New Security Risk Assessment and Genetic Algorithms Based Methods to Optimize Risk Reduction Countermeasures for Cultural Heritage Sites

Cultural heritage sites are exposed to a variety of risks, for instance, by robbery, vandalism, harming, terrorism, etc., which may damage people and cultural heritage place.

For this motive, it is necessary to plan appropriate countermeasures to prevent the above risks and to protect these sites using intrusion detection, access control, video surveillance, communication systems, security personnel, and procedures properly mixed to attain an integrated system or solution [1, 2]. Taking into consideration the devices and installations, it is also vital them to be appropriately powered and to be able to communicate the data and information required for a proper security managing. This involves that power suppliers and transmission devices and networks have to be appropriately secured to prevent potential attacks versus them that might harm the operations of integrated technologies utilized and therefore leave the entire site exposed to extreme risks [3].

For this reason, it is crucial to estimate all the probable risks to select the appropriate countermeasures that have to be applied versus any possible malevolent activity. If security systems are already present, their suitability have also to be evaluated any time the risk context modifies [4, 5].

Risk assessment is very important in cultural heritage sites, and different methods have been proposed such the one suggested by CCI (Canadian Conservation Institute) and ICCROM (International Centre for the Study of the Preservation and Restoration of Cultural Property) named ABC method based on the three ABC components for quantification of risk, where ABC scales are represented by frequency of rate (A scale), loss of value to each affected item (B scale), and items affected (C scale) [6].

Security countermeasures following a proper risk assessment are not so simply to be applied as it has been demonstrated that the responsibility to ensure public access, stimulate art appreciation, and safeguard collections represent a conflict of interest between professionals working in museums that continue to challenge the development of preventative measures [7].

Terrorism can also affect cultural heritage sites and the counter-terrorism security measures at museums represent a form of securitization, after a proper highlighting of risk and related management [8].

Archives represent a particular type of cultural heritage sites characterized by different kind of risks that have been analysed, such a study made to detail what actions have been taken at The National Archives UK to improve issues such as environmental conditions within storage areas, mitigating risk of physical damage to documents from handling, policies on the use of archival microfilm masters, and to reduce damage and loss of original records by substitution copying [9].

Even the Canadian Museum of Nature developed a risk model for preventive conservation that has proven helpful in application to a Portuguese archive. The work utilizes this model to assess the magnitudes of precise risks estimated for this same archive collection when located in either of two pairs of storage rooms. These rooms are in two different parts of this building: two are in an older part and two are in a recent addition. It was, therefore, necessary to assess the building itself, both structurally and environmentally, as well as analyse its common human practices. In terms of the overall risk magnitude, the best room was found to be in the recent building and the worst in the older building. However, the risks related to water problems were found to be higher in the new building. In this work, cost-free measures and easy to implement recommendations are given in order to improve the quality of the storage rooms [10].

Between the different proposed method, there are also specific methodology such as QuiskScan, a quick risk scan, which yields an overview over a collection, its values, and the vulnerabilities with comparatively modest effort. The QuiskScan utilizes a matrix-based approach to map value and vulnerability to the agents of deterioration for different collection units to highlight where considerable losses to the collection might occur. Like other risk assessment approaches, the QuiskScan involves expert input from across the organization thus helping to create a shared insight into the collection and an institutional awareness of risks. The method should be regarded as a tool that fits in between relying on best practice and conducting a comprehensive risk assessment [11].

Another method is represented by CPRAM (Cultural Property Risk Analysis Model), which was developed to guide priorities for resource allocation to preventive conservation under conditions of uncertainty. This model recognizes the preservation system as a subsystem within a collection management system, which, in turn, nests within progressively broader systems. Within this set of systems and subsystems, the contribution of preventive conservation to the continuance and betterment of humanity is recognized. Carefully defining the scope of the preservation system ensures clear understanding of interactions with surrounding systems. The risk analysis model then disaggregates risk through hierarchies both of sources of risk and of divisions of collections. The level of technical risk analysis varies throughout these hierarchies depending on the potential significance of the disaggregate portion considered. This approach makes the entire modelling process as efficient as possible [12].

CPRAM was employed by the American Museum of Natural History (AMNH) to identify a complete picture of its collections priorities and is accomplishing an overall risk assessment of its research, exhibit, and library/archive collections. The assessment model used for this three-phase project is based on the CPRAM and adapted to accommodate the specific needs of a large, complex institution. These assessments have provided AMNH administrators with information crucial to making long-term strategy and policy decisions about reducing and mitigating risks to collections [13].

CPRAM was also employed by the Royal British Columbia Museum (RBCM) that has a large and precious collection of archival records, artifacts, specimens, and associated information pertaining to the Province of British Columbia’s human and natural history. In 2004 and again in 2010, the RBCM performed a comprehensive risk assessment to identify and quantify the potential impact of threats to the collections. Methodology was based on the CPRAM. The RBCM risk assessment projects, which involved over 30 staff members, were each completed over a period of several months. The results of the latest comprehensive review provided a corporate-wide perspective of the risks to the collection. Some risk-related assumptions were confirmed and new issues came to light. As a result of these risk assessments, a Risk Management Implementation Plan has been developed to address the most damaging and imminent threats to the collections [14].

CPRAM was also utilized by the Denver Museum of Nature & Science’s (DMNS) risk assessment estimated hazards for the collections in storage using it to structure a comprehensive assessment and calculate magnitude of risk (MR). MR is the fraction of collection value expected to be lost given one hundred years exposure to current conditions. The MR is the simple product of four variables (Fraction Susceptible [FS], Loss in Value [LV], Probability [P], and Extent [E]) that are multiplied as follows: MR=FS×LV×P×E. Using this approach, the DMNS could derive proper collections preservation strategies that results in safe and more accessible storage of the 1.4 million objects the museum holds in public trust [15]. In this paper, a new security risk assessment method for cultural heritage sites (SRACHS) is presented, showing as a case study, with any loss of its wide pertinence, its application to a museum. Further, a proper genetic algorithms (GAs)-based methodology to optimize risk reduction countermeasures is presented. The proposed security risk assessment methodology allows for obtaining the correct amount of security protections (intrusion detection system, access control, video surveillance, communication devices, security personnel, etc.) that a desired cultural heritage place necessitates and the associated characteristics depending on the possible targets that can be attacked. It also avoids overestimating the risks as in the instance of planning unnecessary protective countermeasures that sometimes is not needed, thus reducing the connected extra expenses, as properly demonstrated by the GAs-based methodology to optimize risk reduction countermeasures.

It also represents a new technique with respect to other security risk assessment techniques for heritage sites [6-15]. As a matter of fact, it employs an appropriate introductory risk assessment to go on further, estimating the degree of defence of every target correlated to each threat, properly aided by the GAs-based method. So, it provides supplementary worthwhile knowledge, as shown in the following.

$\begin{gathered}f(I)=\operatorname{argmin}\left\{\alpha\left[\sum_{i=1}^{N_T} \sum_{j=1}^{N_p} I_{i, j} * C_{i, j}\right] / C_{M A X}+\right. \\ \left.+\beta\left\{\sum_{i=1}^{N_T}\left[T F_i-\log \left(\sum_{j=1}^{N_p} I_{i, j} * P F D_{i, j}+\sum_{m=1}^{N_T} \sum_{n=1}^{N_p} I_{m, n} * P F D_{m, n} * I P T_{m, n, j}\right)\right]\right\} / R_{M A X}\right\}\end{gathered}$                   (3)

where I_i,j is the binary value of element ‘i’ of gene ‘j’ of individual I; C_i,j is the cost of protection P_i, on the target T_j; TF_i is the target factor associated to target T_i; PFD_i,j is the probability of failure on demand of protection Pi, on the target T_j; IPT_m,n,i is the interaction of the protection Pm on the target Tn with the other target T_i; C_MAX is the cost of all the protections applied to all targets; R_MAX is the level of risk evaluated for all the targets without any protection. As it is possible to see from Eq. (3), I_i,j is present in all the terms of it as it is related to the presence or less of protections on targets represented by the generic individual I of population to be optimized. Further, the second part of Eq. (3) related to risk reduction is composed by the first part related to direct protections on the targets and by the second part related to interaction of protections of targets on the other targets. α and β are two parameters that vary between 0 and 1, where β=1-α, so that it is possible to give more importance to the first term (reduction of cost, when α tends to 1) or to the second term (reduction of level of risk of targets, when α tends to 0) or to both of them (when α≈0.5).

The fitness function represented by Eq. (3) can be computed only if the individual I represents an effective solution, which means that the different protections of the different targets represented by it can be really appliable: this is verified by means of the array named applicability of APT. If this does not happen, it is forced to be equal to 0, as the individual I does not correspond to an effective solution for the considered problem. Further, the fitness function represents a multi-optimization problem (two objects function - cost and risk). Consequently, the multi-objective optimization leads to a Pareto front [24] of the optimal solutions, for each value of α in the interval 0÷1, which is illustrated in the following.

The initial population is produced randomly. Once the population is recombined and mutated, the fitness function of the population is computed with the fitness function expressed by Eq. (3), considering only fitting individuals I of the population. The convergence evaluation is done, estimating if the difference between the mean value of fitness functions of the acceptable individuals belonging to the actual generation and the mean values of the last N_G generations is smaller than a definite percentage rate p_stop that can be selected.

The GA has been tested on more than 500 real and random situations using a proper software code developed with Python [25], to obtain, as much as possible, general mean results valid to any sort of site. All of the results, achieved with quite fast converge, as described in the following, are attained with converge test parameters N_G and p_stop equal to 40 and 0.3, respectively. Further, the simulations were made considering a one-point crossover function characterized by a probability variable between 0.6 and 0.8, a mutation probability variable between 0.01 and 0.1 and different values of α variable in the interval 0÷0.25. Due to the huge amount of ultimate data attained and to the number of results that can be obtained from this huge amount of data, only the most considerable results are shown in the following, due to the limited space available. A significant parameter to be considered in obtaining noteworthy data is embodied by IPT_mean that is the mean value of IPT. If this value is equal to 0, it means that every protection shields only every specific target. On the contrary, if it is equal to 1, it means that every protection of each specific target is able to protect all the other targets. The value of IPT_mean depends on the kind of protections chosen to protect the targets of the considered site. An example of protection capable of increasing the value of IPT_mean is represented by video surveillance that can be used, in certain zones and in certain situations, to protect more targets at the same time. It is evident that the greater IPT_mean and the greater the GA chance of optimization, as will be shown in the following.

Another important parameter is represented by the cost ratio (CR), represented by the ratio between the cost of the protections offered by optimal individual I and the cost of all the protections applied to all targets C_MAX. It is evident that the greater CR and the greater the GA chance of optimization, as will be shown in the following.

It is also evident that if all the possible protections are utilized, and if the related calculation shown previously allows it, the total risk, embodied by the sum of all considered risks Ri, is reduced at the minimum level (i.e., a reduction value of 100%), while if no protections are utilized, the total risk remains at the maximum level (i.e., a reduction value of 0%). The total risk reduction (TRR), expressed as a percentage, can represent a valuable parameter to evaluate the optimization skills of the considered GA.

The TRR, expressed as a percentage, as a function of CR, for different values of IPT_mean is shown in Figure 3. As it is possible to see from Figure 3, the GA is capable of usefully increasing the TRR (and therefore reduce the total risk) as a function of both CR and I IPT_mean, as expected. It is evident that, as CR increases, more protections can be utilized by GA for risk reduction, and the curves grow, according to different profiles, as a function of IPT_mean. It is also evident that the greater the IPT_mean and the greater the GA chance of optimization. In fact, when IPT_mean tends to 1 (maximum value reachable), each protection tends to shield every target and this allows the GA to achieve its maximum optimization capabilities, reaching TRR of 100% with investment ratio equal to about 0.45. When IPT_mean tends to 0 (minimum theoretical value reachable), each protection can shield only one target and this does not allow the GA to best perform its optimization capabilities, reaching a TRR of 100% with CR equal to about 0.88. Anyway, even in this worst case, the GA is capable of guaranteeing a reduction of CR.

3.png

Figure 3. TRR, expressed as a percentage, as a function of CR, for different values of IPT_mean

4.png

Figure 4. Pareto front of the optimal solutions for α varying in the interval 0÷1, for different values for different values of IPT_mean (upper left side are the values obtained when α tends to 1, while lower right side are the values obtained when α tends to 0)

Regarding the multi-optimization features of fitness function represented by Eq. (3) (two object functions, cost C and risk R), the multi-objective optimization leads to a Pareto front of the optimal solutions. This aspect has been studied, as indicated previously, for each value of α in the interval 0÷1, and the results are illustrated in Figure 4.

The different curves of Figure 4 are related to different Pareto fronts obtained for different values of IPT_mean, since, as already illustrated previously, the greater the IPT_mean and the greater the GA possibility of optimization.

As it is possible to see from Figure 4, when α tends to 1 (upper left side of Figure 4), that is the reduction of cost C is predominant with respect to the reduction of risk R in Eq. (3), the values of Pareto fronts provide values of risk R greater than 0.5, since, due to superior importance given to the economic resources and the consequent lesser importance given to the protections applicable for risk lessening, the GA is not driven at guaranteeing a great reduction of risk R.

On the contrary, when α tends to 0 (lower right side of Figure 4), that is the reduction of risk R is predominant with respect to the reduction of cost C in Eq. (3), the values of Pareto fronts provide values of risk R smaller than 0.1, since, due to lesser importance given to the economic resources available and the consequent greater importance given to the protections applicable for risk lessening, the GA is driven to guarantee a great reduction of risk R.

When α≈0.5 (central part of Figure 4), that is the reduction of risk R has more or less the same importance of the reduction of cost C in Eq. (3), the values of Pareto fronts provide values of risk R variable between 0.6 and 0.1. The different values obtained for risk depends on different values of IPT_mean since, as already illustrated, the greater the IPT_mean and the greater the GA capability of optimizing the considered problem.

The number of generations required for the GA to achieve the final optimal solution embodies a very important parameter, together with the initial population, as it provides an indication of the calculation charge that, once associated to the processing resources available, delivers a precise information regarding the time needed to reach the wanted final optimal solution. This aspect has been analysed jointly with other aspects, but the findings cannot be shown due to the limited space available.

Anyway, the applied GA, thanks to its specific features, has proven to be able to scope the final optimal solutions, even in the worst cases, with a rather reduced number of generations and a rather reduced number of individuals of population, offering the wanted solution in a rapid and effective mode, even in the presence of limited processing resources.