Citation

Levine ES. Risk Anal. 2012; 32(2): 294-303.

Copyright

(Copyright © 2012, Society for Risk Analysis, Publisher John Wiley and Sons)

DOI

10.1111/j.1539-6924.2011.01655.x

PMID

21801187

Abstract

Many analyses conducted to inform security decisions depend on estimates of the conditional probabilities of different attack alternatives. These probabilities are difficult to estimate since analysts have limited access to the adversary and limited knowledge of the adversary's utility function, so subject matter experts often provide the estimates through direct elicitation. In this article, we describe a method of using uncertainty in utility function value tradeoffs to model the adversary's decision process and solve for the conditional probabilities of different attacks in closed form. The conditional probabilities are suitable to be used as inputs to probabilistic risk assessments and other decision support techniques. The process we describe is an extension of value-focused thinking and is broadly applicable, including in general business decision making. We demonstrate the use of this technique with simple examples.

Language: en