Optimal CyberSecurity Staffing PlanOR/SYST 699 Final Report

Jennifer Krajic, Kendrick van Doorn, Thomas Lepp

1

Contents1.0 Executive Summary 4

2.0 Background 5

2.1 IDS 5

2.2 Literature Review and Findings 6

2.3 Problem Statement 7

3.0 Problem Scope 8

3.1 Primary Problem Requirements 8

4.0 Technical Approach (Assumptions / Limitations) 11

4.1 Assumptions 11

4.2 Approach 11

4.2.1 Time Period Analysis 11

4.2.2 Model Architecture 12

4.2.3 Model Part 1: Input 12

4.2.4 Model Part 2: Optimize 15

4.2.5 Model Part 3: Assign 17

4.3 Results 21

5.0 Sensitivity Analysis 22

6.0 Evaluation 25

7.0 Recommendations and Future Work 26

8.0 References 27

9.0 Appendix A 28

10.0 Appendix B 29

2

Table of TablesTable 1: Time Periods and Frequency of Alerts 9Table 2: Alert Frequency Mean Arrival Rate 10Table 3: Time Period to Minimum Payroll Total Cost Analysis 11Table 4: Analyst Alert Completion and Income Per Hour 16Table 5: Weekend Date Constraints 23

Table of FiguresFigure 1: Intrusion Detection System 5Figure 2: Alert Demand Frequency 9Figure 3: Poisson vs Average Alert Distribution for Seven Days 13Figure 4: Model Part 1 Output 14Figure 5: Equations of Minimization Staffing Problem 15Figure 6: Shift Pattern by Analyst Type 16Figure 7: Demand Versus Supply of Alert 16Figure 8: Cross Reference of Shift Pattern to Analyst 17Figure 9: Part 3: Assign 18Figure 10: 14-Day Intermediate Analyst Schedule 19Figure 11: 14-Day Junior Analyst Schedule 20Figure 12: 14-Day Senior Analyst Schedule 20Figure 13: Model Results Alert to Analyst 21Figure 14: 14-Day Senior Analyst Work Schedule with Weekend Constraint 22Figure 15: 14-Day Constraint Identified 23Figure 16: 14-Day Senior Analyst Work Schedule without Weekend Constraint 23Figure 17: Model Validation Supply Vs. Demand 25Figure 18: EVM Earned Value 28Figure 19: EVM CPI & SPI 28

3

1.0 Executive Summary

A CyberSecurity Operations Center (CSOC) protects against emerging CyberSecurity threats by analyzing all alerts, within a short turnaround time period. The alerts are received from strategically placed sensors in a network that collects data. The CSOC employs varying skill levels of analysts, categorized by Junior, Intermediate, and Senior, for the initial investigation of all alerts. There are different payroll costs and expected alert analysis rates associated with each skill level.

The Optimal CyberSecurity Staffing Plan project’s objective is to find an optimal CyberSecurity analyst-staffing plan, such that a payroll cost of the workforce is minimized. A three-part model, which builds upon itself, was created and delivered by the project team. The model was developed with Python code, utilizing Gurobi Solver for optimization.

Alert demand is generated from a Poisson distribution, with varying alert arrival rates: high, moderate, or low. Next, the model solves for feasible shift patterns within identified constraints. Alert arrival quantity per time period and feasible shift patterns determine the number and type of analysts required. Using the minimum number of work schedules required, the model then creates analyst schedules by assigning shifts using a First Fit Decreasing (FFD) heuristic. The FFD sorts the shifts patterns into decreasing order, then assigns the shifts patterns to the first schedule that the shift pattern fits.

In conclusion, the Optimal CyberSecurity Staffing Plan team delivered a working model, a static staffing schedule for the CSOC, and has multiple future work recommendations to continue this project. Future recommendations include the creation of input preferences for each employee and a manager friendly schedule that allows for adjustments. In addition, another area of analysis will be for an alert backlog analysis to be performed, including a review of surge analysts to ensure all alerts are reviewed within a set time period.

4

2.0 Background

A CSOC protects against emerging CyberSecurity threats. Strategically placed sensors in a network collect data which is analyzed by an intrusion detection system (IDS). Based on automated techniques, such as pattern matching, alerts are issued by an IDS. The CSOC employs CyberSecurity analysts who work in shifts and investigate these alerts.

2.1 IDS

The IDS is a device or software application that monitors a network or system for malicious activity of policy violations. The main detection methods are signature-based, anomaly-based, and stateful protocol analysis. Some limitations are packet noise, false-alarms, legacy software, and lag time.

Figure 1: Intrusion Detection System

Figure 1: Intrusion Detection System displays the traditional workflow of alerts being passed to analysts at a CSOC for review. The workflow begins with multiple sensors, placed all over the world, actively monitoring network traffic that is of concern for the CSOC’s organization. The data is then transferred to the IDS or Security Information and Event Management (SIEM) system. The systems have libraries of previous attacks and behaviors that have been viewed before.

5

The IDS or SIEM will take the incoming data, process it against set rules, correlate multiple alerts, and transfer alerts to the CSOC. The number of alerts that can be transferred to the CSOC are limited to the amount of network availability the IDS is able to analyze.

Once the alerts are transferred to the CSOC, they must be processed within an established amount of time due to the high risk of organizations security, information, and financial accounts. To accomplish this task, there must be enough analysts on staff to perform a pre-review process of categorizing complexity and checking for false-negatives. The most significant alerts are passed onto following stages, while anomalies are added to the database of previous alerts.

CyberSecurity is a dynamic field that requires constant vigilance and adaptation to evolving threats. An IDS is utilized to generate alerts for CyberSecurity analysts to review for potential danger and risk to the network. In recent news, data breaches across both private and commercial sectors have drastically increased. The data breaches have cost individuals and companies millions of dollars in damages and credibility.

At the core of CyberSecurity is monitoring. Monitoring is the critical action that is seen across all CyberSecurity methodologies. It is no longer a viable method to configure a system or network to be “secure.” The dynamic nature of CyberSecurity threats today requires constant monitoring for anomalies or atypical events in the system and network. Monitoring can include system logs, vulnerability scans, and IDS alerts. Without complete monitoring coverage, a system, network, or company is at risk.

2.2 Literature Review and Findings

Optimal CyberSecurity Analyst Staffing Plan builds on the current 12-hour static staffing plan found in the research article “Dynamic Scheduling of CyberSecurity Analysts for Minimizing Risk Using Reinforcement Learning”. Since the staffing plan does not provide overlapping schedules and adaptions to variations in alert generation during a day, the Optimal CyberSecurity Analysts Staffing Plan team created a schedule that adapts to alert demand fluctuations. This is accomplished by using varying shift patterns to reduce the need for dynamic surge support and not burdening the next shift.

Starter parameters used from the research article “Dynamic Scheduling of CyberSecurity Analysts for Minimizing Risk Using Reinforcement Learning” were alert investigation rates for the three levels of analysts: Junior, Intermediate, and Senior and the assumed Poisson moderate alert arrival rate of 9 alerts per hour per sensor.

6

2.3 Problem Statement

A CSOC protects against emerging and dynamic CyberSecurity threats. It is critical that all alerts are reviewed in a timely manner to reduce risk to the organization, while minimizing payroll costs. There are multiple variables such as different shift options (4 -12 hours/shift), night shifts, weekend shifts, off-work times, staffing constraints, and analysts’ skill levels requiring consideration in the creation of a staffing schedule.

7

3.0 Problem Scope

The Optimal CyberSecurity Analyst Staffing Plan Team is tasked with delivering a 14-day staffing schedule model for a CSOC that minimizes payroll costs. This must be accomplished by scheduling an adequate number of analyst (Junior, Intermediate, and Senior) for the initial investigation of varying alert generation patterns. The staffing schedule will include variable overlapping shift patterns that satisfy staffing requirements.

Deliverables:

● Staffing Model and Schedule● Sensitivity Analysis of Results● Model Validation● Recommendations for Next Steps

Areas that are out of scope include:

● False negative alerts are not incorporated into the types of alerts that are received by the analysts.

● Updates and changes to the IDS are not included in the analysis and expectations of the model.

● Manager friendly and customizable schedules, allowing for employee leave and personal preferences are not included in the model.

3.1 Primary Problem Requirements

The staffing plan must meet the following shift and staffing requirements:

● A minimum of two analysts must be on schedule every hour, with at least one being a Senior.

● A shift length can range from 4 to 12 hours.● A minimum of 8 hours off-work must be between shifts for employees.● Analysts require every other weekend off-work.● Analysts cannot work more than six consecutive days.

8

Figure 2: Alert Demand Frequency

In addition to staffing and shift requirements, alert volume ranges from high to low and repeats weekly. Figure 2: Alert Demand Frequency illustrates the Poisson distribution of each day. To generate the Poisson distribution the team assumed there were 10 sensors available for collecting information for the IDS.

Time Period Frequency of Alert

06:00 AM to 10:00 AM High

10:00 AM to 02:00 PM Moderate

02:00 PM to 06:00 PM High

06:00 PM to 10:00 PM Moderate

10:00 PM to 02:00 AM Low

02:00 AM to 06:00 AM LowTable 1: Time Periods and Frequency of Alerts

Table 1: Time Periods and Frequency of Alerts displays the six, four-hour time periods. Each time period has a frequency of alerts that is high, moderate, or low. Each of these has a mean arrival rate shown in Table 2: Alert Frequency Mean Arrival Rate.

Alert Frequency Mean Arrival Rate

High 12

9

Moderate 9

Low 6Table 2: Alert Frequency Mean Arrival Rate

10

4.0 Technical Approach (Assumptions / Limitations)

4.1 Assumptions

Assumptions made for developing the Optimal CyberSecurity Analyst Staffing plan are as follows:

● Alerts are batched for each time period and the batch is presented at the beginning of the time period.

● All alerts are investigated by the end of the time period received. ● Analysts work the entire time period. ● Investigation rates incorporate nominal work breaks.● Each weekday has the same alert pattern and quantity as the same weekday in

the following week. An example of this is Monday is week 1 has the same pattern and alert quantity as Monday in week 2.

4.2 Approach

4.2.1 Time Period Analysis

An initial analysis was conducted to determine alert analysis time period lengths and shift options. Time period increments analyzed were 1 and 4 hour lengths. The worker work hour varied from 4 to 12 hours.

Scenario Period Increment Shift Options Min Payroll

Total Cost24 Hour Pd.

Analyst Shifts

1 1 hour 4-12 hours $16,412Junior – 2

Intermediate – 2Senior – 25

2 1 hour 4, 8, 12 hours $16,412Junior – 2

Intermediate – 2Senior – 25

3 4 hour 4, 8, 12 hours $16,412Junior – 2

Intermediate – 2Senior – 25

Table 3: Time Period to Minimum Payroll Total Cost Analysis

Table 4: Time Period to Minimum Payroll Total Cost Analysis displays the analysis performed on three options. This analysis was performed on a single day, 24 hours. The alerts per hour or four-hour time period were set so that all alerts arriving in the 4-hour

11

time period were the same each hour of that period.

Option 1 displays the analysis performed on 1 hour time periods, shift patterns to include work hours of 4 to 12 hours. This yielded a recommendation of 2 Junior, 2 Intermediate, and 25 Senior workers to meet the demand requirement. The minimum payroll total cost of this analysis is $16,412.

Option 2 displays the analysis performed on 1 hour time periods, shift patterns to include work hours of 4, 8, or 12 hours. This yielded a recommendation of 2 Junior, 2 Intermediate, and 25 Senior workers to meet the demand requirement. The minimum payroll total cost of this analysis is $16,412.

Option 3 displays the analysis performed on 4-hour time periods, shift patterns to include work hours of 4, 8, or 12 hours. This yielded a recommendation of 2 Junior, 2 Intermediate, and 25 Senior workers to meet the demand requirement. The minimum payroll total cost of this analysis is $16,412.

As seen from the initial test, the total costs and workforce required to meet demand are the same across the three scenarios. Since Option 3 only had 26 possible shift patterns for 1 day compared to Option 1 and 2 that had with 224 possible shift patterns for 1 day, the team concluded to design the model around 4-hour time periods, with employees working 4, 8, or 12-hour time periods.

4.2.2 Model Architecture

The mathematical model was created in three major parts, which build upon each other, and utilizes a combination of python coding, integer programming, and the FFD Heuristic.

Input: Calculate average alert arrival rates and feasible shift patterns Optimize: Minimize payroll costs Assign: Minimize staff and create staff schedules

4.2.3 Model Part 1: Input

Identifying hourly demand based on average alerts is the initial step of the optimization model. Determining all feasible shift patterns for 14 days, with four-hour time periods, has 284 possibilities, while shift patterns for 1 day has 26possibilities. Therefore, the model begins with the creation of alert demand for 1 day and repeats seven times to generate demand values for 1 week. Each of the seven days follows the varying alert pattern described in section 3.1 Primary Problem Requirements and corresponds to a

12

day of the week shown in Figure 4: Poisson vs Average Alert Distribution. The varying alert generation rates and seven day patterns are developed by a Poisson distribution, written and executed using Python. The alert demand used for the model was based off a Poisson distribution plus 2 standard deviations. Sunday is the first day and the seventh day is Saturday of the week. The Poisson distribution is utilized due to the number of alerts is bounded by network throughput of the IDS, which control of is outside of scope.

Figure 3: Poisson vs Average Alert Distribution for Seven Days

Figure 3: Poisson vs Average Alert Distribution displays the average alert demand in yellow, the average alert demand plus 2 sigma in grey, and the Poisson distribution values in blue. The data utilizes information from both Table 1: Time Periods and Frequency of Alerts and Table 2: Alert Frequency Mean Arrival Rate to generate the distribution. The first seven different days of alerts are mirrored for the following seven days to create a 14-day pattern.

Next, the model identifies all possible shift patterns that meet given requirements provided in Section 3.1 Primary Problem Requirements and the payroll cost for a Junior, Intermediate, or Senior analyst for each shift pattern. Specifically, the feasible shift patterns meets the following staffing constraints:

Analysts can work a range of 4 hours to 12 hours within a single shift. Analysts must receive a minimum of 8 hours off work in-between all shifts.

Payroll costs for each shift pattern is calculated in Part 1: Input. In addition to the base rate for each employee as shown in Table 3: Analyst Type Rate and Alert Analysis per 4-Hour Time Period, two circumstances that increase the payroll cost for each employee are:

Analysts will receive a rate increase by 10% for working between 10 PM and 6 AM.

13

Analysts will receive a rate increase by 10% for 4 hour shifts

The output Part 1: Input is a .CSV file displaying all possible shift patterns that can be assigned to employees during a 24-hour period and the corresponding cost values.

Figure 4: Model Part 1 Output

Figure 4: Model Part 1 Output shows the output of Part 1: Input. There were thirty shift patterns that met the staffing requirements. The six columns of Time Period display a 0 or 1. A 0 shows that the employee is not working during the 4-hour period. A 1 shows the employee is working during the four-hour period. The file is conditionally formatted to highlight each 1 for easier viewing of the shift pattern. The final three columns display the cost of Junior, Intermediate, and Senior employees working the shift.

Each of the rows displays a different, unique work schedule for the 24-hour period. The Model Part 2: Optimize and Part 3: Assign will reference this table that has been created.

14

15

4.2.4 Model Part 2: Optimize

The feasible shift patterns from Figure 4: Model Part 1 Output is the main input of Part 2: Optimize. Part 2: Optimize focuses on minimizing cost and outputs the required number of resources to meet the alert demand from the initial Poisson distribution. Figure 6: Equations of Minimization Staffing Problem displays the equations utilized by the Model.

Figure 5: Equations of Minimization Staffing Problem

The objective function above minimizes the payroll cost of the analysts while meeting the alert demand for each time period. Each analyst is either a Junior, Intermediate, or Senior level with an alert analysis rate shown in Table 4: Analyst Alert Completion and Income Per Hour. At least two analysts must be working during each time period, and at least one Senior analyst much work during each time period.

Analyst Type Number of Alerts per Hour

Income per Hour

Junior 8 Alerts $38Intermediate 10 Alerts $49

Senior 13 Alerts $61Table 4: Analyst Alert Completion and Income Per Hour

16

The output of Part 2: Optimize is the minimization of payroll cost by identifying shift patterns and the number of analysts needed to fulfill the demand of alerts requiring analysis. There are two types of information output: Number of employees of a type working a specific work pattern and the demand versus supply comparison. The identification of shift patterns to fulfill the demand of alerts while minimizing payroll cost. An initial test for the first day was run and documented to display the following output as an example.

Figure 6: Shift Pattern by Analyst Type

Displayed in Figure 6: Shift Pattern by Analyst Type is the number of employees, of a type, working a specific shift pattern. Employee type 1 is Junior, employee type 2 is Intermediate, and employee type 3 is Senior. Each shift pattern number above lines up with the input shift pattern in Figure 4: Model Part 1 Output.

Figure 7: Demand Versus Supply of Alert

17

Displayed in Figure 7: Demand Versus Supply of Alert compares the supply per 4-hour period to the 4-hour demand. This information is valuable and provides an early check to ensure that the difference between supply of employees meeting the demand and the alert demand is minimized.

Figure 8: Cross Reference of Shift Pattern to Analyst

Figure 8: Cross Reference of Shift Pattern to Analyst displays the linkage of number of employees working a specific shift to the input shift patterns from Part 1 to Part 2. Shown with the first arrow, there is a need for three Junior employees to work shift pattern #3 on the first day. This is a four-hour shift running from 10 PM to 6 AM. This cross referencing and display of the number of employees needed to work different schedules allows for an early check on the model’s health.

4.2.5 Model Part 3: Assign

Part 3 of the model is focused on the assignment of employees to a 14-day work schedule utilizing the output from Part 2: Optimize. The calculated patterns from Part 2: Optimize and the number of each type of analyst required for each 4-hour time period to meet demand are inputs for Part 3: Assign. The analysts’ schedules are constructed using the FFD heuristic.

18

The FFD is sometimes referenced as a bin packing problem, as objects of different volumes must be packed into a limited number of bins in a way that minimizes the number of bins used. In the case of Part 3: Assign, the model is working to determine the number of employees required to fulfill the information input from Part 2: Optimize. The FFD begins with the largest shift patterns and then works down to the smallest shift patterns. When assigning shifts to analysts, FFD does not assign analysts to work more than 80-hours and follows the constraints listed in section 3.1 Primary Problem Requirements. The FFD heuristic has a worst-case scenario of:

119

∗Optimality+ 69

Figure 9: Part 3: Assign

Figure 9: Part 3: Assign displays the output of Part 2: Optimize, focused on Intermediate analysts working the first day of the week. As seen, there is a need for 1 Intermediate analyst to work shift pattern 3, 1 Intermediate analyst to work shift pattern 6, and 1 Intermediate analyst to work shift pattern 25.

19

Figure 10: 14-Day Intermediate Analyst Schedule

Figure 10: 14-Day Intermediate Analyst Schedule displays the output of Part 3: Assign. This print out is provided at the end of the model running by Python. Shown in the red outlined area is the first day of the 2-week work schedule that references Figure 10: Part 3: Assign. Viewing the remaining work schedule, the FFD determined that there is a need for 15 Intermediate analysts to meet the scheduling constraints and alert demand. The three work schedules shown in Figure 11 and Figure 12 are the schedules for Junior and Senior analysts, respectively, required to fulfill demand.

20

Assigned

Figure 11: 14-Day Junior Analyst Schedule

Figure 12: 14-Day Senior Analyst Schedule

Shown in Figure 11: 14-Day Junior Analyst Schedule there is a need for 33 Junior Analysts to meet the demand across the 14-day time period. Shown in Figure 12: 14-Day Senior Analyst Schedule there is a need for 39 Senior Analysts to meet the demand across the 14-day time period.

21

4.3 Results

As shown in Section 4.2 Approach, the model produces a work schedule for the 14-day time period. This analysis requires 33 Junior, 15 Intermediate, and 39 Senior analysts to support the alert received over the 14-day time period. Not all employees are full time, and mainly due to the weekend constraints some analysts are scheduled for less than 8 hours of work during the 14-day time period.

Figure 13: Model Results Alert to Analyst

Displayed in Figure 13: Model Results Alert to Analyst is the graphical representation of the number of alerts over the course of the 7-day time period and the number of analysts working. The 7-day time period is mirrored for the second week to create the 14-day time period. The yellow line represents the total workers across the six 4-hour time periods each day. The total worker references the right axis. The Blue represents the Average Demand + 2 sigma of alerts the red is the supply, number of alerts, the analysts are able to analyze and references the left axis. In summary, the simulation run has a 14-day payroll cost of $183,356 meeting the demand of 18,220 alerts.

22

5.0 Sensitivity Analysis

When reviewing the current output models of Part 3: Assign, one can notice additional employees are scheduled to work only weekends. As stated in 4.2.3 Model Part 1: Input, the first day of the 14-day time period is Sunday, and the final day is Saturday. A constraint of the model is that an employee cannot work both weekends of the 14-day time period. This causes the FFD heuristic to utilize additional analysts only to work weekends.

Figure 14: 14-Day Senior Analyst Work Schedule with Weekend Constraint

Shown in Figure 14: 14-Day Senior Analyst Work Schedule with Weekend Constraint, weekend dates are shown in blue highlight. Shown in Table 5: Weekend Date Constraints is the day highlighted above, the weekday, and which weekend it falls on.

Day Weekday Weekend Number

1 Sunday 17 Saturday 28 Sunday 2

14 Saturday 1Table 5: Weekend Date Constraints

23

Figure 15: 14-Day Constraint Identified

Shown in Figure 15: 14-Day Constraint Identified, the red squares identify 18 workers that only work on the first or second weekend. This can be considered additional costs, especially considering the ability to find and retain 18 Senior level analysts who work less than 20 hours on weekends.

Figure 16: 14-Day Senior Analyst Work Schedule without Weekend Constraint

24

Reviewing this information and adjusting the model to not include the weekend constraint yields the data in Figure 16: 14-Day Senior Analyst Work Schedule without Weekend Constraint. Making this adjustment reduces the total number of Senior Analysts required to 25, thus a reduction of 14 Senior Analysts (36%). Applying this to Junior and Intermediate employees accomplishes a reduction of 8 Junior Analysts (21%) and 4 Intermediate Analysts (27%).

Removing the “Weekend Constraint” allows for the number of required employees to be reduced and the required hiring constraints to be limited for the CSOC.

25

6.0 Evaluation

Figure 17: Model Validation Supply Vs. Demand

Shown in Figure 17: Model Validation Supply Vs. Demand, the model was run 20 times, with the original determined staffing schedule, to validate if the schedule of employees could handle 95% of alert demand. As shown, in almost every scenario, the analysts are able to handle the total workload of alerts. In some instances, the alert numbers are higher than the model can handle at that time period. Analyzing the results of the simulation, our model allowed for the initial investigation of over 95% of all alert demand. If the constraint of completing all alerts within the 4-hour time period is relaxed, the model is capable of completing analysis of backlogged alerts within the 14-day time period.

26

7.0 Recommendations and Future Work

After developing the initial model, the team recommends the following for future work and further development of the model:● Creation of input preference for each employee. This will allow a manager to

determine which employees don’t like the night shift or early morning shifts on certain days.

● Development of a manager friendly view of information.● Development of real world work schedules that employees and managers are willing

to work.● Analysis of Senior, Intermediate, and Junior employee analysis rates. The static rates

are set as averages, but in the real world no employee works the exact same number of alerts.

● Analysis of complex and simple alerts that come in and the amount of time required by different analysts to complete the analysis of the alert.

● Analysis of other heuristic models to determine if there is a further optimized possibility.

● Analysis of Surge and backup employees needed to assist with a varying schedule.● Analysis of a backlog of alerts if the number of alerts for one hour are not reviewed

by the staff on hand. Determining if the number of alerts can be completed within agreed upon Service Level Agreements.

27

8.0 References

[1] – Ganesan, R. Jajodia, S., Shah, A. and Cam, H. 2016b. Dynamic Scheduling of CyberSecurity Analysts for Minimizing Risk Using Reinforcement Learning. ACM Trans. on Intelligent Systems and Technology, 8, 1, Article 4 (July 2016), 21 pages. DOI:http://dx.doi.org/10.1145/2882969

[2] – Chen, Bo, Mike Paterson, and Gouchuan Zhang. "ESCAPE'07 Proceedings of the First international conference on Combinatorics, Algorithms, Probabilistic and Experimental Methodologies." LNCS: Lecture Notes In Computer Science (n.d.): 1-11. Web.

[3] - HEGARTYMATHS. "Packing algorithms - First-fit (decreasing) algorithms (Decision Maths 1)." YouTube. YouTube, 14 Feb. 2012. Web. 27 Apr. 2017.

28

9.0 Appendix A

Figure 18: EVM Earned Value

Figure 19: EVM CPI & SPI

29

10.0 Appendix B

Figure 20: Integer Programming Model is the IP model used to determine the required shifts that will satisfy the demand.

Figure 20: Integer Programming Model

30