Reliability Engineering and System Safety 112 (2013) 214–224

Contents lists available at SciVerse ScienceDirect

Reliability Engineering and System Safety

0951-83

http://d

$This

Lake Cit

* Corr

E-m

kjell.hau

journal homepage: www.elsevier.com/locate/ress

Defending and attacking a network of two arcs subject to traffic congestion$

Vicki M. Bier a, Kjell Hausken b,*

a Department of Industrial and Systems Engineering, University of Wisconsin-Madison, 1513 University Avenue, Room 3270A, Madison, WI 53706, United Statesb Faculty of Social Sciences, University of Stavanger, 4036 Stavanger, Norway

a r t i c l e i n f o

Article history:

Received 20 September 2011

Received in revised form

5 November 2012

Accepted 21 November 2012Available online 16 December 2012

Keywords:

Defense

Attack

Game

Government

Terrorist

Interdiction

Network

Traffic congestion

20/$ - see front matter & 2012 Elsevier Ltd. A

x.doi.org/10.1016/j.ress.2012.11.016

paper was presented at the Society for Risk A

y, Utah, December 5–8, 2010. www.sra.org.

esponding author.

ail addresses: bier@cae.wisc.edu (V.M. Bier),

sken@uis.no (K. Hausken).

a b s t r a c t

To study the effects of intentional attacks on transportation systems, we consider drivers who choose

the more time-efficient of two arcs (possibly of different lengths). Both arcs are subjected to traffic

congestion, and also to interdiction or blockage (e.g., by a terrorist attack). The model has three types of

strategic actors: the government; the terrorist; and potential drivers. The government protects travel,

while the terrorist interdicts travel, along the two arcs. Drivers choose the arc that gives the shortest

travel time, and cannot choose an interdicted arc. The drivers have reservation travel times, such that if

the actual travel time will exceed an individual driver’s reservation travel time, that driver would prefer

not to travel; the reservation travel times are allowed to vary among drivers. The objective function of

the master problem, which the government minimizes and the terrorist maximizes, is the sum of the

total travel time plus the reservation travel times of the non-travelers. Each potential driver decides

endogenously whether to travel, according to whether the actual travel time is greater or lesser than

that driver’s reservation travel time.

& 2012 Elsevier Ltd. All rights reserved.

1. Introduction

A growing literature analyzes how networks and infrastructuresare defended and attacked. A largely separate literature analyzestraffic congestion, assuming neither defense nor attack. This paperis to our knowledge the first to develop an understanding of howthe two literatures can be merged. To begin to study the effect ofintentional attacks on traffic congestion, we consider a simplemodel in which multiple drivers choose the more time-efficient oftwo arcs of different lengths. Both arcs are subjected to trafficcongestion, and also to interdiction. We describe the interdiction asbeing performed by a terrorist, but it may also be performed by agovernment organization, for example for interdiction of drugsmuggling [45]. In our model, the government allocates a resourceto protect travel along the two arcs. The terrorist has the oppositeobjective of interdicting the arcs.

There are three possible outcomes: both arcs operate; one arcoperates while the other is blocked; or both arcs are blocked. Thedrivers have reservation travel times such that if an individualdriver’s reservation travel time is exceeded, the driver prefers not totravel. The objective function, which the government minimizesand the terrorist maximizes, weights the travel times by the

ll rights reserved.

nalyzis Annual Meeting, Salt

number of drivers along the two arcs, and weights the averagepenalty (which equals the trip value) suffered by those preferringnot to travel by the number of drivers who do not travel. Since thetravel times in the objective function are computed taking conges-tion into account, this objective function implicitly considers travel-time delays, but also an estimate of the losses to those who choosenot to travel due to congestion.

In earlier research, Azaiez and Bier [2] consider the optimalresource allocation for security in reliability systems.1 Bier et al.[6] and Bier and Abhichandani [4] assume that the defenderminimizes the success probability and the expected damage of anattack, respectively. Moreover, Bier et al. [6] analyze the protec-tion of series and parallel systems with components of differentvalues. They specify optimal defenses against intentional threatsto system reliability, focusing on the tradeoff between investmentcost and security. The optimal defense allocation in their modeldepends on the structure of the system, the cost-effectiveness ofinfrastructure-protection investments, and the adversary’s goalsand constraints.

Hausken [16,17] analyzes strategic defense and attack for seriesand parallel reliability systems, and then considers how to protectmore complicated infrastructures against multiple strategic attack-ers. Levitin [21] considers the optimal element separation andprotection in a complicated multi-state series-parallel system, and

1 In particular, their results apply to combined series/parallel systems,

provided that the system can be represented with only ‘‘AND’’ and ‘‘OR’’ logic in

such a way that each component appears only once.

V.M. Bier, K. Hausken / Reliability Engineering and System Safety 112 (2013) 214–224 215

suggests an algorithm for determining the expected damage causedby a strategic attacker. Hausken and Levitin [18] analyze bothdefense and attack of complicated multi-state systems.

Apostolakis and Lemon [1] explicitly take into account thecomplicated networked structure of many infrastructure systemsin performing vulnerability assessment; however, their approachis limited to distribution systems (with one-directional flows), inwhich the consequences of interdicting a given line can bedetermined in a straightforward manner. Patterson and Aposto-lakis [27] introduce importance measures for ranking the ele-ments in complicated systems exposed to terrorist actions;Michaud and Apostolakis [24] analyze measures of damagecaused by terror, such as impact on people, impact on theenvironment, impact on public image, etc.

Bier et al. [5,7] assume that a defender allocates defense to acollection of locations, while an attacker chooses a location toattack. They show that the defender prefers to allocate resourcesin a centralized rather than decentralized manner, that theoptimal allocation of resources can be non-monotonic in thevalue of the attacker’s outside option, and that the defenderprefers its defense to be public rather than secret. Also, in theirmodel, the defender sometimes leaves a location undefended, andsometimes prefers a higher vulnerability at a particular locationfor strategic reasons, even if a lower risk could be achieved at zerocost. Dighe et al. [15] consider secrecy in defensive allocations asa strategy for achieving more cost-effective attacker deterrence;see also Zhuang and Bier [49,48], Zhuang et al. [50]. Zhuang andBier [47] consider defender resource allocation for counteringboth terrorism and natural disasters.

Lee et al. [20] analyze the restoration of services in interde-pendent infrastructure systems, using a network-flow model.They observe that these systems have become so interconnectedthat disruption of one system may lead to disruptions in all ofthem. Brown et al. [11] analyze how a defender pre-positionsballistic missile defense to minimize the worst possible damageby a strategic attacker. They first assume complete information,and then generalize to account for secrecy. Brown et al. [10]consider defender–attacker–defender models. First, the defenderinvests in protecting its infrastructure, subject to a budgetconstraint; then a resource-constrained attack is carried out;and finally, the defender operates the residual system as well aspossible. Brown et al. [10] illustrate their approach with applica-tions to border control, the US strategic petroleum reserve, andelectric power grids. Salmeron et al. [32] analyze how to opti-mally mitigate the disruptions to electric power grids caused byterrorist attacks; both critical system components and maximallydisruptive attack plans are identified. By contrast, Bier et al. [5,7]present a heuristic methodology for identifying near-optimalinterdiction strategies for a power transmission system; theirmethod is based on a greedy algorithm in which the transmissionline(s) with the highest load are assumed to be interdicted.Richard et al. [30] observe that many systems contain bottlenecks,critical linkages, or key facilities that, when compromised, mayimperil the system’s intended function, and present an integerlinear-programming model that optimally allocates fortificationresources in order to minimize the impact of interdiction. Weinand Atkinson [44] design radiation-detection systems to protectcities from nuclear terrorist attack.

Bell et al. [3] analyze road-network vulnerability game-theoretically. Their approach posits predefined disruption, attack,or failure scenarios, and then considers how to use the roadnetwork so as to minimize the maximum expected loss in theevent of one of these scenarios. A mixed-route strategy is adopted,meaning that the use of the road network is determined by theworst scenario probabilities. Ukkusuri and Yushimito [41] present amethodology to assess the criticality of highway-transportation

networks. They use concepts from the science of complicatednetworks to assess the importance of highway networks, usingtravel time as a performance measure to assess criticality. Roccoet al. [31] develop a flow importance measure with application toan Italian transmission power system. Ramirez-Marquez et al. [28]consider optimal network protection against diverse interdictorstrategies. Ramirez-Marquez et al. [29] apply evolutionary techni-ques to determine optimal protection of general source-sinknetworks.

Wood [45] considers deterministic network interdiction in thecontext of interdicting drug networks. Snyder et al. [39] deter-mine how to plan for disruption in supply-chain networks.Church and Scaparra [13] present an overview of the challengesof protecting infrastructure facilities against both intentionalattacks and natural disasters. Church and Scaparra [14] formulatethe problem of optimal network defense against intentionalthreats as an optimal r-interdiction median problem (assumingthat the attacker can target up to r components of the network);they solve the problem as a linear integer program and presentcomputational results. Scaparra and Church [33] analyze thisproblem using implicit enumeration, and Scaparra and Church[34] provide an exact solution approach for this problem. Sca-parra and Cappanera [35] develop a game-theoretic approach forallocating protection resources in shortest-path networks. Losadaet al. [23] focus on the issue of resilience and the time required forrecovery from attacks, while Liberatore et al. [22] extend theseresults to the case of an uncertain number of attacks, minimizingthe worst-case impact. Zenklusen [46] presents computational-complexity results for network-interdiction problems.

Numerous models of transportation infrastructure take intoaccount the effects of congestion. For example, Nagurney andQiang [25,26] present an efficiency measure for congested net-works, accounting for demands and costs and the underlyingbehavior of network users. However, most such models do notaddress problems of transportation security. They are typicallyroute-choice methods that predict what the levels of congestionwill be in different parts of (possibly quite complicated) trans-portation network, without the threat of intentional attacks.Despite the extensive work indicated above, to our knowledgethere have not yet been any models of transportation infrastruc-ture that take into account the effects of congestion in systemswith a strategic attacker, a strategic defender, and strategicdrivers.

The model suggested in this paper relies on a contest-successfunction commonly used in models of economic conflict whenplayers have opposite preferences [36,40]. Contest-success func-tions have been less commonly used in the war and combatliterature, where Lanchester [19] differential equations have beenmore common, but are equally applicable to war and combat. Inaddition, we explicitly include a model of congestion, based onthe approach taken in Small and Verhoef [37].

Section 2 presents and analyzes our model. Section 3 givesresults. Section 4 concludes.

2. The model

2.1. Notation

tk government’s effort to protect arc k, k¼A,B, tkZ0Tk terrorist’s effort to interdict arc k, TkZ0mk contest intensity of arc kck government’s unit cost of protecting arc kCk terrorist’s unit cost of interdicting arc kpk travel reliability along arc k, i.e. probability that arc k

will be passable

V.M. Bier, K. Hausken / Reliability Engineering and System Safety 112 (2013) 214–224216

gk¼1�pk probability of a successful attack rendering arc kimpassable

Lk length of arc ktk travel time from start to end of arc ktL lower limit of the drivers’ reservation travel timestU upper limit of the drivers’ reservation travel timesEt conditional expected travel time given that at least one

arc is passableSk average speed along arc kSkopt speed at which the traffic density on arc k reaches its

maximumDk traffic density (i.e., average number of drivers passing

any given point) on arc k per time unitDkmax maximum value of Dk

tknn, Sknn, Dknn values of tk, Sk, Dk when there is no successfulattack on either arc

tAns, SAns, DAns values of tA, SA, DA when there is no successfulattack on arc A, but a successful attack on arc B

tBsn, SBsn, DBsn values of tB, SB, DB when there is a successfulattack on arc A, but no successful attack on arc B

D number of drivers wanting to travel per time unitED expected traffic density (i.e., expected number of drivers

per time unit)Hk parameter for effect of congestionNk average number of drivers on arc k at any point in timer government’s resource constraintR terrorist’s resource constraintf objective function (which the government minimizes,

the terrorist maximizes)

2.2. Basic formulation

We consider multiple drivers proceeding from a start node toan end node in a network. The drivers can choose multiple routesthrough the network, are subject to traffic congestion, and areassumed to choose the most time-efficient route from the startnode to the end node. A network defender, referred to as thegovernment, protects the network to allow time-efficient travelfor as many drivers as possible. An attacker, referred to as theterrorist, wants to interdict time-efficient travel for as manydrivers as possible. For analytical tractability, consider the net-work in Fig. 1, which has two nodes, 1 and 2, and two arcs, A andB. The drivers proceed from node 1 to node 2 along either arc A orarc B.

It is common and realistic to assume that the governmentchooses its protection effort first and the terrorist chooses itsinterdiction effort second. However, since we consider a zero-sumgame, the same equilibrium solution is obtained regardless ofwhether the government and the terrorist choose their strategiessimultaneously and independently, or one player chooses first andthe other player responds. This follows from Von Neumann’s [42]min–max theorem, and from Von Neumann and Morgenstern’s [43]finding (Section 15.3.1) that zero-sum two-person games are solva-ble by backward induction. (For non-zero-sum games, simultaneousand sequential games yield different solutions.)

A

21

B

Fig. 1. The network.

After the government and the terrorist have made theirdecisions, the drivers choose the optimal arc, A or B.2 Both thestructure of the network and all parameter values are commonknowledge. The distance (in miles) along arc k is Lk. Considering astationary-state situation (i.e., assuming that any arc disruptionlasts long enough for transient effects to be negligible), theaverage speed (in miles/h) along arc k is Sk. The average time totravel from node 1 to node 2 along arc k is given by tk (in h),where

Lk ¼ Sktk ð1Þ

We define the traffic density3, Dk (in drivers/h), as the averagenumber of drivers arriving at the destination point (or, equiva-lently, passing any given point) along arc k per unit time. Theaverage number of drivers on arc k at any point in time is thus

Nk ¼Dktk ð2Þ

Example 1. Consider a benchmark system with no congestion.Set LA¼100 miles, DA¼100 drivers/h, and SA¼50 miles/h. Eqs.(1) and (2) give tA¼2 h and NA¼200 drivers. Set LB¼75miles. Making drivers indifferent between the two arcs meanstB¼2 h; Eq. (1) then gives the speed to be SB¼37.5 miles/h. Ifneither DB nor NB is specified, Eq. (2) is indeterminate for arc B,which means that there can be either many or few drivers onarc B. This illustrates how congestion plays no role in thisexample.

We model congestion along arc k by

Dk ¼Dkmax�Hk Sk�Skopt

� �2ð3Þ

where HkZ0 is a parameter that expresses the effect of conges-

tion. Eq. (3) states that the traffic density reaches its maximum

when speed is at its optimum level, Sk¼Skopt. Increasing Sk above

its optimum gives normal congestion, and decreasing Sk below its

optimum gives ‘‘hyper-congestion’’ as defined in [37]; footnote

16, p. 226. Hyper-congestion arises in conditions where speed

increases with traffic density; see Small and Chu [38]. Using data

from a four-lane section of the Washington (DC) Beltway, Board-

man and Lave [8] have quantified the parameters in Eq. (3) as

follows:

Dk ¼ 2490�0:523 Sk�35:34ð Þ2

ð4Þ

where Dk is in drivers/h per lane.

Example 2. Assume that D¼4500 drivers arrive at node 1 perhour, and seek to proceed as quickly as possible to node 2. Thedrivers distribute themselves across arcs A and B so thatDAþDB¼D; i.e.,

2490�0:523 SA�35:34ð Þ2þ2490�0:523 SB�35:34ð Þ

2¼ 4500 ð5Þ

Although drivers may be boundedly rational and have incom-

plete information, we consider as a reasonable assumption that

drivers distribute themselves to achieve tA¼tB. Applying Eq. (1)

gives

2490�0:523 100=tA�35:34� �2

þ2490�0:523 75=tA�35:34� �2

¼ 4500 ð6Þ

2 Commuters are famous for making real-time decisions, changing plans on

the fly if one route seems too congested. To imagine that they make their decisions

ahead of time, based on expected future conditions (or expected payoffs under

future conditions), does not seem credible, except for longer-term decisions like

whether to live in the city or a suburb.3 Small and Verhoef [37] use the term ‘‘traffic flow’’ or volume.

Drivers who prefer not to travel Drivers who prefer to travel

Reservationtravel time

τL τ τU

Fig. 2. Uniform distribution of reservation travel times between tL and tU.

V.M. Bier, K. Hausken / Reliability Engineering and System Safety 112 (2013) 214–224 217

which yields tA¼tB¼1.58 h, SA¼63.15 miles/h, SB¼47.36 miles/

h, DA¼2086, and DB¼2414. Hence, more drivers travel along the

shorter arc, B, but at a lower speed than the drivers traveling

along arc A.

The government exerts effort tk at unit cost ck to protect travel

along arc k. The terrorist exerts effort Tk at unit cost Ck to interdict

travel along arc k. The government has a total defensive budget r,

and must satisfy

r¼ cAtAþcBtB ð7Þ

The terrorist has a resource R, obtained through sponsorship or

in other ways, allocated such that

R¼ CATAþCBTB ð8Þ

This constrained formulation of the problem gives one free-choice

variable tA to the government and one free-choice variable TA to the

terrorist, where tB and TB follow from the budget constraints in (7)

and (8). Each actor can either exert effort on one arc, or distribute its

efforts across both the arcs. The terrorist either executes one attack

(if one arc is attacked) or two simultaneous attacks (if the terrorist

allocates its resource across both arcs).

We define the travel reliability pk along arc k as the probability

that arc k will be passable. We model pk using the common ratio

form contest-success function [36,40], which expresses the prob-

ability that there will not be a successful attack on arc k:

pk ¼tmk

k

tmk

k þTmk

k

ð9Þ

where mkZ0 is a parameter expressing the intensity of the

contest, yielding qpk/qtk40 and qpk/qTko0. The case where

tk¼Tk¼0 does not arise as a solution of our model, since in that

case either actor would have an incentive to increase its effort

from zero to an arbitrarily small positive level in order to win the

contest. With finite resource r and R, both actors thus allocate

strictly positive efforts to both arcs. This is realistic, since in real

life, the government provides at least general police and/or

military protection, so that transportation networks are at least

marginally protected; no government actually allocates zero

resources. Therefore, the value of the contest-success function

can be left undefined for the case where tk¼Tk¼0, or alternatively

can be defined to equal pk¼1/2.

When mk¼0, the efforts tk40 and Tk40 have no impact on the

contest regardless of their magnitudes, which gives a success

probability of pk¼0.5. When 0omko1, small investments are

more effective per unit of effort than large investments (corre-

sponding to a concave contest-success function), which makes

sense if the most cost-effective investments are chosen first.

When mk¼1, every unit of investment is equally effective. When

mk41, larger investments are more effective per unit effort than

small investments (corresponding to economies of scale). Finally,

mk¼N gives a step function in which the winner takes all. In

other words, when mk¼N, arc k is perfectly hardened if the

government protects arc k even infinitesimally more than the

terrorist attacks it, tk4Tk; conversely, arc k is guaranteed to be

interdicted if tkoTk.

If both arcs are operational, drivers distribute themselves across

both arcs so that they experience the same travel time on both

arcs. If an attack on one arc succeeds, then the other arc is

passable, and drivers suffer congestion. If attacks on both arcs

succeed, then no arcs are passable, and all drivers must

stay home.

Assume that D drivers want to travel through the network. If D

exceeds the network capacity, then the excess drivers cannot travel,

and stay at home. We define a driver’s reservation travel time as the

largest acceptable time for travel from node 1 to node 2. It can be

determined either empirically or by survey methods such as con-

tingent valuation. We interpret this as the driver’s value of traveling

(i.e., the trip value). If the actual travel time exceeds the reservation

travel time, the driver prefers not to travel, and stays at home. If the

actual travel time is less than the reservation travel time, the driver

enjoys both the trip value and the savings in travel time. We assume

that the D drivers have reservation travel times uniformly distributed

between tL and tU, where tLrtU, as shown in Fig. 2. Assume that

the actual travel time is t. Then drivers with small reservation travel

times (between tL and t) prefer not to travel, and drivers with large

reservation travel times (between t and tU) prefer to travel.

2.3. Special formulation when one arc is blocked

Assume that arc k is not blocked, while arc j is blocked, k, jE{A,

B}, ka j. We search for equilibrium on arc k where the marginaldriver with travel time tk is indifferent between traveling and nottraveling. This means that tk has the joint interpretation of thismarginal driver’s travel time on arc k, and the driver beingindifferent between traveling and not traveling. In this equili-brium, it is straightforward that there will be D(tU�tk)/(tU�tL)drivers on arc k, and D(tk�tL)/(tU�tL) drivers who prefer not totravel. Inserting into Eq. (3) and applying Eq. (1) gives

DtU�tk

tU�tL¼Dkmax�Hk

Lk

tk�Skopt

� �2

ð10Þ

Eq. (10) determines the travel time tk when a non-zeronumber of drivers prefers not to travel. In that case, the traveltime on arc k must also equal the reservation travel time of adriver who is indifferent between traveling and not traveling.Identifying that value simultaneously specifies the numberD(tU�tk)/(tU�tL) of drivers on the left-hand side of Eq. (10).All drivers on arc k have travel time tk, which means that theytravel at speed Sk. Hence, the D(tU�tk)/(tU�tL) drivers withreservation travel times between tk and tU, on the left-hand sideof Eq. (10), enjoy a time savings relative to their reservation traveltime. On the other hand, the remaining D(tk�tL)/(tU�tL) driversprefer not to travel, since their reservation travel times are lowerthan tk. Eq. (10) is third order in tk, with one real and twoimaginary solutions. The real solution is given by

tk ¼1

12D

��2 3

ffiffiffi2p

1þ iffiffiffi3p� �

D2tU2þ2D tL�tUð Þ DkmaxtUð

�þHk Skopt 3Lk�Skopt tU

� �Þþ tL�tUð Þ

2 Dkmax�Hk Skopt2

� �2��=

�2D3tU3þ3D2 tL�tUð Þ �2tU

2 Dkmax�Hk Skopt2

� �þ9Hk Lk

2���

�6Hk Lk Skopt tUÞþ3ffiffiffi3p

O �D2Hk Lk2 tL�tUð Þ 4D3tU

3��

�D2 tL�tUð Þ 4tU2 2Hk Skopt

2�3Dkmax

� �þ27Hk Lk

2�

�36Hk Lk Skopt tUÞþ4D tL�tUð Þ2�

3D2kmaxtUþDkmax Hk Skopt

Fig. 3. Output variables as functions of HA.

V.M. Bier, K. Hausken / Reliability Engineering and System Safety 112 (2013) 214–224218

9Lk�4Skopt tU

� �þH2

kS3kopt Skopt tU�Lk

� ��þ4Dkmax tL�tUð Þ

3 Dkmax�Hk S2kopt

� �2���6D tL�tUð Þ

2

Dkmax�HkS2kopt

� �Dkmax tUþHk Skopt 3Lk�Skopt tU

� �� ��2 tL�tUð Þ

3 Dkmax�Hk S2kopt

� �3� 1=3ð Þþ22=3 1�i

ffiffiffi3p� �

�2D3t3Uþ3D2 tL�tUð Þ �2t2

U Dkmax�Hk S2kopt

� �þ9Hk L2

k

���6Hk Lk Skopt tUÞþ3

ffiffiffi3p

O �D2Hk L2k tL�tUð Þ

�4D3t3

U�D2 tL�tUð Þ 4t2U 2Hk S2

kopt�3Dkmax

� �þ27Hk L2

k

���36Hk Lk Skopt tUÞþ4D tL�tUð Þ

2�

3D2kmaxtUþDkmax Hk

Skopt 9Lk�4Skopt tU

� �þH2

kS3kopt Skopt tU�Lk

� �Þ

þ4Dkmax tL�tUð Þ3 Dkmax�HkS2

kopt

� �2���6D tL�tUð Þ

2

Dkmax�Hk S2kopt

� �DkmaxtUþHk Skopt 3Lk�Skopt tU

� �Þ

��2 tL�tUð Þ

3 Dkmax�HkS2kopt

� �3� 1=3ð Þ

þ4 DtUþ tL�tUð Þ Dkmax�HkS2kopt

� �� ��ð11Þ

which specifies the travel time on arc k when the other arc is blocked.

Example 3. Extending Example 2, assume that the value of tA

and tB when both arcs are operational is equal to the lower boundof tL¼1.58 h. Hence, under these conditions, all drivers wouldprefer to travel, since by definition none have reservation traveltimes below tL. Now assume that arc A is blocked. Arc B canmaximally carry 2490 drivers if SB¼35.34 miles/h, which means a

travel time of tB¼LB/SB¼75/35.34¼2.12 h. Assume thattU¼2.5 h. Inserting these numerical values into Eq. (11) givestBsn¼1.99 h, SBsn¼37.66 miles/h, and DBsn¼2487 drivers, wherethe subscript ‘‘sn’’ denotes that there was a successful attack onarc A but no successful attack on arc B. Our result shows that thedrivers speed up above the speed of 35.34 miles/h that maximizesthe carrying capacity of arc B, in order to shorten their travel timebelow 2.12 h, thus causing congestion and allowing only 2487drivers to travel (which means that three of the 2490 drivers muststay home). In return, these 2487 drivers enjoy a driving time oftBsn¼1.99 h, which is less than the 2.12 h without congestion, butmore than the 1.58 h when both arcs operate. Analogously, whenarc B is blocked, we get tAns¼2.01 h, SAns¼49.68 miles/h, andDAns¼2382 drivers, where the subscript ‘‘ns’’ denotes no success-ful attack on arc A and a successful attack on arc B. Thus, arc A cancarry fewer drivers than arc B, but at a higher speed, resulting in amarginally longer travel time due to the greater length of arc A.

2.4. General formulation and solution

Inserting Sk¼Lk/tk from Eq. (1) into Eq. (3) shows that as thetravel time tk becomes sufficiently small, congestion can force thedensity to zero. The government seeks to balance the competingobjectives of low travel time, high density, and few drivers unableto travel. We thus formulate an objective function weighting thetravel time by the number of drivers experiencing this travel time,and weighting the penalty for not traveling (also denominated inhours, and represented by the reservation travel time) by thenumber of drivers who do not travel due to congestion.

Fig. 4. Output variables as functions of cA.

V.M. Bier, K. Hausken / Reliability Engineering and System Safety 112 (2013) 214–224 219

To motivate our choice of this objective function, consider ahypothetical status quo in which all drivers get the benefits oftheir trips for free (i.e., travel time equals zero, and everybodytravels). Then, by comparison to this hypothetical travel point, inan actual scenario, those who travel would experience lossesequal to their actual travel times, and those who do not travelwould experience losses equal to the values of their foregone trips(i.e., reservation travel times).

If both arcs are passable, which occurs with probability pApB,the total travel time is proportional to tAnnDAnnþtBnnDBnn, whichweights the travel time along each arc by the density along thatarc, where the subscript ‘‘nn’’ means that there was no successfulattack on either arc. Moreover, since tAnn¼tBnn, the expressiontAnn(DAnnþDBnn) expresses the loss for those who travel. Inaddition, the D�DAnn�DBnn drivers who do not travel haveaverage trip values of (tLþtAnn)/2, because their reservation traveltimes are uniformly distributed; see Fig. 2. Hence, losses for thosewho do not travel are proportional to [(tLþtAnn)/2](D�DAnn�DBnn).When D¼DAnnþDBnn, all demand is served under normal circum-stances. Inserting Eqs. (1) and (3) into D¼DAnnþDBnn gives

tAnn ¼HALASAoptþHBLBSBopt�

ffiffiffiffiQ

pD�DAmax�DBmaxþHAS2

AoptþHBS2Bopt

,

Q ¼ HALASAoptþHBLBSBopt

� �2� HAL2

AþHBL2B

� �� D�DAmax�DBmaxþHAS2

AoptþHBS2Bopt

� �ð12Þ

which specifies the corresponding equilibrium travel time whenboth arcs are operational.

With probability pA(1�pB), there is no successful attack on arc A,but a successful attack on arc B. The quantity DAns, which can bedetermined using Eq. (3), is the density on arc A when arc B isblocked, where the subscript ‘‘ns’’ means no successful attack on arc

A, but a successful attack on arc B. Hence, tAnsDAns gives the rate oftravel-time losses along arc A for those who travel, and [(tLþtAns)/2](D�DAns) gives the rate of losses for those who do not travel.

Analogously, with probability (1�pA)pB, there is a successfulattack on arc A, but no successful attack on arc B. The quantityDBsn again gives the density on the operational arc B when arc A isblocked, where the subscript ‘‘sn’’ means a successful attack onarc A and no successful attack on arc B. Hence, tBsnDBsn gives therate of travel-time losses along arc B for those who travel, and[(tLþtBsn)/2](D�DBsn) expresses the rate of lost trip values forthose who do not travel.

Finally, with probability (1�pA)(1�pB), there are successfulattacks on both arcs. This gives zero density on both arcs. Hence,[(tLþtU)/2]D expresses the rate of lost trip values for travelersbeing unable to travel in this condition.

We thus get the objective function

f ¼ pApBSþpA 1�pB

� �Aþ 1�pA

� �pBBþ 1�pA

� �1�pB

� �F,

S¼ tAnn DAnnþDBnnð ÞþtLþtAnn

2 D�DAnn�DBnnð Þ,

A¼ tAnsDAnsþtLþtAns

2 D�DAnsð Þ,

B¼ tBsnDBsnþtLþtBsn

2 D�DBsnð Þ,

F ¼ tLþtU2 D

ð13Þ

which the government minimizes and the terrorist maximizes. In (13),the government’s strategic decision variable is tA, the terrorist’sstrategic decision variable is TA, and each driver’s two strategic choicesare whether to travel at all, and if so, whether to travel on arc A or arcB (with the restriction that a blocked arc cannot be chosen).

The government exerts effort in an attempt to ensure largevalues of pA and pB. Analogously, the terrorist exerts effort toachieve small values of pA and pB. Solving Eqs. (7) and (8) withrespect to the defense and attack efforts tB and TB, respectively,gives tB¼(r�cAtA)/cB and TB¼(R�CATA)/CB. Inserting these intoEq. (9) and Eq. (9) into Eq. (13) and then applying Eqs. (1) and (3)gives our objective function as a function of the free choicevariables tA and TA.

The expected traffic density ED, which expresses the expectedaverage number of drivers arriving at the destination point per timeunit (accounting for the probabilities of successful arc interdiction), is

ED ¼ pApB DAnnþDBnnð ÞþpA 1�pB

� �DAnsþ 1�pA

� �pBDBsn ð14Þ

This expression weights the traffic density under each condi-tion by the probability of that condition. Hence, D�ED expressesthe expected average number of drivers not traveling per timeunit, which we refer to as the density of lost trips. Note that Eq.(14) assigns zero weight to the event that occurs with probability(1�pA) (1�pB), which reflects the fact that the density oftravelers is zero when both arcs are blocked. ED can thus bearbitrarily close to zero when the terrorist is likely to be success-ful in blocking both arcs. In addition, the conditional expectedtravel time Et, given that at least one arc is passable, is

Et ¼pApBtAnnþpA 1�pB

� �tAnsþ 1�pA

� �pBtBsn

pApBþpA 1�pB

� �þ 1�pA

� �pB

ð15Þ

The objective function in Eq. (13) can be optimized consideringonly tA and TA, since the values of tB and TB follow from Eqs.(7) and (8), respectively. Therefore, we assume that the govern-ment chooses tA to minimize the objective function in Eq. (13),and the terrorist chooses TA to maximize it. Since the game iszero-sum, Von Neumann’s [42] min–max theorem implies thatthe same solution follows regardless of whether the governmentand the terrorist choose their strategies simultaneously andindependently, the government moves first to minimize themaximum value of f that the terrorist can obtain by choosing itsbest response (min–max), or the terrorist moves first to maximizethe minimum value of f obtainable by the government playing its

Fig. 5. Output variables as functions of LA.

V.M. Bier, K. Hausken / Reliability Engineering and System Safety 112 (2013) 214–224220

best response (max–min). Von Neumann and Morgenstern’s [43]proposal (Section 15.3.1) of solving the zero-sum game by back-ward induction, which is the common method to solve sequentialgames, gives a more complicated analyzis than solving thesimultaneous game. We thus solve the simultaneous game.Differentiating Eq. (13) gives Eqs. (A1) and (A2) in Appendix A,which are solved to yield

TA ¼ mA RCA r

cA R

� �mA CB r

cB R

� �mB

þ1

� ��Aþ B�Sð Þ

CB r

cB R

� �mB

þF

� �!,

CACB r

cB R

� �mB CA r

cA R

� �mA

A mB�mAð ÞþB mA�mBð Þð

���

þ F�Sð Þ mAþmBð ÞÞþmB A�Sð ÞCA r

cA R

� �2mA

þmB F�Bð Þ

�

þmAð� A�Fð ÞÞCA r

cA R

� �mA

þmA B�Sð ÞCA r

cA R

� �mA CB r

cB R

� �2mB

!!ð16Þ

where

tA ¼CA=R

cA=rTA, TB ¼

R�CATA

CB, tB ¼

CB=R

cB=rTB ð17Þ

The quantities S, A, B, and F in Eq. (16) are computed accordingto Eq. (13), using the values of tAns and tBsn given in Eq. (11), andthe value of tAnn specified in Eq. (12).

3. Results

We use the following baseline parameter values: r¼R¼cA¼

CA¼cB¼CB¼mA¼mB¼1; tL¼1.58; tU¼2.5; D¼4500; DAmax¼

DBmax¼2490; HA¼HB¼0.523; LA¼100; LB¼75; and SAopt¼

SBopt¼35.34. Fig. 3 plots the output variables as functions of HA,the parameter for the effect of congestion on arc A. As HA

increases, the densities on arc A decrease, the density on arc B

increases, travel speeds decrease, and travel times increase. As wemight expect, the attacker and defender both transfer some oftheir effort from arc A to arc B, since increasing congestion on arcA makes that arc less valuable to both the attacker and thedefender. The expected density ED of travelers decreases in HA,and the expected travel time Et increases in HA. Finally, theobjective function f increases in HA, since increased susceptibilityto congestion is an advantage to the terrorist and a disadvantageto travelers. (The division of f by 5000 is for scaling purposes, sothat multiple results can be presented on the same graph.)

Fig. 4 plots various output variables as functions of the govern-ment’s unit cost cA of protecting arc A. As cA increases, thegovernment decreases its protection tA of arc A, while the terroristincreases its attack effort TA, causing pA to increase. As in Example 2,when no arcs are blocked, we have DAnn¼2086, DBnn¼2414, andtAnn¼tBnn¼1.58. In accordance with Example 3, when one arc isblocked, we have DAns¼2382, DBsn¼2487, tAns¼2.01, andtBsn¼1.99. These quantities, and thus also the equilibrium speedsSAnn¼63.15, SBnn¼47.36, SAns¼49.68, and SBsn¼37.66, are inde-pendent of cA. However, since the travel reliability pA is decreasingin cA, the losses f and the conditional expected travel time Et are

Fig. 6. Output variables as functions of DAmax.

V.M. Bier, K. Hausken / Reliability Engineering and System Safety 112 (2013) 214–224 221

increasing in cA, while the expected travel density ED is decreasingin cA. Intuitively, as the government’s unit cost cA of protecting arc A

increases, fewer potential drivers are able to travel, and those thatdo travel suffer longer travel times.

Fig. 5 plots the output variables as functions of LA, the length ofarc A. For small values of LA (below 70.36), arc A suffers hyper-congestion when arc B is blocked. (In fact, when LA is below 40.38,arc A suffers hyper-congestion even when both arcs operate.) Inthis region, arc A is less valuable to both the government and theterrorist than arc B, and receives fewer resources. In the centralrange (between the vertical bars), 70.36rLAr139.3, normal con-gestion occurs. For LAoLB¼75, tA and TA are still smaller than tB andTB, but increasing in LA. When LA¼LB¼75, the arcs are equivalent,causing equal effort to protect and interdict both arcs, and equaltravel times, speeds, and densities when both arcs are passable. As LA

increases above 75, both the travel time and the speed along arc A

increase, while the density along arc A decreases. This makes arc A

less desirable for both the government and the terrorist, so tA and TA

decrease in LA, while tB and TB increase. Throughout the range fromLA¼70.36 to LA¼139.3, the expected traffic density ED decreases, thetravel times increase, and the speed SBnn decreases, due to conges-tion. However, when LA¼131.0, a corner solution emerges, withtA¼TA¼0 and tB¼TB¼1. At this point, arc A is not worth eitherdefending or attacking; the players instead allocate their entireresources to defending and attacking the shorter arc B. AtLA¼137.1, a different corner solution arises, with tA¼TA¼1 andtB¼TB¼0 (at which point we also have tAnn¼tBnn¼tAns, andDAns¼DAnn). For 131.0oLAo137.1, the solution is indeterminate;since the two players move simultaneously, it is impossible to knowwhich of the two corner solutions will arise without furtherassumptions on the behavior of the players. As LA increases above137.1, the longer arc A becomes less valuable, so tA and TA decrease,

and arc B is increasingly protected. The density DBnn reaches amaximum of DBnn¼2490 when LA¼139.3. As LA increases above139.3, hyper-congestion operates on arc B, causing a low speed SBnn.

Fig. 6 plots the output variables as functions of DAmax, themaximum traffic density on arc A. Larger values of DAmax repre-sent improvements to the capacity of arc A—e.g., adding lanes;making the road wider, straighter, and smoother; or adding abarrier between opposing lanes. When DAmax¼2603, all levels ofeffort are equal, tA¼TA¼tB¼TB¼0.5. At this point, the fact thatDAmax¼26034DBmax¼2490 is exactly sufficient to compensatefor the greater length of arc A. As DAmax increases above 2603, arcA becomes more valuable, and conversely when DAmax decreasesbelow 2603. Aside from tBsn, SBsn, and DBsn (which are constant,and obviously do not depend on the capacity of arc A), increasingthe capacity of arc A yields to lower travel times, higher speeds,and a better value of the defender’s objective function.

Fig. 7 plots the output variables as functions of SAopt, the speedat which the traffic density on arc A reaches its maximum. At thebenchmark value of SAopt¼SBopt¼35.34, the shorter arc B (whichis more valuable) is protected more than arc A. As SAopt increases,so arc A can sustain a higher speed, arc A becomes more valuable;for 47.89oSAopto52.53, we have tA and TA exceeding tB and TB.However, as SAopt increases further (above 52.53), arc A becomesless valuable than arc B because of hyper-congestion on arc A.This causes U-shaped travel times, inverse U-shaped speeds, andinverse U-shaped expected travel density.

Fig. 8 plots key output variables as functions of the upperreservation travel time tU, under the assumption that D¼DAnnþ

DBnn. When both arcs are passable, the densities DAnn and DBnn andthe travel times tAnn¼tBnn are independent of tU. However, as tU

increases, the equilibrium travel times tAns and tBsn increase. Thus,the expected travel time Et also increases, but more slowly than tAns

Fig. 7. Output variables as functions of SAopt.

V.M. Bier, K. Hausken / Reliability Engineering and System Safety 112 (2013) 214–224222

and tBsn, since tAnn¼tBnn is constant. In addition, the travel speedsSAns and SBsn with blocked arcs are decreasing in tU, since as tU

increases, more potential drivers are willing to travel even underdegraded conditions, causing greater congestion. The densities DAns

and DBsn are initially increasing in tU, as more drivers pile onto thenon-degraded arc, but eventually begin to decrease due to conges-tion. Thus, the expected density ED is also inverse U shaped.Interestingly, the attack and defense efforts tA¼TA and tB¼TB arerelatively insensitive to tU.4 The objective function f is increasing intU, since for large values of tU, travelers care more about disruptions.

4. Conclusions

To our knowledge, this is the first model of interdiction toexplicitly consider congestion, rather than just increased traveldistance. Although we consider a system of only two arcs, this isadequate for investigating some basic congestion phenomena.Our results should provide a building block for more complicatedand realistic models.

In our model, each of a population of drivers chooses the moretime-efficient of two arcs of different lengths. Both arcs aresubject to traffic congestion, and also to interdiction by anattacking terrorist. The players consist of the government, the

4 When tU¼tL¼1.58, DAns is much lower than DBsn. Hence, we have tB4tA,

since arc B is more important for the government to protect. As tU increases, DAns

increases more rapidly than DBsn and eventually exceeds DBsn, making arc A more

important; hence, we have tA4tB for large tU. When DAns¼DBsn¼2477 (which

happens for tU¼3.57), we have tA¼tB¼0.5, and both arcs are equally important to

the government.

terrorist, and the drivers. The government allocates a fixedresource to protect travel along the two arcs, while the terroristallocates a fixed resource to interdict travel along the two arcs.The drivers choose the arc that gives the shortest travel time, andcannot choose a blocked arc.

There are three possible outcomes: both arcs operate; one arcoperates while the other is blocked; or both arcs are blocked. Thedrivers have reservation travel times such that if an individualdriver’s reservation travel time is exceeded, the driver prefers notto travel; the reservation travel times vary among drivers, and areuniformly distributed between a minimum and a maximumvalue. In equilibrium, if both arcs are operational, the driversdistribute themselves across the two arcs so that the travel timesalong both arcs are equal; if only one arc is operational, theydistribute themselves between driving and not driving so that thereservation travel times of the non-travelers are less than thetravel time on the operational arc, and the reservation traveltimes of the travelers are greater than the travel time. Theobjective function, which the government minimizes and theterrorist maximizes, weights the travel times by the number ofdrivers along the two arcs, and weights the average penalty(which equals the trip value) suffered by those preferring not totravel by the number of drivers who do not travel.

While the model is simple, with only two arcs, we provideinteresting results. For example, our paper suggests that greaterdefensive effort should be allocated to less congested arcs (withfaster travel times), and to routes with greater maximum traveldensity (e.g., wider or straighter roads). Some of the key para-meters in this model could be challenging to quantify in practice.In many cases, transportation planners should already havereasonable estimates of parameters such as reservation travel

Fig. 8. Output variables as functions of tU.

V.M. Bier, K. Hausken / Reliability Engineering and System Safety 112 (2013) 214–224 223

times and congestion parameters. Other parameters, such asterrorist attack costs and budgets, may of course be more difficultto estimate, but methods for estimating such parameters (e.g.,using expert opinion) are currently of active interest to organiza-tions such as the US Department of Homeland Security. Identifi-cation of suitable data sources and/or methods of quantification(e.g., assessing the feasibility of relying on formal methods ofexpert elicitation in this area) would be needed before anexpanded version of this model is ready for application.

Future research should extend this basic approach to networkswith more than two arcs, and possibly also additional models ofcongestion. However, we believe that our results, while simple, help topave the way for more realistic models of interdiction that considercongestion. Additional extensions may also be desirable, of course; forexample, allowing the terrorist to attack different arcs in the systemsequentially rather than simultaneously, thus making it possible forthe terrorist to observe whether earlier attacks were successful beforedetermining where to direct subsequent attacks. Future researchshould also address the Braess [9] paradox (the fact that adding extracapacity to a network can in some cases reduce overall performance),which cannot be studied in systems with only two arcs.

Equating the values of the foregone trips with the reservationtravel times, as in this paper, is in our view appropriate for the mostcommon travel purposes, such as for example work and shopping.This reflects the assumption that when travel is important, it isbetter to arrive late at the destination than not to arrive at all.However, the value of a trip may in some cases change as a functionof the travel time. For example, an ambulance trip may be of highvalue if it can be completed quickly but of little value after the

patient has already died. Such trips are small in number comparedto the vast body of travel for more common purposes. However,more complicated models with non-constant reservation traveltimes could be considered in future work, for situations whereemergency vehicles or other vehicles that cannot tolerate traveldelays are the primary focus of the analyzis.

Acknowledgment

We thank three anonymous referees of this journal for usefulcomments.

Appendix A

@f

@tA¼

r�cA tA

cB

� �mB R�CA TA

CB

� �mB

ðtmA

A TmA

A cA tA A mA�mBð Þðð

�þB mB�mAð Þ� F�Sð Þ mAþmBð ÞÞþmA r �AþBþF�Sð ÞÞ

�cA mB A�Sð Þt2mAþ1A þcA mB tA B�Fð ÞT2mA

A Þ

�mA A�Fð ÞtmA

A TmA

A r�cA tAð ÞR�CA TA

CB

� �2mB

þcBmA B�Sð ÞtmA

A TmA

A

r�cA tA

cB

� �2mBþ1!,

tA cA tA�rð ÞðtmA

A þTmA

A Þ2 r�cA tA

cB

� �mB

þR�CA TA

CB

� �mB� �2

!¼ 0 ðA1Þ

V.M. Bier, K. Hausken / Reliability Engineering and System Safety 112 (2013) 214–224224

@f

@TA¼

r�cA tA

cB

� �mB R�CA TA

CB

� �mB

tmA

A TmA

A CA TA A mB�mAð Þðð��

þB mA�mBð Þþ F�Sð Þ mAþmBð ÞÞþmA R A�B�FþSð ÞÞ

þCA mB TA A�Sð Þt2mA

A �CA mB B�Fð ÞT2mAþ1A

�

þCB mA A�Fð ÞtmA

A TmA

A

R�CA TA

CB

� �2mB þ1

�mA B�Sð ÞtmA

A TmA

A R�CA TAð Þr�cA tA

cB

� �2mB�,

TA CA TA�Rð Þ tmA

A þTmA

A

� �2 r�cA tA

cB

� �mB

þR�CA TA

CB

� �mB� �2

!¼ 0 ðA2Þ

References

[1] Apostolakis GE, Lemon DM. A screening methodology for the identificationand ranking of infrastructure. Risk Analysis 2005;25:361–76.

[2] Azaiez N, Bier VM. Optimal resource allocation for security in reliabilitysystems. European Journal of Operational Research 2007;181:773–86.

[3] Bell MGH, Kanturska U, Schmocker J-D, Fonzone A. Attacker–defender modelsand road network vulnerability. Philosophical Transactions of the RoyalSociety A 2008;366(1872):1893–906.

[4] Bier VM, Abhichandani V., Optimal allocation of resources for defense ofsimple series and parallel systems from determined adversaries. In:Proceedings of the engineering foundation conference on risk-based decisionmaking in water resources X, 2002, Santa Barbara, CA: American Society of CivilEngineers.

[5] Bier VM, Gratz ER, Haphuriwat NJ, Magua W, Wierzbicki KR. Methodology foridentifying near-optimal interdiction strategies for a power transmissionsystem. Reliability Engineering and System Safety 2007;92:1155–61.

[6] Bier VM, Nagaraj A, Abhichandani V. Protection of simple series and parallelsystems with components of different values. Reliability Engineering andSystem Safety 2005;87:315–23.

[7] Bier VM, Oliveros S, Samuelson L. Choosing what to protect: strategic defenseallocation against an unknown attacker. Journal of Public Economic Theory2007;9:563–87.

[8] Boardman AE, Lave LB. Highway congestion and congestion tolls. Journal ofUrban Economics 1977;4:340–59.

[9] Braess D. Uber ein Paradoxon aus der Verkehrsplanung. Unternehmens-forschung 1969;12:258–68.

[10] Brown G, Carlyle M, Salmeron J, Wood K. Defending critical infrastructure.Interfaces 2006;36:530–44.

[11] Brown G, Carlyle M, Diehl D, Kline J, Wood K. A two-sided optimization fortheater ballistic missile defense. Operations Research 2005;53:745–63.

[13] Church RL, Scaparra MP. Analyzis of facility systems’ reliability when subjectto attack or a natural disaster. In: Murray AT, Grubesic TH, editors. Criticalinfrastructure: reliability and vulnerability. Advances in spatial science.Berlin: Springer; 2007p. 221–42.

[14] Church RL, Scaparra MP. Protecting critical assets: the r-interdiction medianproblem with fortification. Geographical Analyzis 2007;39(2):129–46.

[15] Dighe N, Zhuang J, Bier VM. Secrecy in defensive allocations as a strategy forachieving more cost-effective attacker deterrence. International Journal ofPerformability Engineering 2009;5:31–43 special issue on System Surviva-bility and Defense against External Impacts.

[16] Hausken K. Strategic defense and attack for reliability Systems. ReliabilityEngineering & System Safety 2008;93(11):1740–50.

[17] Hausken K. Protecting complex infrastructures against multiple strategicattackers. International Journal of Systems Science 2011;42(1):11–29.

[18] Hausken K, Levitin G. Minmax defense strategy for complex multi-statesystems. Reliability Engineering and System Safety 2009;94:577–87.

[19] Lanchester FW. 1916. Aircraft in warfare: the dawn of the fourth arm, TiptreeConstable and Co. Ltd.

[20] Lee EE, Mitchell JE, Wallace WA. Restoration of services in interdependentinfrastructure systems: a network flows approach. IEEE Transactions onSystems, Man, and Cybernetics, Part C 2007;37:1303–17.

[21] Levitin G. Optimal defense strategy against intentional attacks. IEEE Transac-tions on Reliability 2007;56:148–56.

[22] Liberatore F, Scaparra MP, Daskin MS. Analyzis of facility protection strate-gies against an uncertain number of attacks: the stochastic R-interdiction

median problem with fortification. Computers and Operations Research2011;38:357–66.

[23] Losada C, Paola M, Church RL. On a bi-level formulation to protect uncapa-citated p-median systems with facility recovery time and frequent disrup-tions. Electronic Notes in Discrete Mathematics 2010;36:591–8.

[24] Michaud D, Apostolakis G. Methodology for ranking the elements ofwater-supply networks. Journal of Infrastructure Systems 2006;12(4):230–42.

[25] Nagurney A, Qiang QA. A network efficiency measure for congested net-works. Europhysics Letters 2007;79(3):1–5, http://dx.doi.org/10.1209/0295-5075/79/38005.

[26] Nagurney A, Qiang QA. Robustness of transportation networks subject todegradable links. Europhysics Letters 2007;80(6):1–6, http://dx.doi.org/10.1209/0295-5075/80/68001.

[27] Patterson S, Apostolakis G. Identification of critical locations across multipleinfrastructures for terrorist actions. Reliability Engineering and System Safety2007;92:1183–203.

[28] Ramirez-Marquez JE, Rocco C, Levitin G. Optimal network protection againstdiverse interdictor strategies. Reliability Engineering & System Safety2011;96(3):374–82.

[29] Ramirez-Marquez JE, Rocco C, Levitin G. Optimal protection of generalsource–sink networks via evolutionary techniques. Reliability Engineeringand System Safety 2009;94(10):1676–84.

[30] Richard L, Church RL, Scaparra MP. Protecting critical assets: the r-Interdictionmedian problem with fortification. Geographical Analyzis 2007;39(2):129–46.

[31] Rocco C, Ramirez-Marquez JE, Salazar D, Zio E. A flow importance measurewith application to an Italian transmission power system. InternationalJournal of Performability Engineering 2010;6(1):53–61.

[32] Salmeron J, Wood K, Baldick R. Analyzis of electric grid security underterrorist threat. IEEE Transactions on Power Systems 2004;19:905–12.

[33] Scaparra MP, Church RL. A Bilevel mixed-integer program for criticalinfrastructure protection planning. Computers and Operations Research2008;35:1905–23.

[34] Scaparra MP, Church RL. An exact solution approach for the interdictionmedian problem with fortification. European Journal of Operational Research2008;189:76–92.

[35] Scaparra MP, Cappanera P., Optimal allocation of protective resources in shortest-path networks. 2010, Working paper, University of Kent Canterbury, Canterbury.

[36] Skaperdas S. Contest success functions. Economic Theory 1996;7:283–90.[37] Small KA, Verhoef ET. Economics of urban transportation. New York:

Routledge; 2007.[38] Small KA, Chu X. Hypercongestion. Journal of Transport Economics and Policy

2003;37:319–52.[39] Snyder LV, Scaparra MP, Daskin MS, Church RL., Planning for disruption in

supply chain networks. In: Johnson MP, Norman B, Secomandi N. Tutorials inoperations research: models, methods, and applications for innovativedecision making. tutorials in operations research, INFORMS, 2006, p. 234–57.

[40] Tullock G. Efficient rent-seeking. In: Buchanan JM, Tollison RD, Tullock G,editors. Toward a theory of the rent-seeking society. College Station: Texas A& M. University Press; 1980;p. 97–112.

[41] Ukkusuri SV, Yushimito WF. A methodology to assess the criticality ofhighway transportation networks. Journal of Transportation Security2009;2:29–46.

[42] Von Neumann J. Zur Theorie der Gesellschaftsspiele. Mathematische Annalen1928;100:295–320.

[43] Von Neumann J, Oskar Morgenstern O. Theory of games and economicbehavior. Third editionPrinceton University Press; 1944 1953.

[44] Wein LM, Atkinson MP. The last line of defense: designing radiationdetection–interdiction systems to protect cities from a nuclear terroristattack. IEEE Transactions on Nuclear Science 2007;54:654–69.

[45] Wood RK. Deterministic network interdiction. Mathematical and ComputerModelling 1993;17:1–18.

[46] Zenklusen R. Network flow interdiction on planar graphs. Discrete AppliedMathematics 2010;158:1441–55.

[47] Zhuang J, Bier VM. Balancing terrorism and natural disasters—defensivestrategy with endogenous attacker effort. Operations Research2007;55:976–91.

[48] Zhuang J, Bier VM. Secrecy and deception at equilibrium, with applications toanti-terrorism resource allocation. Defence and Peace Economics2011;22(1):43–61.

[49] Zhuang J, Bier VM. Reasons for secrecy and deception in homeland-securityresource allocation. Risk Analyzis 2010;30(12):1737–43.

[50] Zhuang J, Bier VM, Alagoz O. Modeling secrecy and deception in a multiple-period attacker–defender signaling game. European Journal of OperationalResearch 2010;203:409–18.