Time-Dependent Railway Security Resource Allocation with a Bounded-Rational Attacker: A Stackelberg Security Game

J. Winstel, F.A. Campos, L.J. Fernández

Summary:

Protecting open railway systems against intentional attacks requires allocating limited security resources across locations and time while accounting for an adversary who reacts strategically but may not be perfectly rational. This paper proposes a time-dependent Stackelberg security game in which a defender selects mixed security postures over station-time pairs and a bounded-rational attacker follows a logit Quantal Response. Target harm integrates passenger exposure, network centrality, asset losses, symbolic relevance and defense effects. The resulting non-convex fractional optimization is addressed through bisection and a piecewise-linear multiple-choice approximation, yielding a sequence of mixed-integer quadratically constrained problems. A reproducible Madrid Cercanías case study is built from public ridership, mobility, infrastructure and financial information through an explicit data-reconstruction pipeline that produces time-dependent passenger exposure and network-criticality inputs for ten zones. Results reveal a transition from broad coverage to concentrated protection as attacker rationality increases, with deliberately unspent budget above a calibration-dependent threshold. Coordinating a common daily budget across time reduces the attacker utility by about 27% relative to an equal per-slot allocation, while computational experiments remain tractable for the operational time horizons tested.

Spanish layman's summary:

Se propone un juego de seguridad de Stackelberg para asignar recursos ferroviarios en el tiempo ante atacantes de racionalidad limitada. El caso de Madrid Cercanías muestra que coordinar el presupuesto diario reduce un 27% la utilidad del atacante frente a una asignación uniforme.

English layman's summary:

A time-dependent Stackelberg security game allocates railway security resources against bounded-rational attackers. A Madrid Cercanías case study shows that coordinating a common daily budget reduces worst-case attacker utility by 27% versus uniform allocation.

Keywords: railway security; Stackelberg security game; bounded rationality; Quantal Response; critical infrastructure; resource allocation; mixed-integer optimization