On Strategic Defense of Stochastic Networks

TL;DR

This paper models the accumulation of cyber attack damages on vital networks using a 2D monotone random walk, providing predictions for critical threshold crossings related to node failures and associated costs.

Contribution

It introduces a stochastic model for network attack impacts, analyzing joint functionals of attack progression and thresholds crossing times.

Findings

Predicts time to critical network failure thresholds.

Provides joint distribution of node failures and costs at threshold crossing.

Offers analytical tools for network defense planning.

Abstract

This paper deals with the detection and prediction of losses due to cyber attacks waged on vital networks. The accumulation of losses to a network during a series of attacks is modeled by a 2-dimensional monotone random walk process as observed by an independent delayed renewal process. The first component of the process is associated with the number of nodes (such as routers or operational sites) incapacitated by successive attacks. Each node has a weight associated with its incapacitation (such as loss of operational capacity or financial cost associated with repair), and the second component models the cumulative weight associated with the nodes lost. Each component has a fixed threshold and crossing of a threshold by either component represents the network entering a critical condition. Results are given as joint functionals of the predicted time of the first observed threshold crossing along with the values of each component upon this time.

Figures

Equations

$$\eta =\mathcal{N}\otimes \mathcal{W}=\sum _{k\ge 1}\left(n_k,w_k\right){\epsilon }_{t_k}$$

$$n_k\text{ nodes are destroyed at time }{t}_k,k=1,2,\dots ,$$

$$w_k=\sum _{j=1}^{n_k}{w}_{jk}\text{ is the nonnegative real weight associated with the nk nodes}$$

$$E\left[z^{\mathcal{N}\left(T\right)}{e}^{-v\mathcal{W}\left(T\right)}\right]=e^{\lambda |T|\left[g\left(zl\left(v\right)\right)-1\right]}\text{, Re}\left(v\right)\ge 0\text{, }|z|\le 1$$

$$\mathcal{T}=\sum _{n=0}^{\infty }{\epsilon }_{{\tau }_n}$$

$${\Delta }_n={\tau }_n-{\tau }_{n-1},n\in \mathbb{N}\text{, be iid and independent of }{\Delta }_0={\tau }_0$$

$$L_0\left(\theta \right)=E\left[e^{-\theta {\Delta }_0}\right]\text{, Re}\left(\theta \right)\ge 0\text{ (the LST of }{\Delta }_0={\tau }_0)$$

$$L\left(\theta \right)=E\left[e^{-\theta {\Delta }_1}\right]\text{, Re}\left(\theta \right)\ge 0\text{ (the common LST of }{\Delta }_n={\tau }_n-{\tau }_{n-1},n\in {\mathbb{Z}}_{>0})$$

$$E\left[z^{\mathcal{N}\left([0,{\tau }_0]\right)}{e}^{-v\mathcal{W}\left([0,{\tau }_0]\right)-\theta {\tau }_0}\right]=L_0\left[\theta +\lambda -\lambda g\left[zl\left(v\right)\right]\right]={\gamma }_0\left(z,v,\theta \right)$$

$$E\left[z^{\mathcal{N}\left(({\tau }_0,{\tau }_1]\right)}{e}^{-v\mathcal{W}\left(({\tau }_0,{\tau }_1]\right)-\theta {\Delta }_1}\right]=L\left[\theta +\lambda -\lambda g\left[zl\left(v\right)\right]\right]=\gamma \left(z,v,\theta \right)$$

$$\mathcal{X}\otimes \mathcal{Y}\otimes \mathcal{T}=\sum _{n=0}^{\infty }\left(X_n,Y_n\right){\epsilon }_{{\tau }_n}$$

$$N_n=\sum _{i=0}^n{X}_i\text{ and }{W}_n=\sum _{i=0}^n{Y}_i.$$

$$\mu :=\inf \left\{n\ge 0:N_n>M\right\}\text{ for a fixed positive integer }M$$

$$\nu :=\inf \left\{n\ge 0:W_n>V\right\}\text{ for a fixed positive real number }V$$

$${\left(\mathcal{X}\otimes \mathcal{Y}\otimes \mathcal{T}\right)}_{\mu }=\sum _{n=0}^{\mu }\left(X_n,Y_n\right){\epsilon }_{{\tau }_n}$$

$$\rho =\min \left\{\mu ,\nu \right\}=\inf \left\{n:\left(N_n,W_n\right)\notin [0,M]\times [0,V]\right\}.$$

$$\Phi$$

$$=\begin{array}{rl}& E\left[{\alpha }_0^{N_{\mu -1}}{\alpha }^{N_{\mu }}{e}^{-{\beta }_0{W}_{\mu -1}-\beta W_{\mu }-h_0{\tau }_{\mu -1}-h{\tau }_{\mu }}{1}_{\left\{\mu <\nu \right\}}\right]\\ & +E\left[{\alpha }_0^{N_{\mu -1}}{\alpha }^{N_{\mu }}{e}^{-{\beta }_0{W}_{\mu -1}-\beta W_{\mu }-h_0{\tau }_{\mu -1}-h{\tau }_{\mu }}{1}_{\left\{\mu =\nu \right\}}\right]\\ & +E\left[{\alpha }_0^{N_{\nu -1}}{\alpha }^{N_{\nu }}{e}^{-{\beta }_0{W}_{\nu -1}-\beta W_{\nu }-h_0{\tau }_{\nu -1}-h{\tau }_{\nu }}{1}_{\left\{\mu >\nu \right\}}\right]\end{array}$$

$$={\Phi }_{\mu <\nu }+{\Phi }_{\mu =\nu }+{\Phi }_{\mu >\nu }$$

$${\text{D}}_{pq}=\mathcal{L}{\mathcal{C}}_q\circ {\mathcal{D}}_p$$

$$\mathcal{L}{\mathcal{C}}_q\left(\cdot \right)\left(y\right)=y{\int }_{q=0}^{\infty }{e}^{-yq}\left(\cdot \right)dq\text{, Re}\left(y\right)>0$$

$$\mathcal{L}{\mathcal{C}}_y^{-1}(\cdot )(q)={\mathcal{L}}_y^{-1}\left(\cdot \frac{1}{y}\right)\left(q\right)$$

$${\mathcal{D}}_p\left(f\right)\left(x\right)=\left(1-x\right)\sum _{p=0}^{\infty }{x}^{p}f\left(p\right),\Vert x\Vert <1$$

$${\mathcal{D}}_x^k\left(\cdot \right)=\underset{x\to 0}{\lim }\frac{1}{k!}\frac{{\partial }^r}{\partial x^r}\left[\frac{1}{1-x}\cdot \right],k\ge 0\text{, and }{\mathcal{D}}_x^k=0\text{, for }k<0.$$

$${\text{D}}_{xy}^{-1}\left(\cdot \right)\left(p,q\right)=\mathcal{L}{\mathcal{C}}_y^{-1}\left({\mathcal{D}}_x^p\left(\cdot \right)\right)\left(q\right).$$

$$\gamma =\gamma \left({\alpha }_0\alpha x,{\beta }_0+\beta +y,h_0+h\right)$$

$${\gamma }_0={\gamma }_0\left({\alpha }_0\alpha x,{\beta }_0+\beta +y,h_0+h\right)$$

$$\Gamma =\gamma \left(\alpha x,\beta +y,h\right)$$

$${\Gamma }_0={\gamma }_0\left(\alpha x,\beta +y,h\right)$$

$${\Gamma }^1=\gamma \left(\alpha ,\beta +y,h\right)$$

$${\Gamma }_0^1={\gamma }_0\left(\alpha ,\beta +y,h\right)$$

$${\Phi }_{\mu <\nu }=D_{xy}^{-1}\left({\Gamma }_0^1-{\Gamma }_0+\frac{{\gamma }_0}{1-\gamma }\left({\Gamma }^1-\Gamma \right)\right)\left(M,V\right)$$

$$\mu \left(p\right)=\inf \left\{j:N_j>p\right\}$$

$$\nu \left(q\right)=\inf \left\{k:W_k>q\right\}$$

Full text

Keywords: Stochastic networks, fluctuation theory, marked point processes, Poisson process, ruin time, exit time, first passage time, prediction, sums of independent random variables, random walks, renewal theory, communication networks, network models.

AMS Subject Classification: 60G50, 60G51, 60G52, 60G55, 60G57, 60K05, 60K35, 60K40, 60G25, 90B18, 90B10, 90B15, 90B25.

Department of Mathematical Sciences

College of Science

Florida Institute of Technology

Melbourne, Florida 32901, USA

1 Introduction

Background Information. Complex large-scale networks form an integral part of our defense system and infrastructure: e.g. wireless communication networks, the Internet, multifunctional sensor networks, large-scale computer networks, and electrical grids. They play crucial roles in military and civilian installations and in biological research. A network can be regarded as a graph with nodes representing individual sensors, computers or servers, and so on, and edges connecting individual nodes. Such nodes are subject to failures of various origins, such as natural disasters, hostile attacks (e.g. cyber attacks), and benign hardware failures. Hostile attacks are prevalent instances of network disruptions and they are a growing threat to national security.

In the past decade, we have observed intense cyber attacks, some of which have hindered proper operation of the computer networks of banks, private corporations, government facilities, and even vital infrastructure. In each situation, conventional security measures were unable to prevent such significant failures of security and the associated financial costs. Thus, it stands to reason to offer unconventional tools that may minimize the damage to networks. One of the common measures is to disconnect the intact portion of a network from the rest of it before incurring critical damage, but how does one recognize the threat and manage the network once an attack begins? In this article we lay out a foundation for predicting the time and caliber of potentially destructive damage to a network by means of statistics and operational calculus.

Once an attack is launched, we seek to determine how much damage it will potentially cause and the time until a specified critical amount of damage is incurred. We model processes of attacks and cumulative losses of nodes and weights to predict both the time and size of critical damage. Further, we embellish the basic model by adding an auxiliary robustness threshold and analyze the fluctuation of the process about this intermediate threshold prior to entering a critical stage, which yields a more refined analysis of the nature of the accumulation of damage. This allows one to rank various risks to the network by considering the time between threshold crossings, which may, for example, be applied to early detection of hostile attacks and differentiation between attacks and benign hardware failures. Values of the thresholds can be determined heuristically, through optimization, or monitored upon the observation of incoming damage.

Modeling Networks. As mentioned, networks can be modeled by graphs, and particularly weighted graphs, in which each edge or node is associated with a weight representing, for example, cost, bandwidth, distance, strength of social ties, energy, gravitational force, liquidity in financial networks, or probabilities. Random graphs are also commonly used, e.g. classical Erdös-R\a‘enyi random graphs consist of $n$ vertices with $M$ edges chosen uniformly at random from all possible adjacencies, but we instead consider graphs with random node weights whose original structure can further be randomly altered.

It is often thought that cyber attacks spread from one node to another along the graph as a branching process, but this is an incomplete picture for several reasons. Firstly, attacks often have multiple simultaneous targets (e.g. machines linked to a targeted router or servers housing virtualized machines) or victims quarantine groups of machines in response to attack detection, both of which result in batch losses. Further, the viral aspect of cyber attacks is significantly mitigated by firewalls, and viral attacks that do elude firewalls tend to practically immediately infect subnetworks (due to the structure of highly interconnected clusters that characterizes large-scale networks). Lastly, some of the most prevalent attacks are not necessarily viral at all (e.g. distributed denial-of-service attacks).

Incoming damage to a network is subject to a complex process. An attack disables successive nodes and edges, effectively removing a subgraph with a random number of nodes with random associated weights (due to both the value of incident edges and intrinsic node value). Furthermore, such a network under attack is observed at potentially random epochs of time, as the losses become apparent. The spread of the damage is one of the most distinctive elements of a hostile action, so we predict its caliber using methods of stochastic analysis.

Related Literature. Combating cyber crime involves various mathematical modeling and methods, as well as those of non-mathematical nature (such as prevention, physical and electronic defense mechanisms, and intelligence, which do not pertain to our article). Thus, we mention a few areas of current research on this topic and some literature known to the authors. Random and deterministic graph theory is probably the most common area for studying networking [2, 3, 5, 10-15, 19, 23-27, 30-32] although just a few [5, 23, 24] focused on potential cyber crime. Random walk and fluctuation analysis is an important hybrid in tools and modeling of interest, although the authors [1, 6-9, 17-18, 28] did not have cyber crime in mind. There are also theoretical aspects of fluctuation analysis and applications to finance, physics, and other sciences that relate to the topic [2, 6, 16, 20, 28, 29].

The Layout of the Paper. In Section 2, we begin with a model of a process where attacks occur according to a marked point process in time, with two-dimensional marks representing the cumulative nodes and weight lost up to time $t$ under delayed observation upon random time epochs. We derive a joint functional of each component as the process (node loss, weight loss, and time) at the first observed exit from $[0,M]\times[0,V]$ and at one observation prior.

In Section 3, we extend the model to include an auxiliary robustness threshold for the node loss component, $M_{1}<M$. We derive a joint functional of the components of the process at both the first observed exit of the node component from $[0,M_{1}]$, the observed exit of the process from $[0,M]\times[0,V]$, and one observation prior to each for the “confined” process, under the restriction that the first observed $M_{1}$ crossing precedes the major crossing.

The key technique in preserving the wide generality of our results in Sections 2 and 3 is to derive them under a composition of a number of operators of two types: the Laplace-Carson transform and so-called D-operator, the latter of which is introduced in some past work of one of the co-authors. Yet the flexibility and tractability of the inverses of these operators allows the reduction of the general formulas to fully explicit formulas for practical cases. We demonstrate this in Sections 4 and 5, where we will derive closed-form, explicit formulas for two sets of realistic probabilistic assumptions. Among other things, we derive explicit probabilistic results, including joint transforms of the process upon the $M_{1}$ and major crossings, which yield marginal transforms of each component at each observed crossing time and the time between the two observed crossings.

2 A Basic Model

Consider an infinite weighted graph in which weights are associated with nodes rather than edges. In reality there are not infinite graphs, but this assumption appropriately models large-scale networks. During a series of attacks, successive batches of nodes are incapacitated upon random time increments. Associated with each node is a random weight representing its value to the health of the network. We suppose the network enters a critical state wherein it may become dysfunctional if the number of nodes incapacitated by hostile attacks exceeds a fixed integer threshold $M$ or the magnitude of weights associated with the compromised nodes exceeds a fixed real threshold $W$. We proceed with more formalism of the model.

Let $\left(\Omega,\mathcal{F}\left(\Omega\right),P\right)$ be a probability space and let

[TABLE]

where $\varepsilon_{a}$ is a Dirac point measure, be a marked Poisson random measure on this probability space describing the evolution of damage taken to a network, where

[TABLE]

and the underlying support counting measure $\sum^{\infty}_{k=1}\varepsilon_{t_{k}}$ is Poisson of rate $\lambda$ directed by $\lambda\left|\boldsymbol{\cdot}\right|$, where $\left|\boldsymbol{\cdot}\right|$ is the Borel-Lebesgue measure on $\mathcal{B}\left(\mathbb{R}_{+}\right)$.

We assume that $n_{k}$’s are iid (and independent of $w_{jk}$’s) with common marginal PGF (probability-generating function) $g\left(z\right)$, and $w_{jk}$’s are iid with common LST (Laplace-Stieltjes transform) $l\left(u\right)$ for $j,k\in\mathbb{N}$.

By straightforward probability arguments we obtain the following representation for $\eta$ in terms of its dependent components $\mathcal{N}$ and $\mathcal{W}$:

[TABLE]

where $T$ is a Borel subset of $\mathbb{R}_{+}$ and $\left|T\right|$ denotes the Borel-Lebesgue measure of set $T$.

Now, suppose $\eta$ is observed by a delayed renewal process

[TABLE]

and let

[TABLE]

such that

[TABLE]

[TABLE]

Then, by Lemma A.1 (Appendix) and (2.2),

[TABLE]

[TABLE]

are the functionals describing the total number of lost nodes and their associated weights observed within time intervals $\left[0,\tau_{0}\right]$ and $(\tau_{0},\tau_{1}]$, respectively. Since the increments are iid, the second corresponds to any $(\tau_{n-1},\tau_{n}]$.

Now, introduce a generic marked delayed renewal process

[TABLE]

with mutually dependent components

[TABLE]

whose relationship to the network will be explained later. Denote

[TABLE]

Introduce the random indices

[TABLE]

[TABLE]

called the exit indices.

We would say that the component $\mathcal{X}$ is terminated at time $\tau_{\mu},$and component $\mathcal{Y}$ is terminated at time $\tau_{\nu}$ if $\mathcal{X}$ and $\mathcal{Y}$ acted alone, but we seek the first time either component terminates. If the original marked Poisson process $\eta$ is observed by a delayed renewal process $\mathcal{T}$, then the embedded process will exhibit (mutually dependent) increments $X_{n}$ and $Y_{n}$ as the marks in the process $\mathcal{X}\otimes\mathcal{Y}\otimes\mathcal{T}$. Such an observed process is regarded as “terminated” at time min$\left\{\tau_{\mu},\tau_{\nu}\right\}$, the first observed passage time, which represents delayed information regarding the actual real-time crossing which occurred earlier.

First, we consider the confined process on trace $\sigma$-algebra $\mathcal{F}\left(\Omega\right)\cap\left\{\mu<\nu\right\}$, i.e. the process with component $\mathcal{X}$ being terminated first, and thus the first observed passage time $\tau_{\mu}$ will be the exit time by the confined process. Equation (2.2.9) will be modified as

[TABLE]

which gives a more precise definition of the process observed until $\tau_{\mu}$. We do the same for the confined processes on $\mathcal{F}(\Omega)\cap\{\mu=\nu\}$ and $\mathcal{F}(\Omega)\cap\{\mu>\nu\}$.

Then, we define the first observed passage index,

[TABLE]

Throughout the rest of this section, we consider various marginal and semi-marginal variants of the joint functional

[TABLE]

of the observed process upon the first observed passage time $\tau_{\min\left\{\mu,\nu\right\}}$ and pre-observed passage time $\tau_{\min\left\{\mu,\nu\right\}-1}.\,$The latter is of particular interest due to the crudeness of the observed process.

The following transforms will be vital in the derivation of explicit results in the upcoming sections. Denote

[TABLE]

Here $\mathcal{L}\mathcal{C}_{q}$ is the Laplace-Carson transform:

[TABLE]

with the inverse

[TABLE]

where $\mathcal{L}_{y}^{-1}$ is the inverse of the Laplace transform.

The operator $\mathcal{D}_{p}$ is defined as

[TABLE]

where $\left\{f\left(p\right)\right\}$ is a sequence, with the inverse

[TABLE]

such that $\mathcal{D}_{x}^{k}(\mathcal{D}_{p}\{f(p)\})=f(k)$. Then, the full inverse operator is

[TABLE]

The upcoming results for the joint transforms from (2) will be derived under the inverse of composed operator Dpq. The utility of D${}^{-1}_{xy}$ is at the heart of the derivation of joint and marginal transforms, which can yield results such as moments and distributions, of the components of process $\left(\mathcal{X}\otimes\mathcal{Y}\otimes\mathcal{T}\right)_{\mu}$ upon threshold crossings in a fully explicit form.

The below Theorem 2.1 establishes an analytically tractable formula for $\varPhi_{\mu<\nu}.\,$With (2.7)-(2.8), we abbreviate

[TABLE]

Theorem 2.1**.**

In light of abbreviations (2.22)-(2.27), the functional $\varPhi_{\mu<\nu}$ of the process on the trace $\sigma$-algebra $\mathcal{F}\left(\Omega\right)\cap\left\{\mu<\nu\right\}$ satisfies the following formula:

[TABLE]

where D${}^{-1}_{xy}$ is the inverse of operator D introduced in (2.16).

Proof.

Introduce the families of indices

[TABLE]

[TABLE]

and

[TABLE]

In particular, we have

[TABLE]

Application of Dpq to $\varPhi_{\mu\left(p\right)\nu\left(q\right)}$ will bypass all terms except 1*{μ(p)<ν(q)}. Thus, after applying the operator Dpq* to random family $\left\{\boldsymbol{1}_{\{\mu\left(p\right)=j,\nu\left(q\right)=k\}}:p\geq 0,q\geq 0\right\}$ we arrive at

[TABLE]

We first notice that

[TABLE]

Then, we have

[TABLE]

which yields (2.33). Denote

[TABLE]

Since

[TABLE]

by Fubini’s Theorem and (2.37), we have

[TABLE]

where

[TABLE]

[TABLE]

We observe that the marginal distribution of $Y_{i}$’s for $i>\mu\,(=j)$ can be different from $Y_{1},\ldots,Y_{\mu},$ because after a number of nodes in excess of $M$ are purged at $\tau_{\mu}$, the forthcoming events (such as further damage to the network leading to a sure excess of weight above $V$ are so far limited to those on the sub-$\sigma$-algebra $\mathcal{F}(\Omega)\cap\left\{\mu<\nu\right\}$). The corresponding marginal transform of those $Y_{i}$’s can differ from $\gamma$ in the next two equations. However, this will not alter the result of the summation of $R_{3jk}R_{4k}$, as we will see. Without loss of generality we omit the corresponding formalism thus having

[TABLE]

At this moment, we will suspend the proof to derive and state some results necessary to the completion of the proof of Theorem 2.1.

Theorem 2.2**.**

The norm

[TABLE]

if

[TABLE]

where any two of the inequalities can be weakened to $\geq$.

Proof.

Consider

[TABLE]

From (2.44)

[TABLE]

where $c=P\left\{\Delta_{1}\leq 1\right\}$. If

[TABLE]

then $\left\|L\left(\vartheta\right)\right\|<1$, so Re$\left(\vartheta\right)>0$ is sufficient for $\left\|L\left(\vartheta\right)\right\|<1$. Also, for $\vartheta=\theta+\lambda-\lambda g\left[zl\left(v\right)\right]$, we have

[TABLE]

Inequality (2.47) holds if each of the two factors in (2.48) is less than one, or in the weaker form, one of the factors equal to one and one is strictly less than one. Let us assume that each factor is less than one. Then, we have Re$\left(\theta\right)>0$ and Re$\left(g\left(zl\left(v\right)\right)\right)<1$.

Since Re$\left(g\left(zl\left(v\right)\right)\right)\leq\left\|g\left(zl\left(v\right)\right)\right\|$, by imposing $\left\|g\left(zl\left(v\right)\right)\right\|<1$ we ensure that Re$\left(g\left(zl\left(v\right)\right)\right)<1$, which is true by the Schwarz lemma below if $\left\|zl\left(v\right)\right\|<1$, as follows. ∎

Theorem 2.3** (Schwarz Lemma).**

Let $g\left(z\right)$ be an analytic function inside the unit ball $B\left(0,1\right)$ and satisfies the condition $\left\|g\left(z\right)\right\|\leq 1$ and $g\left(0\right)=0$. Then $\left\|g\left(z\right)\right\|\leq\left\|z\right\|$ and $\left\|g^{\prime}\left(0\right)\right\|\leq 1$. If $\left\|f\left(z\right)\right\|=\left\|z\right\|$ for some $z\neq 0,$ then $f\left(z\right)=cz,$where $c$ is a complex-valued constant of modulus $1$.

Indeed, by the Schwarz lemma whose conditions are obviously met with $g\left(0\right)=0$, $\|g\left(zl\left(v\right)\right)\|\leq\|zl\left(v\right)\|$, and hence $\left\|g\left(zl\left(v\right)\right)\right\|<1$ if $\left\|zl\left(v\right)\right\|<1$ holds. We first show that $\left\|l\left(v\right)\right\|<1$ under the condition that Re$\left(v\right)>0$.

Proceeding with $\left\|l\left(v\right)\right\|$ exactly as with $L\left(\vartheta\right)$ we impose Re$\left(v\right)>0$ in order to have $\left\|l\left(v\right)\right\|<1$. Finally, $\left\|z\right\|\leq 1$ is the common domain for a pgf like $g\left(z\right)$. Imposing $\left\|z\right\|<1$ we can relax Re$\left(l\left(v\right)\right)$ to be $\geq 0$ or Re$\left(\theta\right)\geq 0$. ∎

Notice that upon application of operator Dpq of (2.15), the output variables must be restricted to $\left\|\cdot\right\|<1$. Therefore, with Re$\left(\theta\right)\geq 0$, we have convergence. Also observe that Theorem 2.2 can be applied to the norm of $\gamma_{0}$ of (2.7) under minor modifications.

Now we continue with the proof of Theorem 2.1. Summing up $\,\sum_{k>j}R_{3jk}R_{4k}\,$yields 1 (with $||\gamma\left(1,y,0\right)||<1$, under a minor sufficient condition given in Theorems 2.2 and 2.3). $\sum_{j\geq 0}R_{1j}R_{2j}$ converges by the same argument, yielding

[TABLE]

Applying the inverse operator D${}_{xy}^{-1}$ of (2.21) to $\varPsi\left(x,y\right)$ yields the statement of Theorem 2.1. ∎

Proceeding as in Theorem 2.1, we can find the functionals $\varPhi_{\mu=\nu}$ and $\varPhi_{\mu>\nu}$, using some additional notation:

[TABLE]

Proposition 2.4**.**

In light of abbreviations (2.22)-(2.27) and (2.50)-(2.53), the functional $\varPhi_{\mu=\nu}$ of the process on the trace $\sigma$-algebra $\mathcal{F}\left(\Omega\right)\cap\left\{\mu=\nu\right\}$ satisfies the following formula:

[TABLE]

Proposition 2.5**.**

In light of abbreviations (2.22)-(2.27) and (2.50)-(2.53), the functional $\varPhi_{\mu>\nu}$ of the process on the trace $\sigma$-algebra $\mathcal{F}\left(\Omega\right)\cap\left\{\mu>\nu\right\}$ satisfies the following formula:

[TABLE]

By the linearity of the inverse operator and expectation, the previous 3 results yield the functional of the process no longer confined to a particular ordering of the exit indices:

Corollary 2.6**.**

In light of abbreviations (2.22)-(2.27) and (2.50)-(2.53)), the functional $\varPhi$ of the process on the $\sigma$-algebra $\mathcal{F}\left(\Omega\right)$ satisfies the following formula:

[TABLE]

Note that the basic model in this section, in a much more rudimentary form was proposed and studied in Dshalalow [7] and further in Dshalalow and Liew [9].

3 An Auxiliary Threshold for the Discrete Component

Preliminaries. In this section we will analyze the process introduced in Section 2 more scrupulously. We will add an intermediate control level $M_{1}<M$ and incorporate it into the  functional $\varPhi_{\mu<\nu}\,$of (2.26). The information associated with the $M_{1}$-threshold will become more conclusive on what leads to critical threshold crossings of the network. The idea of an auxiliary threshold stems from Dshalalow and Ke [8] applied there to stochastic games, with different utility and development compared to the present paper.

We define the corresponding exit indices

[TABLE]

A realization of process $\mathcal{X}\otimes\mathcal{Y}\otimes\mathcal{T}$ (of losses defined in (2.9)) in Figure 1 illustrates how it operates with respect to the introduced main and auxiliary thresholds. We can regard $\mathcal{X}\otimes\mathcal{Y}\otimes\mathcal{T}$ as a two-dimensional random walk on a random grid (rather than traditional lattice). We have a rectangular region formed of rectangular sectors in white, green, and red colors. In real-time a “particle” tries to escape the white-green area at the first opportune time when the cumulative loss of nodes exceeds $M$ or the cumulative weight loss exceeds $V$, whichever comes first. It leaves a polygonal path in blue and a cruder, observed, path ingreen. The particle enters the green area indicating that a lower threshold $M_{1}$ is crossed, while neither $M$ nor $V$ was. In reality, the green area can be empty with a positive probability.

In the figure, the underlying real-time process (the blue dots) represents the real-time incoming damages, which are observed only upon $\tau_{k}$’s (depicted by the green dots), where the $M_{1}$-observed-crossing occurs before the first observed passage time (FOPT) of $M$ or $V$ (i.e. there is an observation in the green area), at which the components of the process may or may not coincide with their values at the real-time FPT.

Here, the operator we will use contains an additional discrete transform $\mathcal{D}_{q}$ corresponding to the $M_{1}$ threshold.

[TABLE]

where $\left|x\right|<1,\left|y\right|<1,$Re$\left(w\right)>0$, i.e. D${}_{pqs}=\mathcal{L}\mathcal{C}_{s}\circ\mathcal{D}_{q}\circ\mathcal{D}_{p}$. Analogous to the operator in Section 2, D${}_{xyw}^{-1}$ denotes the inverse of Dxyw.

The following result seems surprising. Unlike Section 2, with independent thresholds $p$ and $q$ for two active components, now we have two of the three thresholds dependent (since $M_{1}<M$) and yet the below lemma asserts that the application of operator Dpqs to the analogous indicator produces the same result as the case with no relationship between variable levels $p$ and $q$ (representing $M_{1}$ and $M$, respectively). This is a critical asset for our strategy of obtaining closed-form functionals.

Lemma 3.1** ($M_{1}$-Level Insensitivity).**

[TABLE]

Proof.

Let

[TABLE]

We have

[TABLE]

Applying operator (3.4)) we have

[TABLE]

which readily yields the statement of the lemma. ∎

The extended functional,

[TABLE]

carries refined information about the cumulative damage upon crossing $M_{1}$, as well as upon the other reference times. Theorem 3.2 below will establish an explicit formula for $\Phi_{\mu_{1}<\mu<\nu}$.

Having (2.7)-(2.8) in mind and replacing the abbreviations of Section 2, we denote

[TABLE]

Theorem 3.2**.**

The functional $\varPhi_{\mu_{1}<\mu<\nu}$ of the of the network damage on the trace $\sigma$-algebra $\mathcal{F}\left(\Omega\right)\cap\left\{\mu_{1}<\mu<\nu\right\}$ satisfies the following formula under notation (3.10)-(3.20):

[TABLE]

Proof.

As in the proof of Theorem 2.1, we will apply an analog of the LCD operator (3.4) to

[TABLE]

∎

The functional $\varPhi_{\mu_{1}<\mu<\nu}$ becomes

[TABLE]

with

[TABLE]

We first arrive at

[TABLE]

as per Lemma 3.1. Denote

[TABLE]

Analogous to the proof in Theorem 2.1, we have

[TABLE]

where

[TABLE]

[TABLE]

[TABLE]

[TABLE]

[TABLE]

Using Theorem 2.2, $\sum\limits_{n>k}R_{5kn}=1$. The other summations converge similarly, so

[TABLE]

The assertion of the theorem follows upon application of operator D${}_{xyw}^{-1}\,$to (3.32). ∎

The Complete Auxiliary Functional. The formula proved in Theorem 3.2 is itself useful. However, we are further interested in information on the process restricted to the case where the first observed crossing of $M_{1}$ precedes the first observed crossing of $M$ or $V$, whichever comes first: i.e. a functional restricted to $\left\{\mu_{1}<\min\left\{\mu,\nu\right\}\right\}$:

[TABLE]

We derived the first functional in Theorem 3.2, and we find the others in the following two results whose proofs are analogous to Theorem 3.2.

Proposition 3.3**.**

The functional $\varPhi_{\mu_{1}<\mu=\nu}$ of the of the network damage on the trace $\sigma$-algebra $\mathcal{F}\left(\Omega\right)\cap\left\{\mu_{1}<\mu=\nu\right\}\,$satisfies the following formula  under notation (3.10)-(3.20):

[TABLE]

Proposition 3.4**.**

The functional $\,\varPhi_{\mu_{1}<\nu<\mu}$ of the of the network damage on the trace $\sigma$-algebra $\mathcal{F}\left(\Omega\right)\cap\left\{\mu_{1}<\nu<\mu\right\}$ satisfies the following formula under notation (3.10)-(3.20):

[TABLE]

Combining results 3.2-3.4, by linearity we can add them for the general functional.

Theorem 3.5**.**

The functional $\varPhi_{\mu_{1}<\min\left\{\mu,\nu\right\}}$ of the of the network damage on the trace $\sigma$-algebra $\mathcal{F}\left(\Omega\right)\cap\left\{\mu_{1}<\min\left\{\mu,\nu\right\}\right\}$ satisfies the following formula under (3.10)-(3.20):

[TABLE]

In the next two sections, we will demonstrate analytical and numerical tractability of results derived by this approach by carrying out the inverse operators for several practical special cases. We begin with Model 1 in which the status of the network is updated upon a deterministic process, which is a reasonable assumption for many practical cases where periodic measurements are taken, as opposed to Model 2 of Section 5 in which the information about the network is collected upon random times in accordance with a specified Poisson point process (thus, with exponentially distributed inter-observation times). These two cases together represent most common types of statistical data collection.

There are other differences between the two models. In Model 1 (with “constant observations”) we assume that the number of nodes stricken in a single attack is limited by a finite number $R$, with no further restriction upon its distribution. The associated weight of a stricken node is assumed to be gamma distributed. In Model 2 (with “exponential observations”), the number of nodes stricken in one attack is geometrically distributed, whereas the weight associated with each node is exponentially distributed. It seems as though the assumptions made in Model 1 are more challenging than those in Model 2, although they are rather different.

4 Model 1. Constant Observations

In this section, we will present fully explicit probabilistic results for a special case of the process with the $M_{1}$-auxiliary threshold (Model 1), under the following assumptions.

As previously, the attack times $\left\{t_{1},t_{2},...\right\}$ form a Poisson point process of rate $\lambda$. 2. 2.

Inter-observation times are constant, that is, $\Delta_{k}=\tau_{k}-\tau_{k-1}=c$ a.s., $L\left(z\right)=e^{-zc}$. 3. 3.

Nodes lost per strike have an arbitrary finite discrete distribution, i.e.

$P\{n_{k}=j\}=p_{j},\,j=1,...,R$, $g\left(z\right)=\sum\limits_{s=1}^{R}p_{s}z^{s}$,  with $\boldsymbol{p}=\left(p_{1},...,p_{R}\right)$. 4. 4.

Weight per node $w_{jk}\in\left[\text{Gamma}\left(\alpha,\xi\right)\right]$, $l\left(z\right)=\left(\frac{\xi}{z+\xi}\right)^{\alpha}$. 5. 5.

The initial functional $\gamma_{0}=1$ (i.e. zero initial damage).

We note that deterministic observations always present a more challenging case in the context of a stochastic system than random observations. Furthermore, we restrict the total number of nodes destroyed in a single strike by a finite number $R$, which of course can be made arbitrarily large, thereby imposing literally no restriction on the distribution of perished nodes. The general gamma distribution of weight of a single node is also very general. Yet, as we will see, the main indicator of the network status will be established in a closed form functional.

To find marginal transforms we use the $\gamma$-functional of the increment of the process upon observations (as per Lemma A.1),

[TABLE]

By Theorem 3.5 and due to Assumption 5,

[TABLE]

Furthermore,

Theorem 4.1**.**

Under Assumptions 1-5, the joint transform of the number of lost nodes, their cumulative weight, and the first passage time of the crossing of $M_{1}$ preceding the first crossing of $M$ or $V$ $($i.e. on the trace $\sigma$-algebra $\mathcal{F}\left(\Omega\right)\cap\left\{\mu_{1}<\min\left\{\mu,\nu\right\}\right\})$ satisfies the following formula:

[TABLE]

where

[TABLE]

[TABLE]

[TABLE]

[TABLE]

[TABLE]

[TABLE]

Proof.

By (4.2),

[TABLE]

where

[TABLE]

Re$\left(c\theta_{xy}\right)>0$, so $\left|e^{-c\theta_{xy}}\right|<1$, so we can find

[TABLE]

By the multinomial theorem,

[TABLE]

where $C_{jk}\left(\boldsymbol{p}\right)=\sum\limits_{\begin{subarray}{c}\left\|\beta\right\|_{1}=j\\ \left[R\right]\cdot\boldsymbol{\beta}=k+j\end{subarray}}\binom{j}{\beta_{1}\,\cdots\,\beta_{R}}p_{1}^{\beta_{1}}\cdots p_{R}^{\beta_{R}}$

Returning to (4.8),

[TABLE]

where $A_{k}\left(\theta\right)=\frac{\left(c\lambda\right)^{k}}{k!}\sum\limits_{i\geq 0}i^{k}e^{-c\left(\theta+\lambda\right)i}$.

[TABLE]

For convenience, we denote this

[TABLE]

Note that

[TABLE]

Combining (4.12)-(4.13), we find

[TABLE]

Applying $\mathcal{D}^{M_{1}-1}_{x}$ to (4) and using properties (i, iv) of the inverse operator given in Appendix B, we get

[TABLE]

Applying$\mathcal{D}^{M-1}_{y}$ to (4.15) with properties (i, iii, iv), we have (showing only main transitions),

[TABLE]

Next, applying $\mathcal{L}_{w}^{-1}\left(\frac{1}{w}\cdot\right)\left(V\right)$ to (4.16),

[TABLE]

Returning to (4.9), we apply the same procedure to $B$,

[TABLE]

Applying $\mathcal{D}^{M_{1}-1}_{x}$ and $\mathcal{D}^{M-1}_{y}$ to (4), we get

[TABLE]

Applying $\mathcal{L}_{w}^{-1}\left(\frac{1}{w}\cdot\right)\left(V\right)$ to (4.19) yields

[TABLE]

Subtracting (4.20) from (4.17) yields the desired result. ∎

Remark 4.2**.**

Through simulation of the process, we were able to produce some verification of the results via numerical examples. For two sets of parameters of the process with $R=3$ $\left(\lambda,[p_{1},p_{2},p_{3}],[\alpha,\xi],c,M_{1},M,V\right)$, we generated 100 realizations of the process for each of a range of $M_{1}$ values and calculated the empirical probabilities $P\left\{\mu_{1}<\min\left\{\mu,\nu\right\}\right\}$ for each:

5 Model 2. Exponential Observations

In this section, we will offer fully explicit formulas for another special case of the process with the $M_{1}$-auxiliary threshold (Model 2), under the following assumptions.

The attack times $\left\{t_{1},t_{2},...\right\}$ form a Poisson point process of rate $\lambda$ 2. 2.

Inter-observation times $\Delta_{k}=\tau_{k}-\tau_{k-1}\in\left[\text{Exponential(}\mu\text{)}\right]$, so $L\left(z\right)=\frac{\mu}{\mu+z}$. 3. 3.

Nodes losses per strike $n_{k}\in\left[\text{Geometric(}a\text{)}\right]\,$(with $b=1-a$), so $g\left(z\right)=\frac{az}{1-bz}$ 4. 4.

Weight lost per node $w_{jk}\in\left[\text{Exponential(}\xi\text{)}\right]$, so $l\left(z\right)=\frac{\xi}{\xi+z}$ 5. 5.

The initial functional $\gamma_{0}=1$ (i.e. zero initial damage)

Using these, we find explicit marginal transforms. As in Section 4, we use the functional of the increment of the process upon observations (as shown in Lemma A.1),

[TABLE]

By Theorem 3.5 and Assumption 5,

[TABLE]

5.1 The Joint Transform upon $\boldsymbol{\tau}_{\boldsymbol{\mu}_{\boldsymbol{1}}}$

We will find the joint transform of the process upon the observed $M_{1}$-crossing and deduce some useful results from it, i.e.

[TABLE]

We introduce some notation convenient for the forthcoming results

[TABLE]

[TABLE]

[TABLE]

We will also use the convention $\sum\limits_{j=0}^{-1}=1$.

Proposition 5.1**.**

Under Assumptions 1-5 and notation (5.4)-(5.6), for $M_{1}>M_{1}+1$,

[TABLE]

For $M=M_{1}+1$,

[TABLE]

Proof.

By (5.2),

[TABLE]

After inputting parameters and using (5.4)-(5.6), we have

[TABLE]

where

[TABLE]

Then $\mathcal{D}_{x}^{M_{1}-1}\left(\frac{\mu}{\mu+\theta_{y}}\frac{\theta_{xy}-\theta_{y}}{\theta_{xy}}\right)=\frac{\mu}{\mu+\theta_{y}}\mathcal{D}_{x}^{M_{1}-1}\left(\frac{\theta_{xy}-\theta_{y}}{\theta_{xy}}\right)$, where

[TABLE]

For convenience, denote $c=c\left(\theta\right),\,d=d\left(\theta\right)$. Now we apply $\mathcal{D}_{x}^{M_{1}-1}$ to (5.11), using properties (i, iii, v) from Appendix B, and retain the multiplier to the left, resulting in

[TABLE]

Next, we need to apply $\mathcal{D}_{y}^{M-1}$ to (5.12), so we first expand the $\frac{\mu}{\mu+\theta_{y}}$ term,

[TABLE]

This allows us to apply $\mathcal{D}_{y}^{M-1}$ to (5.12), via properties (i, iii, iv) of the inverse operator given in Appendix B:

[TABLE]

Next, we need to apply $\mathcal{L}\mathcal{C}_{w}^{-1}\left(\cdot\right)\left(V\right)$ to the results of (5.13)-(5.14), for $M>M_{1}+1$:

[TABLE]

A more convenient form is as follows:

[TABLE]

Next, we will apply $\mathcal{L}\mathcal{C}^{-1}_{w}\left(\cdot\right)=\mathcal{L}^{-1}_{w}\left(\frac{1}{w}\cdot\right)$ to both $A$ and $B$. By partial fractions,

[TABLE]

[TABLE]

The inverse transform of $B$ is similar, where $M_{1}\,$is replaced by $M$. Combining this inverse with (5.16) yields the statement of the theorem for $M>M_{1}+1$.

For $M=M_{1}+1$, the inverse Laplace-Carson transform reduces to

$\mathcal{L}\mathcal{C}_{w}^{-1}\left(l^{M_{1}}\right)\left(V\right)=\mathcal{L}^{-1}_{w}\left(\frac{\xi^{M_{1}-1}}{w\left(w+v+\xi\right)^{M_{1}-1}}\right)\left(V\right)=\left(\frac{\xi}{v+\xi}\right)^{M_{1}-1}\left[1-k_{M_{1}-2}\left(v\right)\right]$ ∎

The first fact we deduce from the joint transform above is the probability that the observed $M_{1}$ crossing occurs before crossing of an observed $M$ or $V$.

Corollary 5.2**.**

Under Assumptions 1-5 and notation (5.4)-(5.6) for $M>M_{1}+1$,

[TABLE]

Remark 5.3**.**

Through simulation of the process, we were able to produce some verification of the results via numerical examples. For two sets of parameters of the process $\left(\lambda,a,\xi,\mu,M_{1},M,V\right)$, we generated 100 realizations of the process for each of a range of $M_{1}$ values and calculated the empirical probabilities of $P\left\{\mu_{1}<\min\left\{\mu,\nu\right\}\right\}$ for each:

5.2 Marginal Transforms upon $\boldsymbol{\tau}_{\boldsymbol{\mu}_{\boldsymbol{1}}}$

In this subsection, we present the joint transform and marginal transforms of each component of the process upon the (intermediate) control level $M_{1}$ crossing. These follow trivially from the joint functional of the previous subsection by adjusting the values of $u,\,v,\,$and $\theta$.

Corollary 5.4**.**

Under Assumptions 1-5 and notation (5.4)-(5.6) for $M>M_{1}+1$,

[TABLE]

Corollary 5.5**.**

Under Assumptions 1-5 and notation (5.4)(5.6), for $M>M_{1}+1$,

[TABLE]

Corollary 5.6**.**

Under Assumptions 1-5 and notation (5.4)-(5.6), for $M>M_{1}+1$,

[TABLE]

5.3 The Joint Transform upon $\boldsymbol{\tau}_{\min\left\{\boldsymbol{\mu,\nu}\right\}}$

In this subsection, we will find the joint transform of the process upon the first observed crossing of $M$ or $V$. By (5.2), the desired transform is

[TABLE]

We will use the following additional notation,

[TABLE]

Proposition 5.7**.**

Under Assumptions 1-5 and notation (5.4)-(5.6) and (5.22), for $M>M_{1}+1$,

[TABLE]

Proof.

The following term is independent of $x$.

[TABLE]

so as in (5.11)-(5.14) with $\left(u,v,\theta\right)$ replaced with $\left(\alpha,\beta,h\right)$, we apply $\mathcal{D}_{x}^{M_{1}-1}$ to $\frac{\phi^{1}-\phi}{1-\varphi}$ while denoting $c=c\left(h\right),\,d=d\left(h\right)$ for convenience,

[TABLE]

Manipulating $\frac{\mu}{\mu+h_{y}}$, $\frac{h_{y}-h_{\ast}}{h_{y}}$, and $\frac{\mu}{\mu+h_{\ast}}$ similarly and combining with the above yields

[TABLE]

where $C=\frac{\left(a\mu\lambda\right)^{2}\alpha^{M_{1}+1}c^{M_{1}-1}}{\left(1-d\alpha l\left(\beta\right)\right)\left(h+\lambda\right)^{2}\left(\mu+h+\lambda\right)^{2}}$. We can now apply $\mathcal{D}_{y}^{M-1}$ to (5.27), using properties (i, iii, vi) of the inverse operator as given in Appendix B,

[TABLE]

Next, we need to apply $\mathcal{L}\mathcal{C}^{-1}_{w}\left(\cdot\right)\left(V\right)$ to (5.3). Notice that each non-constant term (with respect to $w$) is of the form $\frac{l^{k}}{1-d\alpha l}$, so we establish a result for an arbitrary $k$. We have

[TABLE]

Applying $\mathcal{L}\mathcal{C}_{w}^{-1}$ here is the same as in (5.16) with $M_{1}=k$, $v=\beta$, and $\theta=h$, so we have

[TABLE]

Applying this result to (5.3) and expanding the constant $C$ yields the statement of the theorem for $M>M_{1}+1$. Deriving a formula for $M=M_{1}+1$ is similar to the second part of the proof of Proposition 5.1, where applying $\mathcal{D}_{y}^{M_{1}}$ instead yields a constant, $l\left(\beta\right)$ in (5.3). ∎

5.4 Marginal Transforms upon $\boldsymbol{\tau}_{\min\left\{\boldsymbol{\mu,\nu}\right\}}$

Next, we find the marginal transforms of each component upon $\tau_{\min\left\{\mu,\nu\right\}}$, the first observed crossing of $M$ or $V$. These readily follow from the joint functional of the previous section by adjusting the values of $\alpha,\,\beta,\,$and $h$.

Corollary 5.8**.**

Under Assumptions 1-5 and notation (5.4)-(5.6) and (5.22),

[TABLE]

Corollary 5.9**.**

Under Assumptions 1-5 and notation (5.4)-(5.6) and (5.22),

[TABLE]

Corollary 5.10**.**

Under Assumptions 1-5 and notation (5.4)-(5.6) and (5.22),

[TABLE]

5.5 Time Between Successive Threshold Crossings

Next, we provide a functional of the time between the observed $M_{1}$ crossing and the first observed $M$ or $V$ crossing,

[TABLE]

Proposition 5.11**.**

Under Assumptions 1-5 and notation (5.4)-(5.6) and (5.22),

[TABLE]

The proof is similar to the above propositions and thus is omitted. ∎

5.6 Summary

In this article we deal with the detection and prediction of losses due to cyber attacks waged on large-scale vital networks. We model the accumulation of losses to a network during a series of hostile attacks by a 2-dimensional monotone random walk process as observed by an independent delayed renewal process. The first component of the process is associated with the number of nodes (such as routers or operational sites) incapacitated by successive attacks. Each node has a weight associated with its incapacitation (such as loss of operational capacity or financial expense associated with repair), and the second component represents the cumulative weight associated with the nodes lost. Each component has a fixed threshold, and crossing of a threshold by either component represents the network entering a critical condition. We obtain tractable results in the form of joint transforms of the predicted time of the first observed threshold crossing, along with the values of each underlying component (such as the number of perished nodes, their associated cumulative weight) upon this time and one observation prior to the first passage time. We demonstrated the tractability of the obtained results on two major and various other special cases. We further validated the results through the comparison with stochastically simulated attacks.

5.7 A Forthcoming and Future Work.

We continue our research on strategic networks in two directions. First, we plan to further refine the obtained predicted data hindered by an eventual crudeness of observations. This will be rendered by means of so-called “time sensitive analysis.” The latter is a completely different technique applied to continuous time parameter processes and it will allow us to obtain the underlying distributions in any vicinity of the first passage time reviving missed moments of attacks due to delayed observations. These measures may yield a more accurate information about the status of the network than those delivered by auxiliary thresholds. The method of auxiliary thresholds will thus be replaced by the time sensitive analysis, although a combination of both techniques is not excluded. Independent of this refinement, we also plan to introduce strategic defense of finite networks, which can be utilized to random walks on smaller scale graphs.

Acknowledgement

The authors are very grateful to the referees for their constructive remarks and suggestions that led to a better version.

Appendix A Proof of the Value of $\gamma(z,v,\theta)$

Lemma A.1**.**

The joint functional of increments per observation epoch is

[TABLE]

Proof.

[TABLE]

where $J$ is the number of strikes arriving in $\Delta_{1}$, which is a Poisson RV with parameter $\lambda\Delta_{1}$. ∎

Appendix B Properties of the Inverse Operator $\mathcal{D}^{k}$

In this appendix, we mention some useful properties of the inverse operator $\mathcal{D}^{k}$, as defined in (2.21).

1. ($i$)

$\mathcal{D}^{k}$ is a linear functional. 2. ($ii$)

$\mathcal{D}^{k}_{x}\left(\boldsymbol{1}\left(x\right)\right)=1$, where 1$\left(x\right)=1$ for all $x\in\mathbb{R}$. 3. ($iii$)

If $g$ is an analytic function at [math], then

[TABLE] 4. ($iv$)

If $a\left(x\right)=\sum\limits_{j=0}^{\infty}a_{j}x^{j}$, then

[TABLE] 5. ($v$)

If $b\neq 1$, for $b\in\mathbb{R}$, then

[TABLE] 6. ($vi$)

If $b\neq 1$, for $a,b\in\mathbb{R}$, then

[TABLE]