the adversary from completing their theft or sabotage task, as illustrated in Figure 19-6.

Start ofPath

Completion of Path

Adversary Minimizes Detection

Adversary Minimizes

Delay

Response Force Time, RFT

Time DelayRemaining Along Path, TR

Probability of Interruption, PI

Critical Detection

Point (CDP)

Total Path Delay

= detection point

Start ofPath

Completion of Path


Adversary Minimizes

Delay

Response Force Time, RFT



Critical Detection

Point (CDP)

Total Path Delay

= detection point

Completion of Path


Adversary Minimizes

Delay

Response Force Time, RFTResponse Force Time, RFT



Critical Detection

Point (CDP)

Total Path Delay

= detection point

Figure 19-6. Timely Detection as a measure of PPS effectiveness

Determine PPS Response Time

The Path Interruption Analysis for this system approach proceeds by first determining the PPS Response Time, TPRT. Then, working outward from the target, the minimum delays associated with each protection element encountered along the path are summed (and thus represent the minimum delay remaining along a path at any point, represented as TR) until TPRT is just exceeded. This is represented mathematically as:

PRTR TT

and:

RT i k

m

ait

where m is the total number of delay elements along the path of concern, k is the point at which TR just exceeds TPRT, and tai is the time delay provided

PPS Response Time



Probability of Interruption

by ith element. The critical detection point (CDP) is then defined to be the first sensor located prior to this point (relative to the outside). Finally, the analysis proceeds from the outside in along the chosen path in order to develop the probability of interruption, PI ; this metric is calculated as the minimum cumulative probability of detection from the start of the path up to the CDP, or (using the same basic relationship presented earlier):

1

1

11k

iDiI

PP

where k-1 is the total number of detection elements along the path of concern up to and including that at the CDP, and where DiP is the detection

probability provided by ith element. For an effective PPS, the following condition must also hold true:

IP I acceptableP

The acceptable probability of interruption value, PI acceptable, must be established as part of the system requirements. The disadvantage of this measure is that it does not consider the results of an actual force-on-force engagement between the response and the adversaries.

Example Figure 19-7 illustrates the concept of timely detection. Assume protection system elements provide the time delays and detection probabilities shown in Figure 19-7. If the guard response time is 120 seconds, the designer/evaluator must find the last sensing opportunity on the adversary path where the adversary is more than 120 seconds away from his goal. In this example, the time remaining is 135 seconds after he has crossed the Building Interior area (for this course we assume detection at an action occurs at the end of the delay time). Thus, the Building Interior Area is the Critical Detection Point (CDP). The 135-second total is the sum of 110 seconds for Surface 2, 5 seconds to cross the Vital Area, and 20 seconds for attacking the pump. Since four sensing opportunities are timely (that is, Adversary Task Time Remaining After First Sensing exceeds the PPS Response Time) then the probability of Interruption is calculated as PI = 1- (1-.1)(1-.1)(1-.6) (1-.1)(1-.1) = 1- (.9*.9*.4*.9*.9) = 1-.292 = .708 or approximately .71 (it is a common practice to maintain two-place accuracy, at most, on PI terms). The Time Remaining After Interruption (TRI) is the difference between the Adversary Task Time Remaining After First Sensing at the CDP (135 seconds) and the PPS Response Time (120 seconds), or 15 seconds.



Path

254 sec

140 sec

25 sec

250 sec

135 sec

20 sec

0 sec

PPS Response Time = 120 sec

(CDP)

DelayTime

Detection Probability, (PD)

6 sec

80 sec

110 sec

0.1

0.6

0.7

4 sec 0.1

5 sec 0.1

5 sec 0.0

20 sec 1.0

MinimumAdversary Task Time Remaining

After First Sensing

OPEN 1: Pump(Sabotage Target)

SURFACE 2

DOOR 1

FENCE 1

Protected Area

Building Interior

Vital Area

Figure 19-7. Example of Timely Detection

Example Path Upgraded

The designer/evaluator must decide whether PI = .708 is satisfactory. If it is not, the system must be improved. Three types of system improvements are shown in Figure 19-8: (1) a reduction in guard response to 40 seconds from 120 seconds, (2) a delay improvement where the pump delay time has increased from 20 to 50 seconds, and (3) an improvement in detection at the outer door, from probability of detection of .60 to .90. On this path the Critical Detection Point is located at the Vital Area so that PI in this case reaches 1- (1-.1)(1-.9) (1-.1)(1-.7) (1-.1)(1-0)= 1- (.9*.1*.9*.3*.9) = 1-.022 =.9781 or approximately .98. Not all upgrades probably need to be implemented. For example, if we had not made the detection upgrade shown in Figure 19-8 (but still reduced the PPS Response Time to 40 seconds and improved the task delay at the pump to 50 seconds) the Critical Detection Point would still be at the same place but now PI would only increase to .91252 or roughly .91. Looking back at Figure 19-7, if we had merely implemented the sensor upgrade at door 1 from .6 to 9, PI would have increased to .9271 or approximately .93.



PathAdversary Task Time Remaining

After First Sensing

254 sec

170 sec

55 sec

250 sec

165 sec

50 sec

0 sec

(CDP)

DelayTime

Detection Probability, (PD)

6 sec

80 sec

110 sec

0.1

0.9

0.7

4 sec 0.1

5 sec 0.1

5 sec 0.0

50 sec 1.0

Minimum

Timely Detection

PPS Response Time = 40 sec

OPEN 1: Pump(Sabotage Target)

SURFACE 2

DOOR 1

FENCE 1

Protected Area

Building Interior

Vital Area

Figure 19-8. Timely Detection for Upgraded Example

19.5 Path Interruption Analysis

Path Interruption Analysis considers all adversary paths

The last section merely considered one adversary path. To have an effective system, from the perspective of timely detection, all paths to all targets need to provide Probability of Interruption against threats in the design basis threat (DBT) that are sufficiently high enough to meet either design or security plan requirements. Path Interruption Analysis performs such a search. The path with the lowest Probability of Interruption for a given target, threat, and operation condition is called the critical path. The Probability of Interruption along the critical path is taken as the performance of the facility or site. This is in keeping with a “weak-link” approach to security where it is presumed that the adversary can discover this path while looking for weak security. Unless the facility being evaluated is small, not all such critical paths can be identified manually. Multipath analysis tools, such as MP VEASI, introduced later in this course, are typically used to search through all the paths in an adversary sequence diagram (ASD) to identify the critical paths.

19.5.1 Path Interruption Analysis Response Models

How Effective Is the Response Force in

Overcoming the DBT?

Commonly, there is an interest in seeing how effectively the PPS interrupts and neutralizes the adversary. This is addressed currently in the United States by creating a detailed scenario around that path and performing a scenario analysis involving simulations to determine PN and PE for that path. To characterize the overall PPS performance, it is necessary to take into account both the probability of interruption and the expectation of response force capabilities in overcoming or neutralizing the DBT. This can be expressed as:



EP IP

NP

where PI is the probability of interruption, PN is the probability of neutralization, and PE is the overall system measure of probability of effectiveness. The challenge is, of course, to determine PN. Possible options include the use of exercise data, historical engagement data, tabletop exercises, and computerized force-on-force modeling and simulation tools. Investigation of PN is, however, beyond the scope of this module. Given a DBT definition, it is conceivably possible to size, equip, and train a response force such that, for analytical purposes, PN can be assumed to approach a value of one.

19.6 Path Interruption Analysis Models

Path Interruption Analysis Models

Used in the Course to Show how to

Evaluate PPS Across All Paths

Several analytical computer models have been developed to help the analyst evaluate the effectiveness of a PPS. This course introduces Multipath VEASI: MP VEASI (Multipath Very-simplified Estimate of Adversary Sequence Interruption)—This model allows the user to conduct analysis of paths defined by adversary sequence diagrams (ASD) once data on the threat, target, facility state, site-specific PPS, and response force response time are entered, and the user identifies a path, and the MP VEASI code calculates PI and CDP. While MP VEASI has been designed for the purposes of this course, it is based on research performed for several multipath analysis tools. Note that MP VEASI includes a smaller tool called Single Path VEASI (normally just called VEASI) that only addresses a single path. Participants in this course will receive a disk copy of EXCEL™ MP VEASI.

MP VEASI Input Parameters

MP VEASI is simple to use, easy to change, and it quantitatively illustrates the effect of changing physical protection parameters that affect PI; input parameters for MP VEASI are shown in Table 19-1.

Table 19-1. Input Summary for MP VEASI

Detection

Probability of detection

Delay

Minimum Mean Delay time

Location of Detection with Respect to Delay

Assumed to fall at the end of delay

PPS Response Time

Planned response time



19.7 Summary

Definition of Path Interruption

Analysis and Probability of

Interruption, PI, for a Single Path

This section introduced the concept of Path Interruption Analysis and described how to determine Probability of Interruption, PI, for a single adversary path. Two path timelines were introduced, one depicting the delay times associated with adversary tasks on the one hand, and the other showing how long it would take the PPS to respond (the PPS Response Time). Probabilities of Detection, PD, are also associated with the adversary tasks along the path. Based on this information a Critical Detection Point (CDP) is determined that is the last sensing opportunity on the path where the adversary task time remaining exceeds the PPS Response Time. Probability of Interruption is the probability that the adversary is detected at a sensing opportunity before or at the CDP.

Limitation of PI Model

The Probability of Interruption is just one component part of Probability of System Effectiveness, PE. PI says nothing about who will win in a battle—just what the chances are that a sufficiently large contingent of the response force will arrive in time to interrupt the adversary. If this probability is not satisfactory, additional PPS measures can be planned and subsequent analyses run to determine the most cost-effective solutions.

Single Path Interruption

Analysis Evaluates Only One Path

It must be remembered that calculating PI for one specific path analyzes only that one specific path, and other paths may have an even lower probability of interruption. Because of this limitation, an exhaustive program, like MP VEASI, is valuable for looking at all possible paths and displaying only the most vulnerable.

19. path interruption analysis - sandia.gov19. path interruption analysis abstract. this session...

Documents