1216 IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 23, NO.

4, AUGUST 2015

A Robust Optimization Approach to Backup Network

Design With Random Failures
Matthew Johnston, Student Member, IEEE, Hyang-Won Lee, Associate Member, IEEE, and
Eytan Modiano, Fellow, IEEE

Abstract—This paper presents a scheme in which a dedicated the disrupted traffic can be rerouted onto its backup path.
backup network is designed to provide protection from random Preplanned methods of link restoration offer benefits over other
link failures. Upon a link failure in the primary network, traffic is methods in terms of speed and simplicity of failure recovery,
rerouted through a preplanned path in the backup network. We
introduce a novel approach for dealing with random link failures, as no additional dynamic routing is necessary at the time of a
in which probabilistic survivability guarantees are provided to failure [3]. In addition to designing a backup path for each link,
limit capacity overprovisioning. We show that the optimal backup preplanned link restoration requires provisioning of sufficient
routing strategy in this respect depends on the reliability of the spare capacity along each backup path to carry the load of
primary network. Specifically, as primary links become less failed links. Backup paths can share spare capacity and network
likely to fail, the optimal backup networks employ more resource
sharing among backup paths. We apply results from the field of resources to reduce the total cost of protection.
robust optimization to formulate an ILP for the design and ca- Communication networks can suffer from multiple simul-
pacity provisioning of these backup networks. We then propose a taneous failures, for example, if a second link fails before a
simulated annealing heuristic to solve this problem for large-scale first failed link is repaired. Furthermore, natural disasters or
networks and present simulation results that verify our analysis large-scale attacks can destroy several links in the vicinity of
and approach.
such events. Preplanning backup paths for combinations of mul-
Index Terms—Backup network design, random failures, robust tiple failures can be complex and impractical and can lead to
optimization.
significant capacity overprovisioning. Consequently, new ap-
proaches must be considered to offer protection against multiple
I. INTRODUCTION failures.
Spare capacity allocation for link-based protection has

T ODAY'S backbone networks are designed to operate at

very high data rates, now exceeding 10 Gb/s [1]. Conse-
quently, any link failure can lead to catastrophic data loss. In
been studied extensively in the context of single-link fail-
ures [1], [4]–[6]. The objective of these works is to allocate
sufficient protection resources to recover from any single-link
order to ensure fast recovery from failures, protection resources failure. Recently, the authors in [7] proposed the use of a
must be allocated prior to any network failures. This paper deals dedicated backup network to protect against a single failure
with providing protection in networks from multiple random on the primary network. Upon such a failure, the load on the
link failures. failed link is routed on a predetermined path on the backup
A widely used approach for recovery from a link failure is network. The authors provide an integer linear program (ILP)
preplanned link restoration [2], where a backup path between to design an optimal backup network with minimal cost. They
the end nodes of a link is chosen for every link during the show that the cost of the optimal backup network is small
network configuration stage. In the event of a link failure, relative to that of a large primary network. Specifically, they
show that the ratio between the total backup capacity and the
Manuscript received October 23, 2012; revised June 01, 2013 and November total primary capacity tends to zero as the network size grows
27, 2013; accepted April 16, 2014; approved by IEEE/ACM TRANSACTIONS ON
large for certain classes of networks.
NETWORKING Editor S. Ramasubramanian. Date of publication May 09, 2014;
date of current version August 14, 2015. This work was supported by the NSF For many applications, it is insufficient to protect against only
under Grants CNS-1116209, CNS-0830961, and CNS-1017800 and the DTRA single-link failure events. Several authors have extended the re-
under Grants HDTRA1-07-1-0004 and HDTRA-09-1-005. The work of H.-W.
sults of survivability for single-link failures to dual-link fail-
Lee was supported by the Basic Science Research Program through the Na-
tional Research Foundation of Korea (NRF) funded by the Ministry of Science, ures [2], [8], [9]. The work in [10] considers protecting against
ICT and Future Planning under Grant 2012R1A1A1012610. (Corresponding up to three link failures. Most of these works require the pri-
author: Hyang-Won Lee.)
mary network to have multiple disjoint paths between node pairs
M. Johnston is with the Department of Electrical Engineering and Computer
Science, Massachusetts Institute of Technology, Cambridge, MA 02139 USA to survive multiple failures. This assumption is too restrictive
(e-mail: [email protected]). when considering a large number of failures. Additionally, [11]
H.-W. Lee is with the Department of Internet and Multimedia Engineering,
provides a spare capacity allocation approach based on a spe-
Konkuk University, Seoul 143-701, Korea (e-mail:[email protected]).
E. Modiano is with the Laboratory for Information and Decision Systems, cific set of failure events and restricted backup path lengths.
Massachusetts Institute of Technology, Cambridge, MA 02139 USA (e-mail: However, in all of these works, large amounts of spare capacity
[email protected]).
are required if many links can fail simultaneously. The work in
Color versions of one or more of the figures in this paper are available online
at http://ieeexplore.ieee.org. [12] addresses this problem by providing incremental surviv-
Digital Object Identifier 10.1109/TNET.2014.2320829 ability improvements for a fixed amount of additional capacity

1063-6692 © 2014 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
JOHNSTON et al.: ROBUST OPTIMIZATION APPROACH TO BACKUP NETWORK DESIGN WITH RANDOM FAILURES 1217

and shows that a substantial degree of protection can be pro-

vided for limited excess capacity.
Survivability amid multiple failures has also been addressed
in the form of a shared risk link group (SRLG) [13]. An SRLG
is a set of links sharing a common network resource, such that
a failure of that resource could lead to a failure of all links in
the SRLG. Many authors have proposed routing strategies for Fig. 1. Example backup network shown as solid directed links over dotted bidi-
path-based protection against SRLG failures [14]–[17]. These rectional primary network.
works assume that links in an SRLG all fail simultaneously and
deterministically. However, this line of work does not extend to
uncorrelated, nondeterministic failures. network flow problems [21]. We apply these results to design
In this paper, we introduce a new framework for providing backup networks that are robust to the uncertainty in link
protection from multiple random link failures involving prob- failures. This leads to an ILP formulation for backup capacity
abilistic survivability guarantees. Since large-scale attacks and provisioning. We also present a simulated annealing approach
natural disasters can result in multiple links failing randomly, to solve the ILP for large-scale networks.
providing protection from any single failure is insufficient, and The remainder of this paper is organized as follows. In
networks designed for protection against single-link failures Section II, we present the network model and formulate the
often cannot protect against multiple failures. The straightfor- problem of backup network design. In Section III, we consider
ward approach of offering guaranteed protection against any protection for uniform-load primary networks to investigate
random failure scenario is to allocate capacity such that every the impact of link failure probability on backup network design
failure event is protected. However, this approach is impractical and the cost of protection. Robust optimization is introduced in
as it requires enormous amounts of capacity to protect against Section IV to formulate an ILP for general primary link loads,
potentially unlikely events. To address this issue, we take an and a heuristic based on simulated annealing is presented to
alternative approach that provides a probabilistic protection solve it for large networks. We present simulation results in
guarantee. This approach significantly reduces the cost of Section V. In Section VI, we consider several extensions to
protection by guaranteeing recovery from failures with high the survivability model, and we present concluding remarks in
probability. Section VII.
Motivated by the results of [7] and the simplicity of their ap-
proach, we extend the use of a dedicated backup network to
II. NETWORK MODEL
deal with multiple random link failures. We show that a dedi-
cated backup network is a low-cost method of providing pro- Consider a primary network made up of a set of nodes and
tection against random failures, relative to large primary net- a set of directed links connecting these nodes. We assume
works. Specifically, we show a dedicated backup network can throughout that the links are directed, as the undirected case is
often be constructed to provide protection with high probability a specific instance of the directed link case.
using roughly half of the capacity needed to provide full pro- Each link has a given primary link capacity
tection guarantees. Additionally, we show that the structure of , and a positive probability of failure , independent of
the minimum-cost backup network changes with the reliability all other links. Let the random variables equal 1 if link
of the primary network. Specifically, optimal backup networks fails, and 0 otherwise. This probabilistic failure model
for primary networks with a low link-failure probability em- represents a snapshot of a network where links fail and are
ploy a high level of link sharing among backup paths. On the repaired according to some Markovian process. Hence, rep-
other hand, optimal backup networks for primary networks with resents the steady-state probability that a physical link is in a
a high link-failure probability emphasize shorter backup paths failed state. This model has been adopted by several previous
and less capacity sharing. works [6], [22]–[24]. A backup network is to be constructed
Throughout this paper, we assume that links on the primary over the same set of nodes and a new set of links , by
network fail with some probability, and links on the backup routing a backup path for each primary link over the backup
network are free from failure. Often, the links making up the network and allocating capacity to every backup link. We
backup network can be made robust via hardening or shielding, assume that can consist only of links if there is a
thus making them more resistant to failure. This is particularly primary link connecting nodes and . An example backup
relevant for failures due to physical link cuts. Yet, it is possible network is shown in Fig. 1. Note that not all links in will
to extend this work to the case of unreliable backup links, as be used as backup links. Backup paths are routed over the
discussed in Section VI. links in , and thus the resulting backup network topology
To design a backup network under random link failures, consists of the links in that are used by the backup routing
we develop a robust optimization approach to backup ca- . Furthermore, the backup links
pacity provisioning. Robust optimization finds a solution to are designed such that failures can only occur in the primary
a problem that is robust to uncertainty in the optimization network. For each primary link , a path on the backup
parameters [18]–[20]. In [20], Bertsimas and Sim propose a network is chosen such that in the event that fails, the
novel linear formulation with an adjustable level of robustness. traffic load on is rerouted over the backup path. Let
These techniques have previously been successfully applied to if link uses backup link in its
1218 IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 23, NO. 4, AUGUST 2015

TABLE I survivability metrics that can be considered in this setting, the

LIST OF COMMONLY USED NOTATIONS choice of which will impact the network design. One can con-
sider survivability from a primary link perspective. In this case,
one constrains the joint probability that a primary link fails and
its backup path has insufficient capacity. Alternatively, one can
consider a survivability constraint on the entire backup network,
rather than on each backup link independently. The backup-net-
work constraint restricts the probability that any of the backup
links have insufficient capacity. It is straightforward to show
that the primary-link and backup-network constraints can be
written in the form of the backup-link constraint in (2) using a
union-bound argument. Therefore, we will use the backup-link
constraint of (2) throughout this paper.
We start by considering the backup network design problem
for networks with uniform primary link loads. In Section IV,
this is generalized to primary networks with arbitrary primary
link capacities.

backup path. Hence, represents the III. UNIFORM-LOAD NETWORKS

backup path for the primary link .
A capacity is allocated to each backup link Any primary network can be represented by a fully connected
such that can support the increased load due to a random graph, with for links that are not in the primary net-
failure scenario with probability , where is a design work. However, in order to form an intuitive understanding of
parameter. Naturally, as becomes smaller, more capacity is re- the general problem, we first explore the backup-network design
quired on the backup network. Throughout this work, we only problem for the special case where each primary link has unit
consider the case where since no backup capacity is re- capacity, i.e., . The capacity required on
quired for . A summary of the notations throughput this each backup link is dictated by the reliability constraint in (2).
paper is provided in Table I. Let be the number of primary links for which backup link
Each primary link has exactly one path in the backup network is part of the backup path. In other words
for protection, and the links in this path can be shared among
backup paths for multiple primary links. The goal is to construct (5)
a minimal cost dedicated backup network. The problem can be
formulated as follows:
Let be a random variable representing the number of
failed primary links using as part of their backup paths,
Minimize:
i.e.,
(1)
(6)

Subject To:
Since each is an i.i.d. Bernoulli random variable with pa-
rameter , is a binomial random variable with parameters
(2)
and . Furthermore, as all the primary links have unit ca-
pacity, (2) can be rewritten as
if
if
(7)
o.w.
(3)
(4)
The constraint in (3) is a standard flow conservation con-
straint for the routing of a single backup path for each primary (8)
link. The probabilistic constraint (2) is the capacity constraint,
from which the backup capacities are computed. Backup link Equation (8) uses the cumulative distribution function (CDF) of
must carry the load of each failed primary link that it pro- the binomial distribution. For each link , let be
tects. Constraint (2) restricts the probability that the load on the minimum value of satisfying (8). Clearly, the capacity
due to failures exceeds the backup capacity provisioned required on a backup link increases with the number of primary
on . This survivability metric, which considers the relia- links it protects, and it decreases as the probability of failure de-
bility of each backup link independently, is referred to as the creases. Additionally, as decreases, more capacity is required
backup-link survivability metric. There are a number of possible on each backup link.
JOHNSTON et al.: ROBUST OPTIMIZATION APPROACH TO BACKUP NETWORK DESIGN WITH RANDOM FAILURES 1219

The left-hand side of the above inequality can be upper-bounded

as follows:

(12)
(13)
(14)
(15)
(16)

where the inequality in (13) follows from Bernoulli's Inequality,

and the inequality in (16) follows since the number of primary
links protected by each backup link is necessarily smaller than
, the total number of primary links. Therefore, for values of
Fig. 2. Sample backup network link placement to protect a 6-node, fully con- satisfying (9), protecting against single link failures is sufficient.
nected primary network. The dotted lines represent the primary network, and the
solid lines represent the backup links. (a) Cycle protection. (b) Two-hop protec-
tion. (c) One-hop protection. Note that in order to require protection to begin with, we must
have . Therefore, if , then a backup network
designed for single link failures is optimal for
A. Impact of Link Failure Probability
To gain intuition about the optimal backup network design, (17)
we compare three backup routing schemes, shown in Fig. 2,
and show that backup network performance depends on the link Therefore, in the scenario of Fig. 2, the cycle protection
failure probability. In the cycle protection scheme of Fig. 2(a), scheme yields the optimal backup network when
each primary link has a backup path lying in a single
Hamiltonian cycle through the network. This is the minimum- (18)
cost backup network providing protection against a single-link
failure [7]. Each backup link in this cycle requires unit capacity
since the total number of primary links is . As dis-
to protect against a single-link failure, resulting in a total cost
cussed above, the total backup capacity of cycle protection is
of for an -node network. Due to network symmetry, each
given by , which equals when (18) is
backup link protects half of the primary links. Therefore, in
satisfied.
order to use this scheme to provide protection from a random
For sufficiently large values of , the backup capacity re-
number of failures with high probability, a total backup capacity
quired by this topology is since
of is required, where
for close to 1. This capacity can be reduced by considering the
is the smallest value of satisfying (8).
scheme in Fig. 2(c), where the backup network is a mirror of the
For small values of , only a small number of links will
primary network, and the backup path for is the one-hop
likely fail, and in this case, it is sufficient to provide protec-
path from to . Since each backup link offers protection to a
tion against a small number of failures. Therefore, it is con-
single primary link, the total capacity required is
ceivable that for sufficiently small , the optimal backup net-
. For all values of , .
work topology is the same as the optimal topology for protecting
Thus, the mirror scheme requires a factor of less capacity
against single-link failures [such as the one in Fig. 2(a)]. Specif-
than the cycle scheme for primary networks with a high proba-
ically, a backup topology protecting against single-link failures,
bility of link failure.
as designed in [7], is sufficient for our problem if the probability
It is clear that for values of close to 1, each link requires
of having more than one link failure is less than . The following
dedicated backup capacity to protect against its probable failure.
proposition characterizes the region over which it is sufficient
Consequently, a shortest-path backup routing scheme, as pro-
to provide protection against only a single failure.
vided by the one-hop protection scheme, minimizes the total
Proposition 1: Let be the total number of primary links.
backup capacity. For example, if the probability that every link
Then, protecting against single-link failures is sufficient if
fails is greater than , then every primary link requires dedicated
backup capacity, and therefore the one-hop topology is optimal.
(9) While the one-hop protection scheme is preferred in the high-
regime, other schemes are more capacity-efficient for smaller
Proof: Assume that a link is used as a backup by values of . Consider the two-hop scheme in Fig. 2(b), where
primary links. Protecting against a single failure is sufficient if node 1 serves as a relay node for every backup path. The pri-
mary links from node 2 to every other node share the backup
(10) link (2, 1) and, similarly, the primary links from all nodes to
(11) node 2 share the backup link (1, 2). Extending this to an -node
1220 IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 23, NO. 4, AUGUST 2015

the ratio between the total capacity of the optimal backup net-
work and that of the primary network can be upper-bounded as
the primary network size grows large by the following:

(21)

Proof: The optimal total backup capacity is bounded by

that of the two-hop scheme considered in Fig. 2(b)

(22)

Consider the behavior of when is large. Recall that

is the required number of primary links out of that
Fig. 3. Comparison of three protection schemes for an fully connected need to be protected to ensure a probability of error of . Fix a
network with unit load and . , and by the weak law of large numbers (WLLN)

network, each backup link protects primaries, and there

are backup links. Thus, (23)
.
The three aforementioned routing schemes are compared in
Fig. 3 for a fully connected network with 50 nodes and varying
probability of link failure. The cycle-protection scheme, which Therefore, as gets large, (24)
is sufficient
is optimal in the single-failure scenario, is optimal for very small to meet the probability requirements (for any positive ). In the
values of ( ), but requires excessive capacity for limit of large , the inequality in (22) reduces to
larger . For small values of beyond that region, the two-hop
routing strategy outperforms the other two strategies. Once ex-
ceeds roughly 0.25, there is no longer a benefit to sharing backup (25)
resources, and the one-hop starts to outperform the two-hop
schemes. Hence, it is clear that the optimal backup network
topology depends on the reliability of the primary network. This
is further analyzed in Section IV where the problem is formu- Therefore, the size of the backup network is a small frac-
lated for general primary link capacities. tion of the size of the primary network since is usually small.
Consequently, a backup network designed using the backup-link
B. Scaling Properties of Backup Network Capacity survivability constraint is a low-cost method of providing pro-
tection against random failures in addition to single-link fail-
Consider the cost of the backup network with respect to that ures. This result is consistent with [7], in that as the primary
of the primary network. Let be defined as network size grows large, approaches zero under the single-
failure model. Additionally, there has been work in [12] inves-
tigating the relationship between capacity and expected traffic
(19) loss.

IV. GENERAL-LOAD NETWORKS

That is, is the ratio of the total capacity of the optimal backup Next, we develop a formulation for general primary link
network to that of the primary network. In [7], the authors show loads. First, we apply the robust optimization results from [20]
that this ratio tends to 0 asymptotically as the network size gets to formulate a nonlinear program for backup capacity provi-
very large for specific networks and single-failure protection. sioning and develop an equivalent integer linear formulation in
For fully connected, uniform-load networks, the optimal backup terms of new parameters . We show that the choice of these
network under single-failure protection is shown in Fig. 2(a), parameters affects the amount of capacity provisioned, and
and for this topology hence the probability of insufficient backup capacity. Then, we
add constraints to directly compute these parameters, yielding
(20) a solution satisfying the probabilistic constraint in (2).

Conversely, for protection against random failures, the ratio A. Robust Optimization Formulation
in (19) can be upper-bounded using the following proposition. In the case of uniform link loads, capacity is allocated to the
Proposition 2: Assuming a fully connected primary network backup network by computing for each link .
with unit-capacity on each link and probability of link failure , The backup capacity provisioned is the number of primary link
JOHNSTON et al.: ROBUST OPTIMIZATION APPROACH TO BACKUP NETWORK DESIGN WITH RANDOM FAILURES 1221

failures protected against, as a function of , , and . How- The value of determines the probability of protection.
ever, this approach does not apply directly to nonuniform pri- While should be chosen such that (2) is satisfied, for now
mary link loads, as different links will require different capaci- we fix the value of for each link. The capacity constraint in
ties to provide protection. In order to mathematically formulate (28) replaces the probabilistic constraint in (2), leading to the
the problem for general link loads, we will use techniques from following nonlinear optimization problem.
the field of robust optimization.
Robust optimization finds a solution to a problem that best Minimize:
fits all possible realizations of the data, when that data is sub-
ject to uncertainty. In [20], the authors propose a novel formula-
tion with an adjustable level of conservatism for such problems.
Their approach is to introduce an optimization parameter and
provide sufficient capacity to support all scenarios in which any Subject To:
of the demands exceeds their mean. The solution is guaran-
teed to be robust for those scenarios and is shown to be robust
for all other scenarios with high probability, determined by .
Robust optimization techniques have been successfully if
applied to different network design problems previously if
[25]–[28]. The work in [27] applies the robust optimization o.w.
results of [20] to solve the problem of allocating capacity to (29)
support traffic uncertainty. Given an average traffic demand and
a peak power demand, the authors formulate the robust network The above is nonlinear due to the backup capacity constraint
design problem to support some of the demands reaching their in (28), but it can be reformulated as an ILP using duality tech-
peak intensity, using the fact that not all demands will reach niques similar to [20], detailed in the Appendix. The following
their peak simultaneously. In [27], the demand uncertainty is an equivalent formulation to (29):
arises due to traffic intensity variation, whereas in our paper,
the demand uncertainty on the backup network arises due to Minimize:
the uncertainty in which links will fail. The work in [26] uses
this approach to compute the realized robustness of networks
designed with a certain degree of robustness, exploring the
sensitivity the traffic parameters. The work in [25] elaborates
on this problem, determining the correct amount on peak traffic Subject To:
intensities to support to provide robustness guarantees.
A similar approach can be applied to the problem of backup
network design for general link loads, where the uncertainty is
in the number of primary links that fail. Consider allocating ca-
pacity on link to protect against any scenario where up to if
of the primary links utilizing for protection if
fail. Clearly, for the specific case of uniform loads, the required o.w.
backup capacity is just , and as shown in Section III,
is given by under the constraint in (2). For gen-
eral loads, is not the bandwidth that needs to be (30)
allocated, as in Section III, but rather the number of primary
links for which to provide protection. To extend this idea, let Clearly, if fewer than links in fail, the capacity al-
be the set of primary links protected by backup link , i.e., located in (28) will be sufficient. Therefore, the probability of
. Let be a set of primary links in insufficient backup capacity can be upper-bounded using the tail
with the largest capacities. Thus, for any , we probability of a binomial random variable
have
(31)
(26)
The backup capacity required to protect against any pri-
The capacity allocated in (27) is sufficient to meet the relia-
mary link failures is given by
bility constraint in (31) with probability if .
(27) However, is an optimization variable, on which depends.
Thus, the remaining task is to modify (30) to directly compute
the value of for each link using an ILP formulation.
In a complete form, this constraint can be expressed as
B. Complete Formulation
Since cannot be computed analytically, we create a
(28) table a priori in which the th entry equals ,
1222 IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 23, NO. 4, AUGUST 2015

computed numerically. We develop an ILP that leads to the

direct computation of in order to index the table.
To compute , let if , and 0 otherwise.
The following constraints are introduced:

(32) if
if
o.w.
Constraint (32) enforces to be equal to 1 for only one value
of for each backup link
(39)
(33) This formulation calculates the backup paths and capacity al-
location for a dedicated backup network satisfying the surviv-
Constraint (33) ensures that the number of primary links uti- ability constraint in (2).
lizing a backup link is equal to the value of for which
C. Simulated Annealing
. Consequently, can be represented by the following:
The ILP in (39) can be directly solved for small instances,
but becomes intractable for large networks. There are a number
(34)
of heuristic approaches to solving ILPs, such as randomized
rounding, tabu search, and simulated annealing. Here, we em-
The capacity constraint of (30) is rewritten as ploy a simulated annealing approach to estimate the backup path
routing in (39).
(35) Simulated annealing (SA) is a random search heuristic that
can be used to find near-optimal solutions to optimization prob-
lems [29]. The algorithm begins with an arbitrary feasible solu-
Since the product is nonlinear, another set of opti- tion, with a cost computed with respect to an objective func-
mization variables is added to represent this product in linear tion. Then, a random perturbation is applied to the solution,
form. Let be a nonnegative variable satisfying the following and the cost is reevaluated. The new solution is probabilisti-
constraints: cally accepted based on the relationship between the two costs.
A positive probability of moving to a worse solution avoids the
(36) problem of being trapped in a local minima. SA has been used
(37) previously on network survivability problems [30].
(38) For a fixed backup path routing, the computation of the op-
timal backup capacity is straightforward. Therefore, we use
In the above equations, is a large number such that simulated annealing to estimate the backup path routing. For the
. When , then , and constraints problem in (39), the solution at each SA iteration is the backup
(37) and (38) force to 0. On the other hand, if , con- path for each primary link, and the cost is the total backup ca-
straint (36) will force , which at the optimal solution pacity, computed using (28). Perturbations are applied to this so-
will be satisfied with equality. These constraints lead to an ILP lution by randomly recomputing the backup path for a randomly
formulation for backup network design, given in (39). chosen primary link. This recomputation is done by choosing
The following is an ILP formulation for the design of a ded- random links starting from the source node and ending at the
icated backup network to protect against random failures: destination node. The current network with cost is mod-
ified by changing a single backup path, and the network cost
Minimize: is recomputed. The new backup network is accepted with
probability , where

(40)
Subject To:
Hence, better solutions are unconditionally accepted, and
worse solutions are accepted with probability . The parameter
in (40) represents the ”temperature” of the system. At high
temperatures, there is a high probability of accepting a solution
with a larger cost than the current solution. This prevents the
algorithm from getting trapped in a local minima. The temper-
ature decreases after a number of iterations depending on the
network size by , for . SA cannot escape
local minima if is too small, but high values of result in
JOHNSTON et al.: ROBUST OPTIMIZATION APPROACH TO BACKUP NETWORK DESIGN WITH RANDOM FAILURES 1223

Fig. 5. 14-node NSFNET backbone network (1991).

Fig. 4. Optimal backup networks shown as solid links over dotted primary net-
works for different probabilities of link failure. Designed using . (a)
. (b) . (c) .
Fig. 6. Backup network (solid) shown for the NSFNET (dotted) with the re-
striction that the backup network must be a subgraph of the primary network.
TABLE II The primary network here assumes a probability of link failure of 0.075, and
BACKUP NETWORK CAPACITY REQUIRED FOR TOPOLOGIES DESIGNED USING the backup network is designed for .
DIFFERENT STRATEGIES. IN EACH DESIGN

Fig. 7. Backup network (solid) shown for the NSFNET (dotted) with the re-
long computation times. Eventually, becomes small enough striction that the backup network must be a subgraph of the primary network.
that the probability of accepting a worse solution approaches The primary network here assumes a probability of link failure of 0.1, and the
zero. At this point, the algorithm terminates and returns the backup network is designed for .
resulting backup network.
There are only limited theoretical results on the convergence
The table shows that for , the two-hop protection
time of SA, which is known to be highly problem-dependent.
scheme is optimal, and for , the one-hop protection
Regardless, SA approaches are widely used in practice [29]. The
scheme is optimal. Furthermore, the simulated annealing
choice of parameters leads to an inherent tradeoff between the
heuristic performs very close to optimal for different values
accuracy of SA and its convergence time. As the number of it-
of . Clearly, the optimal topology depends on the probability
erations before a temperature reduction increases, the accuracy
of link failure, and it is therefore necessary to use a different
of the SA approach improves at the expense of increased con-
backup routing scheme depending on the link failure probabil-
vergence time.
ities.

V. NUMERICAL RESULTS A. Simulated Annealing on Unit-Load Networks

To begin with, consider a 5-node, fully connected topology The heuristics can be extended to larger networks, but the ILP
where each primary link has unit-capacity. Due to the small size in (39) cannot be solved directly for large networks. Thus, we
of this network, the ILP in (39) can be solved to compute the op- use the SA approach to solve the ILP for backup network design
timal backup topologies for different values of . These backup for large primary networks.
networks are shown in Fig. 4. For small values of , the backup Consider the NSFNET primary network shown in Fig. 5.
topology consists of few links, whereas for large values of , the Each link is bidirectional, with unit capacity in each direction.
backup network resembles the primary network. Table II sum- Our goal is to construct a backup network consisting of links
marizes the results of the backup networks for different values of , where and are connected by a link in the
, using all of the design heuristics discussed. Cycle protection, NSFNET. The survivability constraint in (2) must be satisfied
two-hop protection, and one-hop protection refer to the strate- with probability . The SA algorithm, shown to be near-
gies analyzed in Section III. The optimal column refers to the optimal for smaller networks, is used to compute the backup net-
solution returned by solving the ILP in (39) using CPLEX, and work for this larger example. The resulting backup networks for
the SA column refers to an approach where simulated annealing probability of link failure and are shown in
is used to solve the ILP. Figs. 6 and 7, respectively.
1224 IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 23, NO. 4, AUGUST 2015

TABLE III
COMPARISON OF BACKUP NETWORKS FOR NSFNET WITH DIFFERENT
PROBABILITIES OF PRIMARY LINK FAILURE. NETWORKS WERE DESIGNED
USING . AVERAGE REFERS TO THE AVERAGE NUMBER OF
PRIMARY LINKS BEING PROTECTED BY A BACKUP LINK

Fig. 8. 36-node Sprint backbone network.

TABLE IV
COMPARISON OF BACKUP NETWORKS FOR NSFNET WITH DIFFERENT
PROBABILITIES OF PRIMARY LINK FAILURE. NETWORKS WERE DESIGNED
USING . AVERAGE REFERS TO THE AVERAGE NUMBER
OF PRIMARY LINKS BEING PROTECTED BY A BACKUP LINK

Fig. 9. Backup network (solid) shown for the Sprint backbone network (dotted)
with the restriction that the backup network must be a subgraph of the primary
network. The primary network assumes a probability of link failure of
and is designed for a survivability constraint of .

TABLE V
COMPARISON OF BACKUP NETWORKS FOR NSFNET WITH DIFFERENT
ROBUSTNESS CONSTRAINTS. NETWORKS WERE DESIGNED ASSUMING
PROBABILITY OF LINK FAILURE . AVERAGE REFERS TO THE
AVERAGE NUMBER OF PRIMARY LINKS BEING PROTECTED BY A BACKUP LINK

Fig. 10. Backup network (solid) shown for the Sprint backbone network
In the backup network of Fig. 6, a total capacity of 24 is re- (dotted) with the restriction that the backup network must be a subgraph of the
quired. Most backup links protect up to five primary links. In the primary network. The primary network assumes a probability of link failure of
case of Fig. 7, where the probability of link failure is higher, a and is designed for a survivability constraint of .
total capacity of 28 is needed. The backup links in this example
protect an average of three primary links. If the probability of The simulated annealing approach can be used to solve large-
link failure increases to , the resulting backup topology scale networks as well, such as the 36-node Sprint backbone
is a mirror of the primary topology, requiring a capacity of 42. network, shown in Fig. 8. Due to the large size of the network,
As increases, the number of backup links needed rises, and the simulated annealing algorithm requires a prohibitively large
similarly the number of primary links being protected by each number of iterations to find an optimal solution. However, the
backup link falls, until the network follows the one-hop pro- number of iterations can be reduced in exchange for a less optimal
tection scheme. These results are summarized in Table III. In solution. Assume the bidirectional links in Fig. 8 represent a unit
this table, we also see that by providing probabilistic protec- of primary capacity in each direction. Again, the goal is to con-
tion, we only need to allocate roughly half the capacity needed struct a backup network consisting of links , where
for 100% protection. In Table IV, we show numerical results and are connected by a link in the primary network, to satisfy the
for smaller values of and , modeling scenarios where fail- survivability constraint in (2) with probability .
ures are less common. Additionally, in Table V, we show the The backup networks returned by the simulated annealing al-
effect of varying the probabilistic constraint on the resulting gorithm for a probability of primary link failure of
backup network. As grows, the constraint becomes more le- and are shown in Figs. 9 and 10, respectively. For a
nient, and more failures can be tolerated. Thus, we would expect small probability of primary link failure (Fig. 9), the optimal
less backup capacity to be required, as confirmed by the results backup network is made up of many cycles, where backup paths
in Table V. are potentially many hops. However, as the probability of link
JOHNSTON et al.: ROBUST OPTIMIZATION APPROACH TO BACKUP NETWORK DESIGN WITH RANDOM FAILURES 1225

Fig. 11. 14-node NSFNET backbone network with nonuniform link loads. Fig. 12. 14-node NSFNET backbone network with nonuniform link loads. Di-
Bold links represent demands of 10, and dashed links represent demands of 1. rected bold links represent a primary capacity of 10 in one direction, and of 1 in
the other direction, while dashed links represent primary capacity of 1 in both
directions.
TABLE VI
COMPARISON OF BACKUP NETWORKS FOR THE SPRINT BACKBONE WITH
DIFFERENT PROBABILITIES OF PRIMARY LINK FAILURE. NETWORKS WERE
DESIGNED USING . AVERAGE REFERS TO THE AVERAGE
NUMBER OF PRIMARY LINKS BEING PROTECTED BY A BACKUP LINK

Fig. 13. Backup network (solid) shown for the NSFNET (dotted). The backup
network must be a subgraph of the primary network. The primary network here
assumes a probability of link failure of 0.075, and the backup network is de-
signed for . Primary link capacities are distributed according to Fig. 11.

failure increases, long backup paths become more inefficient,

and the optimal backup topology consists of more links and
Fig. 14. Backup network (solid) shown for the NSFNET (dotted). The backup
more direct paths. To see this clearly, Table VI summarizes the network must be a subgraph of the primary network. The primary network here
resulting backup topologies for varying probabilities of primary assumes a probability of link failure of 0.1, and the backup network is designed
link failure. Similar to the results for the NSFNET, as the prob- for . Primary link capacities are distributed according to Fig. 11.
ability of link failure increases, the backup links protect fewer
primary links, and the optimal topology resembles a mirror of Fig. 11, Figs. 13 and 14 show the backup topologies when the
the primary network. However, for small probabilities of link probability of primary link failure is and ,
failure, it is more efficient for primary links to share backup re- respectively. For the lower probability of link failure, a total
sources, hence the higher average number of primary links pro- backup capacity of 98 is required, while the less reliable net-
tected by each backup link. work requires a backup capacity of 119. On the other hand,
B. Simulated Annealing on General-Load Networks Figs. 15 and 16 show the backup topologies when the proba-
The previous simulation results were for primary networks bility of primary link failure is and for the
where each link had a unit capacity. Our simulated annealing demand structure in Fig. 12. In this case, the backup topologies
approach can also be applied to networks with nonuniform pri- require a total capacity of 141 and 148, respectively. Despite
mary capacities. The presence of these nonuniformities greatly the fact that the total primary capacity is the same in both
affects the backup topology necessary to sufficiently protect the scenarios, the backup capacity is much higher in the case where
primary network. To illustrate, we consider two distributions the high-capacity primary links are distributed throughout the
of primary link capacities on the NSFNET in Fig. 5. The first, network. This is due to the fact that at low probabilities of
shown in Fig. 11, assumes 10 directional (five bidirectional) link failure, a few high-capacity backup links are sufficient
links on the east side of the network have a high primary ca- to protect many local high-capacity primary links. However,
pacity of 10, while the rest of the links have a low primary ca- when the high-capacity primary links are spread throughout
pacity of 1. As an alternative, we consider 10 directional links the network, they cannot share these high-capacity backup
mixed throughout the network to have a high capacity, while the resources, and consequently more high-capacity backup links
remainder of the network has a low primary capacity, as shown are required.
in Fig. 12.
The simulated annealing algorithm is applied to each of VI. MODEL EXTENSIONS
these primary link capacity distributions in order to find a The framework developed in this paper can be extended to
(near-)optimal backup topology. For the primary capacities in include variations to the model. In this section, we highlight
1226 IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 23, NO. 4, AUGUST 2015

(43)

(44)

Therefore, by choosing a small value of , one can construct a

network with uniform link failure probability that approximates
the original network with nonuniform link failure probabilities,
at the expense of additional links.
Fig. 15. Backup network (solid) shown for the NSFNET (dotted) with the re-
striction that the backup network must be a subgraph of the primary network. B. Unreliable Backup Links
The primary network here assumes a probability of link failure of 0.075, and
the backup network is designed for . Primary link capacities are dis- In practical networks, backup links may also experience some
tributed according to Fig. 12. probability of failure. Throughout this work, we have assumed
that this probability is negligible compared to that of a primary
link failure. However, when this assumption is relaxed, a backup
link “overflow” can also occur when the backup link fails and
any primary link needs to use the failed backup link. Clearly,
our formulation provides an upper bound on reliability (a lower
bound on the required backup capacity) on the case with unreli-
able backup links. Additionally, our approach can be applied to
this case, given a probability of backup-link failure . Let be
Fig. 16. Backup network (solid) shown for the NSFNET (dotted). The primary
a random variable equal to 1 if backup link fails, and 0 oth-
network here assumes a probability of link failure of 0.1, and the backup network erwise. Assume that every primary link has nonzero traffic, i.e.,
is designed for . Primary link capacities are distributed according to . Let be the number of primary links
Fig. 12.
whose backup paths use backup link . Then, new backup
link overflow constraint is
several extensions to our problem to more appropriately model
certain real-world scenarios.

A. Nonuniform Link Failures

To begin, we can assume that link in the primary
network has a link failure probability , allowing for primary (45)
links to fail with different probabilities. To adapt our framework
to this new model, we can consider a link with probability of
failure as links in series with the same probability of (46)
link failure , where is calculated as

Designing to satisfy (46) is equivalent to satisfying

(41)

The number of links is calculated such that the probability that (47)
at least one of the links fails (and the total demand over all the Therefore, incorporating backup-link failures into the formula-
links needs to be rerouted over the backup network) is equal to tion is equivalent to solving the formulation with a modified
the probability of link failure . Applying our formulation to probability constraint ( ), as long as .
the modified network results in an upper bound on the required As an illustration, for the backup network design problem for
capacity since our formulation allocates capacity to account for the NSFNET in Table III, if , then for backup link
multiple links in series failing. However, this bound becomes failure probability , , and for backup failure
tight for small , where it is unlikely that multiples of those links probability , which is the same order as the primary link
to fail. failure probability , . Thus, for a reliability require-
The difference between the original link failure probability ment , one can solve our formulation with a slightly smaller
and the failure probability of the new links in series can be value of .
written as
C. Correlated Link Failures
As a final extension, we consider augmenting our framework
to account for correlated failures. For example, consider the
Probabilistic Shared Risk Link Group (PSRLG) model in [31],
where once an SRLG failure event occurs, the links contained in
(42) the SRLG fail independently with probability . For simplicity
JOHNSTON et al.: ROBUST OPTIMIZATION APPROACH TO BACKUP NETWORK DESIGN WITH RANDOM FAILURES 1227

of exposition, assume mutually exclusive SRLGs such that each Assuming the number of primary links satisfying
SRLG fails with probability and . Then, is larger than or equal to , the LP will choose the of them
the overflow probability at backup link can be written as with the largest capacities by setting for those links
. This corresponds to choosing the set in (27). If there
(48)
are fewer than primary links satisfying , then
for each of these links, , and the other satisfying
are chosen arbitrarily. Note, however, that this does not
affect the correctness of (51).
Let be the dual variable for the first constraint in (51), and
(49) let be the dual variables for the second set of constraints.
where is the number of primary links that belong to The dual problem of (51) is formulated as follows:
SRLG and use as backup links. We assume an empty
summation to be zero. Similar to the argument in Section IV-B, minimize
we can create a priori a table containing the values of and
use it in the MILP formulation. Note that in this case, a much subject to
larger table is needed since the value of is determined by
the number of links in each SRLG that use link as backup.
(52)
VII. CONCLUSION
Since there is zero duality gap between problem (51) and its
Dedicated backup networks are a low-cost and efficient
dual (52), the optimal value of the objective function in (52) is
method for providing protection against multiple (random)
equal to . Additionally, since problem (29) mini-
failures. In the event of a failure, the load on the failed link
mizes for each , problem (52) can be substi-
can be automatically rerouted over a predetermined path in
tuted into (29) to arrive at the formulation in (30).
the backup network, providing fast recovery from network
failures. We formulated the backup network design problem as
REFERENCES
an ILP for primary networks with general link capacities and
[1] W. Grover, Mesh-Based Survivable Networks: Options and Strategies
independent, identically distributed probabilities of link failure. for Optical, MPLS, SONET, and ATM Networking. Upper Saddle
For primary networks with rare failures, backup networks are River, NJ, USA: Prentice-Hall, 2004.
shown to use fewer links, with more resource sharing among [2] S. Lumetta et al., “Capacity versus robustness: A tradeoff for link
restoration in mesh networks,” J. Lightw. Technol., vol. 18, no. 12, p.
backup paths. Conversely, when the primary network has a 1765, Dec. 2000.
high probability of link failure, the backup network consists [3] D. Zhou and S. Subramaniam, “Survivability in optical networks,”
of shorter backup paths. For larger primary networks, a sim- IEEE Netw., vol. 14, no. 6, pp. 16–23, Nov.–Dec. 2000.
[4] Y. Liu, D. Tipper, and P. Siripongwutikorn, “Approximating op-
ulated annealing approach was presented to solve the backup timal spare capacity allocation by successive survivable routing,”
network design ILP. This approach has been shown to perform IEEE/ACM Trans. Netw., vol. 13, no. 1, pp. 198–211, Feb. 2005.
near-optimally in designing dedicated backup networks. The [5] S. Ramamurthy, L. Sahasrabuddhe, and B. Mukherjee, Survivable
WDM Mesh Netw., vol. 21, no. 4, pp. 870–883, 2003.
SA algorithm can be adjusted to trade off between computation [6] J. Zhang and B. Mukherjee, “A review of fault management in WDM
time and accuracy. Additionally, we demonstrated our capacity mesh networks: Basic concepts and research challenges,” IEEE Netw.,
allocation approach on real-world networks and have shown vol. 18, no. 2, pp. 41–48, Mar. 2004.
[7] M. Banner and A. Orda, “Designing low-capacity backup networks for
that, practically, protecting against failures with high proba- fast restoration,” in Proc. IEEE INFOCOM, 2010, pp. 1–9.
bility can lead to a capacity savings of up to 50% compared to [8] H. Choi, S. Subramaniam, and H. Choi, “On double-link failure re-
approaches providing 100% protection guarantees. covery in WDM optical networks,” in Proc. IEEE INFOCOM, 2002,
vol. 2, pp. 808–816.
[9] L. Guo, H. Yu, and L. Li, “Segment shared protection for survivable
APPENDIX meshed WDM optical networks,” Opt. Commun., vol. 251, no. 4–6,
The following steps are used to convert formulation (29) to pp. 328–338, 2005.
[10] B. Jozsa, D. Orincsay, and A. Kern, “Surviving multiple network fail-
formulation (30) using a duality approach. For a fixed and ures using shared backup path protection,” in Proc. ISCC, 2003, vol.
, the backup capacity of link 1, pp. 1333–1340.
[11] M. Herzberg, S. Bye, and A. Utano, “The hop-limit approach for spare-
capacity assignment in survivable networks,” IEEE/ACM Trans. Netw.,
(50) vol. 3, no. 6, p. 784, Dec. 1995.
[12] K. Vajanapoom and D. Tipper, “Risk based incremental survivable net-
work design,” in Proc. 6th DRCN, 2007, pp. 1–9.
can be written as the solution to the following LP: [13] D. Papadimitriou et al., “Inference of shared risk link groups,” Internet
Draft, May 2002 [Online]. Available: http://tools.ietf.org/html/draft-
many-inference-srlg-02
[14] R. Bhandari, Survivable Networks: Algorithms for Diverse Routing.
New York, NY, USA: Kluwer, 1999.
[15] E. Modiano and A. Narula-Tam, “Survivable lightpath routing—A new
approach to the design of WDM-based networks,” IEEE J. Sel. Areas
Commun., vol. 20, no. 4, pp. 800–809, May 2002.
[16] E. Oki, N. Matsuura, K. Shiomoto, and N. Yamanaka, “A disjoint path
selection scheme with shared risk link groups in GMPLS networks,”
(51) IEEE Commun. Lett., vol. 6, no. 9, pp. 406–408, Sep. 2002.
1228 IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 23, NO. 4, AUGUST 2015

[17] D. Xu, Y. Xiong, C. Qiao, and G. Li, “Trap avoidance and protection Hyang-Won Lee (S'02–M'08) received the B.S.,
schemes in networks with shared risk link groups,” J. Lightw. Technol., M.S., and Ph.D. degrees in electrical engineering and
vol. 21, no. 11, pp. 2683–2693, Nov. 2003. computer science from the Korea Advanced Institute
[18] A. Soyster, “Convex programming with set-inclusive constraints and of Science and Technology (KAIST), Daejeon,
applications to inexact linear programming,” Oper. Res., vol. 21, no. Korea, in 2001, 2003, and 2007, respectively.
5, pp. 1154–1157, 1973. He was a Postdoctoral Research Associate with the
[19] A. Ben-Tal and A. Nemirovski, “Robust solutions of uncertain linear Massachusetts Institute of Technology, Cambridge,
programs,” Oper. Res. Lett., vol. 25, no. 1, pp. 1–14, 1999. MA, USA, during 2007 to 2011, and a Research
[20] D. Bertsimas and M. Sim, “The price of robustness,” Oper. Res., vol. Assistant Professor with KAIST between 2011 and
52, no. 1, pp. 35–53, 2004. 2012. He is currently an Assistant Professor with the
[21] S. Gast and A. Keimer, “Robust optimization in network flows,” Uni- Department of Internet and Multimedia Engineering,
versity of Erlangen-Nürnberg, Germany, Tech. Rep., 2009. Konkuk University, Seoul, Korea. His research interests are in the areas
[22] J. Zhang, K. Zhu, H. Zang, and B. Mukherjee, “Service provisioning of congestion control, stochastic network control, robust optimization, and
to provide per-connection-based availability guarantee in WDM mesh reliable network design.
networks,” in Proc. OFC, Atlanta, GA, USA, Mar. 2003, pp. 622–624.
[23] M. Tornatore, G. Maier, and A. Pattavina, “Availability design of op-
tical transport networks,” IEEE J. Sel. Areas Commun., vol. 23, no. 8,
pp. 1520–1532, Aug. 2005. Eytan Modiano (S'90–M'93–SM'00–F'12) received
[24] J. Segovia, E. Calle, P. Vila, J. Marzo, and J. Tapolcai, “Topology-fo- the B.S. degree in electrical engineering and com-
cused availability analysis of basic protection schemes in optical trans- puter science from the University of Connecticut,
port networks,” J. Opt. Netw., vol. 7, pp. 351–364, 2008. Storrs, CT, USA, in 1986, and the M.S. and Ph.D.
[25] A. M. Koster, M. Kutschka, and C. Raack, “Robust network design: degrees in electrical engineering from the University
Formulations, valid inequalities, and computations,” Networks, vol. 61, of Maryland, College Park, MD, USA, in 1989 and
no. 2, pp. 128–149, 2013. 1992, respectively.
[26] A. M. Koster, M. Kutschka, and C. Raack, “On the robustness of op- He was a Naval Research Laboratory Fellow
timal network designs,” in Proc. IEEE ICC, 2011, pp. 1–5. between 1987 and 1992 and a National Research
[27] A. M. Koster and M. Kutschka, “An integrated model for survivable Council Post-Doctoral Fellow during 1992 to 1993.
network design under demand uncertainty,” in Proc. 8th DRCN, 2011, Between 1993 and 1999, he was with the Massachu-
pp. 54–61. setts Institute of Technology (MIT) Lincoln Laboratory, Lexington, MA, USA,
[28] M. Johnston, H.-W. Lee, and E. Modiano, “Robust network design where he was a project leader for MIT Lincoln Laboratory's Next Generation
for stochastic traffic demands,” in Proc. IEEE GLOBECOM, 2011, pp. Internet (NGI) project. Since 1999, he has been on the faculty of MIT, where
1–5. he is a Professor with the Department of Aeronautics and Astronautics and the
[29] S. Brooks and B. Morgan, “Optimization using simulated annealing,” Laboratory for Information and Decision Systems (LIDS). His research is on
Statistician, vol. 44, no. 2, pp. 241–257, 1995. communication networks and protocols with emphasis on satellite, wireless,
[30] B. Van Caenegem, W. Van Parys, F. De Turck, and P. Demeester, and optical networks.
“Dimensioning of survivable WDM networks,” IEEE J. Sel. Areas Prof. Modiano is an Associate Fellow of the AIAA. He is an Editor-at-Large
Commun., vol. 16, no. 7, pp. 1146–1157, Sep. 1998. for the IEEE/ACM TRANSACTIONS ON NETWORKING and served as Associate
[31] H.-W. Lee, E. Modiano, and K. Lee, “Diverse routing in networks Editor for the IEEE TRANSACTIONS ON INFORMATION THEORY, IEEE/ACM
with probabilistic failures,” IEEE/ACM Trans. Netw., vol. 18, no. 6, TRANSACTIONS ON NETWORKING, and AIAA Journal of Aerospace Information
pp. 1895–1907, Dec. 2010. Systems. He was the Technical Program Co-Chair for IEEE WiOpt 2006, IEEE
INFOCOM 2007, and ACM MobiHoc 2007.
Matthew Johnston (S'10) received the B.S. degree
in electrical engineering and computer science from
the University of California, Berkeley, CA, USA, in
2008, and the S.M. degree in electrical engineering
from the Massachusetts Institute of Technology
(MIT), Cambridge, MA, USA, in 2010, and is
currently pursuing the Ph.D. degree in electrical
engineering with the Laboratory for Information and
Decision Systems, MIT.
His research interests include network con-
trol, wireless resource allocation, and network
survivability.