Green Security Game with Community Engagement

Despite the significance of protecting natural resources to environmental sustainability, a common lack of funding leads to an extremely low density of law enforcement units (referred to as defenders) to combat illegal activities such as wildlife poaching and overfishing (referred to as attacks). Due to insufficient sanctions, attackers are able to launch frequent attacks Le Gallic and Cox (2006); Leader-Williams and Milner-Gulland (1993), making it even more challenging to effectively detect and deter criminal activities through patrolling. To improve patrol efficiency, law enforcement agencies often recruit informants from local communities and plan defensive resources based on tips provided by them Linkie et al. (2015). Since attackers are often from the same local community and their activities can be observed by informants through social interactions, such tips contain detailed information about ongoing or upcoming criminal activities and, if known by defenders, can directly be used to guide allocating defensive resources. In fact, community engagement is listed by World Wild Fund for Nature as one of the six pillars towards zero poaching WWF (2015). The importance of community engagement goes beyond these green security domains about environment conservation and extends to domains such as fighting urban crimes Tublitz and Lawrence (2014); Gill et al. (2014).

Previous research in computational game theory have led to models and algorithms that can help the defenders allocate limited resources in the presence of attackers, with applications to enforce traffic Rosenfeld and Kraus (2017), combat oil-siphoning Wang et al. (2018), and deceive cyber adversaries Schlenker et al. (2018) in addition to protecting critical infrastructure Pita et al. (2008) and combating wildlife crime Fang et al. (2017). However, none of the work has considered this essential element of community engagement.

Community engagement leads to fundamentally new challenges that do not exist in previous literature. First, the defender not only needs to determine how to patrol but also needs to decide whom to recruit as informants. Second, there can be multiple attackers, and the existence of informants makes the success or failure of their attacks interdependent since any tip about other attackers’ actions can change the defender’s patrol. Third, because of the combinatorial nature of the tips, representing the defender’s strategy requires exponential space, making the problem of finding optimal defender strategy extremely challenging. Fourth, attackers may notice the patrol pattern over time and adapt their strategies accordingly.

In this paper, we provide the first study to fill the gap and provide a novel two-stage security game model for community engagement which represents the social network between potential informants and attackers with a bipartite graph. In the first stage of the game, the defender recruits a set of informants under a budget constraint, and in the second stage, the defender chooses a set of targets to protect based on tips from recruited informants. Inspired by the quantal cognitive hierarchy model Wright and Leyton-Brown (2014), we use a level-$\kappa$ response model for attackers, taking into account the fact that the attacker can make iterative reasoning and the attacker’s strategy will impact the actual marginal strategy of the defender.

Our second contribution includes complexity results and algorithms for computing optimal defender strategy against level-$\kappa$ ($\kappa<\infty$) attackers. We show that the problem of selecting the optimal set of informants is NP-Hard. Further, based on sampling techniques, we develop an approximation algorithm to compute the optimal patrol strategy and a heuristic algorithm to find the optimal set of informants to recruit. For an expository purpose, we mainly describe the algorithms for level-0 attackers and provide the extension to level-$\kappa$ ($0<\kappa<\infty$) attackers in the last section.

The third contribution is a novel algorithm to find the optimal defender strategy against level-$\infty$ attackers, which is an extremely challenging task: an attacker’s strategy may affect the defender’s marginal strategy, which in turn affects the attackers’ strategies and level-$\infty$ attackers is defined through a fixed-point argument; as a result, the defender’s utility relies crucially on solving a parameterized fixed-point problem. A naïve mathematical programming-based formulation is prohibitively large to solve. We instead reduce the program to a bi-level optimization problem, where both levels become more tractable. In particular, the inner level optimization is a linear program, and the outer level optimization is one with a linear number of variables and a single linear constraint.

Finally, we conduct extensive experiments. We compare the running time and solution quality of different algorithms. We show that our bi-level optimization algorithm achieves better performance than the algorithm adapted from previous works. We also compare level-0 attackers and the case with insider threat (i.e., the attacker is aware of the informants), where we formulate the problem as a mathematical program and solve it by adapting an algorithm from previous works. We show that the defender suffers from utility loss if the insider threat is not taken into consideration and the defender still assumes a naïve attacker model (level-0).

Community engagement is studied in criminology. Smith and Humphreys (2015); Moreto (2015); Duffy et al. (2015) investigate the role of community engagement in wildlife conservation. Linkie et al. (2015); Gill et al. (2014) show the positive effects of community-oriented strategies. However, they lack a mathematical model for strategic defender-attacker interactions.

Recruitment of informants has also been proposed to study societal attitudes in relation to crimes using evolutionary game theory models. Short et al. (2013) formulate the problem of solving recruitment strategies as an optimal control problem to account for limited resources and budget. In contrast to their work, we emphasize the synergy of community engagement and allocation of defensive resources and aim to find the best strategy of recruiting informants and allocating defensive resources.

In security domains, Stackelberg Security Game (SSG) has been applied to a variety of security problems Tambe (2011), with variants accounting for alarm systems, surveillance cameras, and drones that can provide information in real time Basilico et al. (2017); Ma et al. (2018); Guo et al. (2017). Unlike the sensors that provide location-based information as studied in previous works, the kind of tips the informants can provide depends on their social connections, an essential feature about community engagement.

Other than the full rationality model, boundedly rational behavioral models such as quantal response (QR) McKelvey and Palfrey (1995); Yang et al. (2012) and subjective utility quantal response Nguyen et al. (2013) have been explored in the study of SSG. Our model and solution approach are compatible with most existing behavioral models in the SSG literature, but for an expository purpose, we only focus on the QR model.

In this section, we introduce our novel two-stage green security game with community engagement. The key addition is the consideration of informants from local communities. They can be recruited and trained by the defender to provide tips about ongoing or upcoming attacks.

Following existing works on SSG Jain et al. (2010); Korzhyk et al. (2011), we consider a game with a set of targets $T=[n]=\{1,\dots,n\}$. The defender has $r$ units of defensive resources and each can protect or cover one target with no scheduling constraint. An attacker can choose a target to attack. If target $i$ is attacked, the defender (attacker) receives $R^{d}_{i}>0$ ($P^{a}_{i}<0$) if it is covered, otherwise receives $P^{d}_{i}<0$ ($R^{a}_{i}>0$).

Informants recruited by the defender can provide tips regarding the exact targets in ongoing or upcoming attacks but tip frequency and usefulness may vary due to heterogeneity in the informants’ social connections. We model the interactions and connections between potential informants $X$ (i.e., members of the community that are known to be non-attacker and can be recruited by the defender) and potential attackers $Y$ using a bipartite graph $G_{S}=(X,Y,E)$ with $X\cap Y=\emptyset$. Here we assume the defender has access to a list of potential attackers which could be provided by the conservation site manager, since the deployment of our work relies on the manager’s domain knowledge, experience, and understanding of the social connections among community members.

When an attacker decides to launch an attack, an informant who interacted with the attacker previously may know his target location. Formally, for each $v\in Y$, we assume that $v$ will attack a target with probability $p_{v}$ but the target is unknown without informants and each attacker takes actions independently. An edge $(u,v)\in E$ is associated with an information sharing intensity $w_{uv}$, representing the probability of attack activities of attacker $v$ being reported by $u$, given $v$ attacks and $u$ is recruited as an informant.

In the first stage, the defender recruits $k$ informants, and in the second stage, the defender receives tips from the informants and allocates $r$ units of defensive resources. The defender’s goal is to maximize the expected utility defined as the summation of the utilities for each attack.

Let $U$ denote the set of recruited informants in the first stage where $|U|\leq k$, and $V=\{v\mid\exists u\in V,(u,v)\in E\}$ denote the set of attackers that are connected with at least one informant in $U$. We represent tips as a vector of disjoint subsets of attackers $\mathbf{V}=(V_{1},\ldots,V_{n})$, where $V_{i}$ is the set of attackers who are reported to attack target $i\in T$ such that $V_{i}\subseteq V,V_{i}\cap V_{j}=\emptyset$ for any $i,j\in T$. An attacker $v$ is reported if there exists $i\in T$ such that $v\in V_{i}$, otherwise he is unreported. We also denote by $V_{0}=\bigcup_{i\in T}V_{i}$ the set of reported attackers. It is possible that $V_{0}=\emptyset$ and we say the defender is informed if $V_{0}\neq\emptyset$. Note that $\mathbf{V}$ is a compact representation of the tips received by the defender as it neglects the identity of the informants, which is not crucial in the defender’s decision making given that all the tips are assumed to be correct.

In practice, tips are infrequent and the defender is often very protective of the informants. Thus, the attackers are often not aware of the existence of informants unless there is a significant insider threat. In addition, patrols can be divided into two categories – routine patrols and ambush patrols, where the latter are in response to tips from informants. Ambush patrols are costly, often requiring rangers to lie in wait for many hours for the possibility of catching a poacher. If not informed, the defender follows her routine patrol strategy $\mathbf{x}_{0}=(x_{1},\ldots,x_{n})$ with $x_{i}$ denoting the probability that target $i$ is covered. Naturally, under this assumption the defender should use a strategy $x_{0}$ that is optimal against the QR model, which can be computed by following Yang et al. (2012). If informed she uses different strategies $\mathbf{x}(\mathbf{V})$ based on the tip $\mathbf{V}$. Assume that each attacker, if deciding to attack a target, will respond to the defender’s strategy following a known behavioral model – the QR model. We define $\mathsf{QR}(\mathbf{x}^{\prime}):=(q^{\prime}_{1},\ldots,q^{\prime}_{n})$, where $q^{\prime}_{i}$ is the probability of attacking target $i$ defined by

and $\mathbf{x}^{\prime}$ is the attacker’s subjective belief of the coverage probabilities. In the above equation, $\lambda\geq 0$ is the precision parameter McKelvey and Palfrey (1995) fixed throughout the paper. We discuss the relaxation of the some of the assumptions mentioned above in Section 8.

In this section, we first tackle the case where all attackers are level-0 by providing complexity results and algorithms to find the optimal set of informants. Designing efficient algorithms to solve this computationally hard problem is particularly challenging due to the combinatorial nature of the tips and exponentially many possibilities of informant selections. Furthermore, in the general case, attackers are heterogeneous and we do not know which attackers will be reported, making it hard to compute $\mathsf{DefEU}(U)$.

As discussed in Section 3.1, a level-$\kappa$ attacker may keep adapting to the new marginal strategy formed by his current level of behavior. In this section, we first show in Theorem 5 that there exists a fixed-point strategy for the attacker in our level-$\kappa$ response model, and then use that to define the level-$\infty$ attackers.

We formulate the problem of finding the optimal defender’s strategy for this case as a mathematical program. However, such a program can be too large to solve. We propose a novel technique that reduces the program to a bi-level optimization problem, with both levels much more tractable.

[] Let $\Delta_{n}=\{\mathbf{q}\mid\mathbf{q}\in[0,1]^{n},\mathbf{1}^{\mathsf{T}}\mathbf{q}\leq 1\}$. Given defender’s strategies $\mathbf{x}_{0}$ and $\mathbf{x}(\mathbf{V})$, there exists $\mathbf{q}^{*}\in\Delta_{n}$ such that $\mathbf{q}^{*}=\mathsf{QR}(\mathsf{MS}(\mathbf{x}_{0},\mathbf{x},\mathbf{q}^{*}))$.

According to the definition of level-$\kappa$ attackers, we have $\mathbf{q}^{\kappa+1}=\mathsf{QR}(\mathsf{MS}(\mathbf{x}_{0},\mathbf{x},\mathbf{q}^{\kappa}))$. Slightly generalizing the definition, we define a level-$\infty$ attacker as:

We now consider a variant of our model where attackers take into account the impact of informants when determining the target they attack. Specifically, we assume the attackers follow the QR behavior model but incorporate the probability of being discovered when determining their expected utility for attacking a target.²²2Consider attackers that have had experience playing against the defender. Over time, the attacker might start to consider their expected utility in practice, which is affected by informants. In this setting, the attackers’ subjective belief $\mathbf{x}^{\prime}$ of the target coverage probability does not necessarily satisfy $\sum_{i}x^{\prime}_{i}\leq r$. Consider the example of a single attacker and a single informant with report intensity 1. Assume that the defender has $r=1$ and always protects the target being reported with probability 1. Then no matter which target the attacker chooses to attack, it will always be covered.

We focus on the single attacker case with $r\geq 1$. We first consider the problem of computing the optimal defender strategy when given the set of informants $U$ and associated probability of receiving a tip $w=1-\prod_{u\in U}(1-w_{u1})$. In the general case with multiple attackers, we will need to specify the defender strategy for each combination of tips received. However, when there is only one attacker, we can succinctly describe the defender strategy by their default strategy without tips, $\mathbf{x}$, and their probability of defending a location after receiving a tip for that location, $\mathbf{z}$. Then, under the QR adversary model, the probability $q_{i}$ of the attacker targeting location $i$ will be:

This leads to the following optimization problem, QRI, to compute the optimal defender strategy:

We can compute the optimal defender strategy by adapting the approach used in the PASAQ algorithm Yang et al. (2012). The description of the algorithm is deferred to Appendix J.

In this section, we demonstrate the effectiveness of our proposed algorithms through extensive experiments. In our experiments, all reported results are averaged over 30 randomly generated game instances. See Appendix L for details about generating game instances and parameters. Unless specified otherwise, all game instances are generated in this way.

In this paper, we introduced a novel two-stage security game model and a multi-level QR behavioral model that incorporated community engagement. We provided complexity results, developed algorithms to find (sub-)optimal groups of informants to recruit against level-0 attackers and evaluated the algorithms through extensive experiments. Our results also generalize to the case where informants have heterogeneous recruitment costs and to different kinds of attacker response models, such as SUQR model Nguyen et al. (2013), which can be done by calculating the attacker’s response correspondingly. Also, see Appendix M on how to extend our algorithms to defend against level-$\kappa$ ($\kappa<\infty$) attackers. In Section 5, we defined a more powerful type of attacker that could respond to the marginal strategy and developed a bi-level optimization algorithm to find the optimal defender’s strategy in this case.

In the anti-poaching domain, some conservation site managers utilize the so-called “intelligence” operations that rely on informants in nearby villages to alert rangers when they know the poachers’ plans in advance. The deployment of the work relies on the site manager to provide their understanding of the social connections among community members. The edges and parameters of the bipartite graph in our model can be extracted from a local social media application or historical data collected by site managers. Recruiting and training reliable informants is costly and managers may only afford a limited number of them. Our model and solution can help the managers efficiently recruit informants, make the best use of tips and evaluate the trade-off between allocating budget to hiring rangers and recruiting informants in a timely fashion.

For future work, instead of using a particular behavior model, we can use historical records as training data and learn the attackers’ behavior in different domains. It would also be interesting to consider the case where the informants can only provide inaccurate tips or other types of tips, e.g., some subset of targets will be attacked instead of a single location. We can also model the informants as strategic agents. In real life, it is possible that informants may also provide fake information if they have their own utility structures. We can try to reward them to elicit true information and maximize the defender’s utility.

This work is supported in part by NSF grant IIS-1850477 and a research grant from Lockheed Martin.