Network Inspection from Locations with Imperfect Detection Capabilities

We consider a two-player network inspection game, in which a defender positions a limited number of detectors according to a probability distribution in order to detect multiple attacks caused by an attacker. We assume that detection is imperfect, and each detector location is associated with a probability of detecting attacks within its set of monitored network components. The objective of the defender (resp. attacker) is to minimize (resp. maximize) the expected number of undetected attacks. Under mild assumptions on the detection capabilities and the number of attacks, we analytically characterize Nash equilibria of this zero-sum game when the monitoring sets are mutually disjoint. Our equilibrium analysis shows how the criticality of network components jointly depends on both players’ resources, detection rates, and the network topology. We leverage our results in the disjoint case to provide heuristic solutions to the general case by solving a minimum weighted set cover problem. Our computational results on a benchmark distribution network illustrate the performance and scalability of our solution approach.