REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member,...
-
Upload
myrtle-snow -
Category
Documents
-
view
215 -
download
0
Transcript of REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member,...
![Page 1: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/1.jpg)
1
REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACKGregory Levitin, Senior Member, IEEE, and Kjell Hausken
IEEE Transactions on ReliabilityVol. 58, No.1, March 2009
Advisor: Frank Yeong-Sung, LinPresented by : Hui-Yu, Chung
![Page 2: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/2.jpg)
2
AgendaIntroductionThe ModelDetermining the Optimal StrategiesConsidering Intervals of the Contest
IntensityConclusions
![Page 3: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/3.jpg)
3
IntroductionResources of The Defender◦Three measures to remain survivability
Deploying redundant genuine elements (GE) Deploy false elements (FE) to attract the attacker Protecting some of the GE
Resources of The Attacker◦The Attacker’s object is to maximize damage
But the Attacker is expected to expend resources on both GE and FEs.
![Page 4: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/4.jpg)
4
IntroductionDefender’s strategy◦How to allocate its resource between GE, FE,
and protect GEAttacker’s strategy◦How many elements to attack
Two period game with minmax defender strategy◦First period: defender, second period: attacker◦Minimize the maximum risk
![Page 5: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/5.jpg)
5
Basic Aefinition & Acronym• Lowest-level part of the system characterized by performance g,
and cost x
Genuine system element (GE)
• Imitation of GE that has actual performance 0, and cost y
False Elements (FE)
• Either GE, or FE
Element
• Conditional probability of element destruction even it is attacked
Vulnerability
• Technical or organizational measure aimed at reduction of element vulnerability
Protection
![Page 6: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/6.jpg)
6
Nomenclatures
![Page 7: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/7.jpg)
7
AssumptionsThe attacker cannot distinguish between
GE and FEBoth the attacker/defender
attacks/protects each element with equal resources
Considering a non-strategic attacker (fixed attack or fixed attack probability)
Both the attacker and the defender have limited, fixed resources
![Page 8: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/8.jpg)
8
AgendaIntroductionThe ModelDetermining the Optimal StrategiesConsidering Intervals of the Contest
IntensityConclusions
![Page 9: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/9.jpg)
9
The ModelAll parameters are known by both the
defender and the attacker◦except the attacker cannot distinguish GE and
FEThe system is built to meet a demand H:
Minimal elements required:Total resource cannot exceed r: Nx r
/H g
→ /r x H g
Ng H
![Page 10: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/10.jpg)
10
The Model
The attacker attacks elementsThe attacked unprotected GE can be destroyed with
fixed probability b.Using the most conservative defense policy◦ Assuming a maximum attacker’s budget
Defender Side Attacker Side
Measures Increase GE Deploy FE Protect GE Attack elements
Resource Needed x y ( ) /t r Nx Fy K /T R Q
Q N F
![Page 11: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/11.jpg)
11
Contest Success FunctionAttack success probability (vulnerability)
for each protected GE
Contest Intensity Parameter m◦Reflect how the survivability of the system
depends on the resources expanded
![Page 12: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/12.jpg)
12
Contest Success FunctionContest intensity parameter m:
m = 0 v = 50%t and T have equal impact on vulnerability
0 < m < 1 Disproportional advantage of investing less than the opponent
m = 1 The investments have proportional impact on vulnerability
m > 1 Disproportional advantage of investing more effort than opponent (economics of scare)
m = Winner-takes-all
![Page 13: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/13.jpg)
13
Problem Formulation The prob. that attacker attacks exactly n GE is
For any n, the conditional prob. That exactly k out of n attacked GE are protected is
The prob. That exactly n GE are attacked, and among them k GE are protected is
( ) ( ) ( | )P A B P A P B A
![Page 14: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/14.jpg)
14
Problem FormulationThe conditional prob. That exactly s out
of k protected attacked GE are destroyed is
The prob. That exactly n GE are attacked, e out of the n - k attacked unprotected elements are destroyed is
![Page 15: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/15.jpg)
15
Problem Formulation :The prob. That exactly j elements are
destroyed by the attack, which is the sum of prob. Of all possible combinations that produce the same value of j. ( j = s + e)
jp
Unprotected elements
Destroyed unprotected elements
# of attacked GE, n,can range from max{0,Q - F}to min{Q, N}
# of protected attacked GE, k, can range from max{0,Q – N + K} to min{n, K}
![Page 16: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/16.jpg)
16
Problem FormulationIf b = 1 → e = n - k
![Page 17: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/17.jpg)
17
Algorithm Which obtains the prob. of different number of GE destroyed by attack Q
elements
![Page 18: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/18.jpg)
18
Measures of risk In terns of expected damage:
Damage exists whenIn terns of system vulnerability:◦(prob. Of not meeting the demand)
/j N H g
![Page 19: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/19.jpg)
19
AgendaIntroductionThe ModelDetermining the Optimal StrategiesConsidering Intervals of the Contest
IntensityConclusions
![Page 20: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/20.jpg)
20
The Optimal StrategiesThe optimal defender can be a solution of
a minmax game that minimize the risk given that for any N, F, K, the attacker chooses Q elements to attack to maximize the risk .
![Page 21: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/21.jpg)
21
The Optimal StrategiesThe risk can be replaced by D or V
![Page 22: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/22.jpg)
22
SolutionsSolutions for different contest intensities◦H = 10, g = 2, y = 1, x = 3, b = 1, R = 10, r = 40
![Page 23: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/23.jpg)
23
SolutionsThe solution of the two measures of risk (considering
expected damage and system vulnerability) are similar
With small m → Increase system redundancy with minimal protection, and FE is less important.
Increasing m → FE becomes more important
Larger m → Since attacker only attacks a subset of the elements, FE slightly decreases.
![Page 24: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/24.jpg)
24
AgendaIntroductionThe ModelDetermining the Optimal StrategiesConsidering Intervals of the Contest
IntensityConclusions
![Page 25: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/25.jpg)
25
Intervals of the Contest Intensity
In many practical situations, the values of the contest intensities cannot be exactly determined.
Most conservative defense strategy→ Consider most favorable m for the attacker
The defender’s strategy is to choose N*, F*, K* that minimize the risk under attacker’s optimal strategy Q = Q*(N, K, F, m) in the range min maxm m m
![Page 26: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/26.jpg)
26
Intervals of the Contest Intensity
Algorithm
max min0.04( )m m mIn this case,
![Page 27: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/27.jpg)
27
Optimal defender’s minmax strategies as a function of rH = 10, g = 2, y = 1, b = 1, R = 10, x = 3
![Page 28: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/28.jpg)
28
Optimal defender’s minmax strategies as a function of xH = 10, g = 2, y = 1, b = 1, R = 10, r = 50
![Page 29: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/29.jpg)
29
Optimal defender’s minmax strategies
The influence when increasing the defender’s resource is similar to the influence when decreasing the GE cost.
Small m→Need large N → more sensitive to N
Intermediate m→Prefer large F → less sensitive to N
Large m→Need to protect GE → N decreases
![Page 30: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/30.jpg)
30
Optimal defender’s minmax strategies as a function of RH = 10, g = 2, x= 3, y = 1, b = 1, r = 30
![Page 31: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/31.jpg)
31
Optimal defender’s minmax strategies as a function of R
With the growth of R, the defender must decrease the number of GE and K/N, to allocate more resource to protect some of the GE.
Low attacker resource◦The defender benefits from high contest intensity
High attacker resource◦The defender benefits form small contest intensity◦The attacker benefits from intermediate contest
intensity
![Page 32: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/32.jpg)
32
Optimal defender’s minmax strategies as a function of bH = 10, g = 2, x= 3, y = 1, r = 30, R = 10
![Page 33: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/33.jpg)
33
Optimal defender’s minmax strategies as a function of bWith the growth of b, the importance of
protecting GE increasesDefender protect more GE
→ Limits the # of GE that can be deployed→ Deploy more FE to compensate
K < N→ The expected damage increases
K = N → No unprotected GE→ b has no effect on expected damage
![Page 34: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/34.jpg)
34
Considering Optimal FEThe number of FE, F, is most sensitive to
variation of the game parameter m, x, r, and R.◦The cost of FE is lower than GE◦Balance?
Deploy more FE?
Protecting more on
GE?
![Page 35: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/35.jpg)
35
Considering Optimal FE F = 10, g = 2, y = 1, x = 3, b = 1, R = 10, 1 < m < 5
![Page 36: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/36.jpg)
36
Considering Optimal FEConsider a fixed and optimal number of
FEWhen r grows, the difference between D
corresponding to different fixed values of F decreases.◦ If the defender has enough resources, non-
optimal F can be compensated by other defensive measures.
![Page 37: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/37.jpg)
37
AgendaIntroductionThe ModelDetermining the Optimal StrategiesConsidering Intervals of the Contest
IntensityConclusions
![Page 38: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/38.jpg)
38
ConclusionsUsing a two-period minmax game to
analyze the defender’s strategy.Considering the system redundancy, # of
FEs, and protection resource◦Small m : high system redundancy with
minimum protection, low FE◦Intermediate m: redundancy decreased, FE
increased, invest more on protection◦High m: FE decreases (since attacker attacks
only part of the elements)
![Page 39: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/39.jpg)
39
ConclusionsConsidering non-certain determined
contest intensities, the influence on defender’s increase of resource is similar to the influence on decrease of the GE cost.
Low GE cost/ High defender’s resource:◦The defender benefits from extremely low m
High GE cost/ Low defender’s resource:◦The attacker benefits from intermediate m
![Page 40: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/40.jpg)
40
ConclusionsWhen the attacker’s resource is high, the
defender need to lower the ration of protected GE and deployed GE to make more effort on protecting them.
Low attacker resource:◦Defender benefits from large m
High attacker resource:◦The defender benefits from low m◦The attacker benefits from intermediate m
![Page 41: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/41.jpg)
41
ConclusionsThe balance between deploying more FE,
spending more resources toward protection of the GE, depends on the agents’ resources, the contest intensity, and the relative cost of deploying FE an GE.◦While the optimal # of FE provides lowest
possible expected damage, some other # of FE may differ from the possible lowest one.
Future works can concern on cost and budget issues
![Page 42: REDUNDANCY VS. PROTECTION VS. FALSE TARGETS FOR SYSTEMS UNDER ATTACK Gregory Levitin, Senior Member, IEEE, and Kjell Hausken IEEE Transactions on Reliability.](https://reader033.fdocuments.us/reader033/viewer/2022051622/5697bfd11a28abf838cab020/html5/thumbnails/42.jpg)
42
THANKS FOR YOUR LISTENING~!!!