How to quantify security is a classic question in the security community that until today has had no plausible answer. Unfortunately, current security evaluation models are often either quantitative but too specific (i.e., applicability is limited), or comprehensive (i.e., system-level) but qualitative. The importance of quantifying security cannot be overstated, but doing so is difficult and complex, for many reason: the “physics” of the amount of security is ambiguous; the operational state is defined by two confronting parties; protecting and breaking systems is a cross-disciplinary mechanism; security is achieved by comparable security strength and breakable by the weakest link; and the human factor is unavoidable, among others. Thus, security engineers face great challenges in defending the principles of information security and privacy. This thesis addresses model-based system-level security quantification and argues that properly addressing the quantification problem of security first requires a paradigm shift in security modeling, addressing the problem at the abstraction level of what defines a computing system and failure model, before any system-level analysis can be established. Consequently, we present a candidate computing systems abstraction and failure model, then propose two failure-centric model-based quantification approaches, each including a bounding system model, performance measures, and evaluation techniques. The first approach addresses the problem considering the set of controls. To bound and build the logical network of a security system, we extend our original work on the Information Security Maturity Model (ISMM) with Reliability Block Diagrams (RBDs), state vectors, and structure functions from reliability engineering. We then present two different groups of evaluation methods. The first mainly addresses binary systems, by extending minimal path sets, minimal cut sets, and reliability analysis based on both random events and random variables. The second group addresses multi-state security systems with multiple performance measures, by extending Multi-state Systems (MSSs) representation and the Universal Generating Function (UGF) method. The second approach addresses the quantification problem when the two sets of a computing system, i.e., assets and controls, are considered. We adopt a graph-theoretic approach using Bayesian Networks (BNs) to build an asset-control graph as the candidate bounding system model, then demonstrate its application in a novel risk assessment method with various diagnosis and prediction inferences. This work, however, is multidisciplinary, involving foundations from many fields, including security engineering; maturity models; dependability theory, particularly reliability engineering; graph theory, particularly BNs; and probability and stochastic models.

Conceptual design synthesis is part of the conceptual phase of the design process, which focuses on creating alternative, candidate solutions. Conceptual design phase has the greatest influence on the cost and characteristics of the final product; an excellent detailed design based on a poor and inappropriate concept can never compensate for the inadequacy of the concept. Conceptual design is difficult, which currently relies on the designer’s intuition and experience to guide the process. A major issue in conceptual design is that often not many alternative candidate solutions are explored by the designer during the design process. The major reasons for this are the tendency to delimit a design problem area too narrowly and thus not being able to diversify the possible set of design solutions, possible bias towards a limited set of ideas, and time constraints. Many researchers recommended a thorough search of the design space for developing a good solution; this requires generation of a large solution space. Mechanical devices (mechanisms and machines) have fascinated the mankind throughout recorded history. Conceptual design synthesis of mechanical devices is difficult even for humans, and is also difficult to completely automate. In a single state design task, the relation between an input and output are fixed, but in a multiple state design task, the relation is not fixed. Much of the current research has been focused on supporting synthesis of single state devices, in particular where the device has to convert an input motion into an output motion. Synthesis of multiple state device is in contrast rather poorly understood and supported. Complete automation is unlikely to be possible; developing support taking into account the strength of computer and and human is important mechanical device is not adequate the biggest source for understanding of this process, and for its subsequent support, is human designers. The concept of state for a mechanical device is explained in detail by analyzing the existing multiple state mechanical devices. An operating state described by elemental functions (defined by efforts- motions of input and output components) and their associated Understanding and Supporting Conceptual Design Synthesis of Multiple State Mechanical Devices configurations and configuration changes. However, study of current literature indicates that little has been known about the actual processes carried out by designers in synthesizing multiple state devices. The main objectives of this thesis, therefore, are as follows: (1) understand the multiple state device design synthesis process carried out by designers, and (2) develop methods for supporting synthesis of multiple state mechanical devices to enhance the number of solution alternatives generated. Empirical studies are conducted to understand how designers currently carry out multiple state design tasks. Ten designers are given a multiple state design task and asked to generate as many solutions as possible. The designers are asked to think aloud while carrying out their synthesis processes. All these synthesis processes are video recorded, and analyzed to identify what activities are involved in the multiple state design synthesis, what the inputs are to each activity, and what the outcomes are from each activity. It has been found from these studies that design fixation is quite common, and the majority of the designers pursued developing a single solution to the given design task. A generic descriptive model of the multiple state mechanical device design synthesis process, explaining how this is carried by the designers, is developed. Based on this model, a prescriptive model of multiple state design synthesis process, explaining how the multiple state synthesis process should be carried by designers in order to develop a large solution space, is also developed. The prescriptive support, for synthesizing a large solution space for a given multiple state design task, has been evaluated. Eight engineering designers participated in the evaluation procedure, where each designer had to synthesize solutions for two, given multiple state design tasks. Results indicate that use of the prescriptive support, even without the power of a computational implementation, may have been beneficial in helping designers develop feasible solutions in a greater number of cases in a more efficient manner (that is, by considering fewer solution proposals and in similar amounts of time). All the designers who participated in this exercise gave a positive feedback regarding the prescriptive support. However, in none of the design sessions did the designers develop more than one feasible solution. This, along with various other comments from designers, indicates that a faster and more proactive support – implemented on computer – might be more useful in supporting the tasks. The various aspects for a potential computer support are discussed.

Afin de mieux connaitre puis d'optimiser les trajectoires suivies par les patients arrivés au stade terminal de leur insuffisance rénale chronique, il a été nécessaire de mettre au point des outils permettant de modéliser ces trajectoires complexes. Les différentes modalités de traitement n'ont pas été comparées une à une mais une approche globale a été privilégiée tenant compte d'une vision intégrée où les modalités de traitement sont considérées comme complémentaires et non concurrentielles. Ce travail de modélisation a utilisé des modèles à compartiments avec prise en compte de risque concurrents et un modèle de mélange pour données de survie avec fraction non à risque. Les paramètres des modèles ont été estimés à partir des données du registre du Réseau Épidémiologie et Information en Néphrologie (REIN). L'outil de prédiction développé a également pu être alimenté par les données de remboursement de l'assurance maladie (SNIIRAM) sur l'année 2009. Cette première version de l'outil a permis d'évaluer les conséquences en termes d'espérance de vie restreinte à 15 ans et de coût moyen par mois de différentes stratégies simulées de prise en charge des patients en IRCT dans le cadre d'une analyse médico-économique, en partenariat avec la Haute Autorité de Santé. L'objectif final de ce travail sera de proposer des outils d'aide à la décision reposant sur des stratégies de prise en charge les mieux adaptées aux besoins des patients. A terme, les outils développés lors de ce travail pourraient également servir de base à une plateforme de simulation afin d'accompagner les décideurs publics lors de la réflexion sur les schémas d'organisation sanitaire / In order to better understand and then optimize the trajectories followed by end-stage renal disease patients, it was necessary to develop tools to model these complex trajectories. The different treatment modalities were not compared but a comprehensive approach was preferred taking into account an integrated vision where treatment modalities are considered complementary and non-competitive. We used compartments models which took into account competitive risk and a mixture model for survival with fraction not at risk. The model parameters were estimated from the data from the Renal Epidemiology and Information Network registry. Reimbursement data from the national health insurance (SNIIRAM) were also used. The prediction tool developed was used to evaluate the consequences in terms of expected 15- years restricted lifetime and average cost per month for different strategies in a medicoeconomic analysis, in partnership with the Haute Autorité de Santé. The final aim of this work is to offer decision support tools based on strategies best adapted to patients’ needs. The tools developed in this work could also serve as a basis for a simulation platform to accompany public decision-makers in their reflection on health organization

Composants de systèmes de sûreté nucléaire sont en général très fiable, ce qui conduit à une difficulté de modéliser leurs comportements de dégradation et d'échec en raison de la quantité limitée de données disponibles. Par ailleurs, la complexité de cette tâche de modélisation est augmentée par le fait que ces systèmes sont souvent l'objet de multiples processus concurrents de dégradation et que ceux-ci peut être dépendants dans certaines circonstances, et influencé par un certain nombre de facteurs externes (par exemple la température, le stress, les chocs mécaniques, etc.).Dans ce cadre de problème compliqué, ce travail de thèse vise à développer un cadre holistique de modèles et de méthodes de calcul pour l'analyse basée sur la fiabilité et la maintenance d'optimisation des systèmes de sûreté nucléaire en tenant compte des connaissances disponibles sur les systèmes, les comportements de dégradation et de défaillance, de leurs dépendances, les facteurs influençant externes et les incertitudes associées.Les contributions scientifiques originales dans la thèse sont:(1) Pour les composants simples, nous intégrons des chocs aléatoires dans les modèles de physique multi-états pour l'analyse de la fiabilité des composants qui envisagent dépendances générales entre la dégradation et de deux types de chocs aléatoires.(2) Pour les systèmes multi-composants (avec un nombre limité de composants):(a) un cadre de modélisation de processus de Markov déterministes par morceaux est développé pour traiter la dépendance de dégradation dans un système dont les processus de dégradation sont modélisées par des modèles basés sur la physique et des modèles multi-états; (b) l'incertitude épistémique à cause de la connaissance incomplète ou imprécise est considéré et une méthode volumes finis est prolongée pour évaluer la fiabilité (floue) du système; (c) les mesures d'importance de l'écart moyen absolu sont étendues pour les composants avec multiples processus concurrents dépendants de dégradation et soumis à l'entretien; (d) la politique optimale de maintenance compte tenu de l'incertitude épistémique et la dépendance de dégradation est dérivé en combinant schéma volumes finis, évolution différentielle et non-dominée de tri évolution différentielle; (e) le cadre de la modélisation de (a) est étendu en incluant les impacts des chocs aléatoires sur les processus dépendants de dégradation.(3) Pour les systèmes multi-composants (avec un grand nombre de composants), une méthode d'évaluation de la fiabilité est proposé considérant la dépendance dégradation en combinant des diagrammes de décision binaires et simulation de Monte Carlo pour réduire le coût de calcul. / Components of nuclear safety systems are in general highly reliable, which leads to a difficulty in modeling their degradation and failure behaviors due to the limited amount of data available. Besides, the complexity of such modeling task is increased by the fact that these systems are often subject to multiple competing degradation processes and that these can be dependent under certain circumstances, and influenced by a number of external factors (e.g. temperature, stress, mechanical shocks, etc.). In this complicated problem setting, this PhD work aims to develop a holistic framework of models and computational methods for the reliability-based analysis and maintenance optimization of nuclear safety systems taking into account the available knowledge on the systems, degradation and failure behaviors, their dependencies, the external influencing factors and the associated uncertainties.The original scientific contributions of the work are: (1) For single components, we integrate random shocks into multi-state physics models for component reliability analysis, considering general dependencies between the degradation and two types of random shocks. (2) For multi-component systems (with a limited number of components):(a) a piecewise-deterministic Markov process modeling framework is developed to treat degradation dependency in a system whose degradation processes are modeled by physics-based models and multi-state models; (b) epistemic uncertainty due to incomplete or imprecise knowledge is considered and a finite-volume scheme is extended to assess the (fuzzy) system reliability; (c) the mean absolute deviation importance measures are extended for components with multiple dependent competing degradation processes and subject to maintenance; (d) the optimal maintenance policy considering epistemic uncertainty and degradation dependency is derived by combining finite-volume scheme, differential evolution and non-dominated sorting differential evolution; (e) the modeling framework of (a) is extended by including the impacts of random shocks on the dependent degradation processes.(3) For multi-component systems (with a large number of components), a reliability assessment method is proposed considering degradation dependency, by combining binary decision diagrams and Monte Carlo simulation to reduce computational costs.