Risk mitigation in resilient networks

Abstract

This article proposes shifting the perspective for the design of resilient networks from cost-focused to one suited for business purposes. Risk engineering is used as a basis to enable us to monetarily express not only the cost of recovery, but also the impact of failures affecting connections (expressed with use of penalties imposed on an operator), and then to find the tradeoff between the cost of the assigned recovery methods and the improved level of resilience. During risk assessment, monetary quantification of penalties is applied with compensation policies, and business relevant risk measures are used. Then, risk response selection is based on various risk mitigation strategies (involving profit maximization, total benefit coverage, cost balance, and risk minimization) proposed in the security risk management. Looking for the cost-risk trade-off related to the assumed mitigation strategy is a complex optimization problem that cannot be modeled with deterministic linear programming. Therefore, to be able to choose recovery options, we develop a genetic algorithm. The results show diversity of recovery procedures selected for various selected mitigation strategies.