Game Theory Meets Information Security Management

  • Andrew Fielder
  • Emmanouil Panaousis
  • Pasquale Malacaria
  • Chris Hankin
  • Fabrizio Smeraldi
Part of the IFIP Advances in Information and Communication Technology book series (IFIPAICT, volume 428)

Abstract

This work addresses the challenge “how do we make better security decisions?” and it develops techniques to support human decision making and algorithms which enable well-founded cyber security decisions to be made. In this paper we propose a game theoretic model which optimally allocates cyber security resources such as administrators’ time across different tasks. We first model the interactions between an omnipresent attacker and a team of system administrators seen as the defender, and we have derived the mixed Nash Equilibria (NE) in such games. We have formulated general-sum games that represent our cyber security environment, and we have proven that the defender’s Nash strategy is also minimax. This result guarantees that independently from the attacker’s strategy the defender’s solution is optimal. We also propose Singular Value Decomposition (SVD) as an efficient technique to compute approximate equilibria in our games. By implementing and evaluating a minimax solver with SVD, we have thoroughly investigated the improvement that Nash defense introduces compared to other strategies chosen by common sense decision algorithms. Our key finding is that a particular NE, which we call weighted NE, provides the most effective defense strategy. In order to validate this model we have used real-life statistics from Hackmageddon, the Verizon 2013 Data Breach Investigation report, and the Ponemon report of 2011. We finally compare the game theoretic defense method with a method which implements a stochastic optimization algorithm.

Keywords

Information security management game theory cyber security 

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    2013 data breach investigations report by verizon, http://www.verizonenterprise.com/DBIR/2013/
  2. 2.
    Hackmageddon.com, http://hackmageddon.com/ (accessed october 2013)
  3. 3.
    Acquisti, A., Grossklags, J.: Losses, gains, and hyperbolic discounting: An experimental approach to information security attitudes and behavior. In: Proc. of the 2nd Annual Workshop on Economics and Information Security (WEIS 2003), vol. 3 (2003)Google Scholar
  4. 4.
    Alpcan, T., Başar, T.: Network security: A decision and game-theoretic approach. Cambridge University Press (2010)Google Scholar
  5. 5.
    Grossklags, J., Christin, N., Chuang, J.: Secure or insure?: a game-theoretic analysis of information security games. In: Proc. of the 17th International Conference on World Wide Web (WWW 2008), pp. 209–218. ACM (2008)Google Scholar
  6. 6.
    Hankin, C., Malacaria, P.: Payoffs, intensionality and abstraction in games. In: Coecke, B., Ong, L., Panangaden, P. (eds.) Abramsky Festschrift. LNCS, vol. 7860, pp. 69–82. Springer, Heidelberg (2013)CrossRefGoogle Scholar
  7. 7.
    Johnson, B., Grossklags, J., Christin, N., Chuang, J.: Nash equilibria for weakest target security games with heterogeneous agents. In: Jain, R., Kannan, R. (eds.) Gamenets 2011. LNICST, vol. 75, pp. 444–458. Springer, Heidelberg (2012)CrossRefGoogle Scholar
  8. 8.
    Kannan, R., Theobald, T.: Games of fixed rank: A hierarchy of bimatrix games. Economic Theory 42(1), 157–173 (2005)CrossRefMathSciNetGoogle Scholar
  9. 9.
    Kiekintveld, C., Islam, T., Kreinovich, V.: Security games with interval uncertainty. In: Proc. of the 12th International Conference on Autonomous Agents and Multiagent Systems (AAMAS 2013), pp. 231–238. International Foundation for Autonomous Agents and Multiagent Systems, Richland (2013)Google Scholar
  10. 10.
    Kiekintveld, C., Jain, M., Tsai, J., Pita, J., Ordóñez, F., Tambe, M.: Computing optimal randomized resource allocations for massive security games. In: Proc. of the 8th International Conference on Autonomous Agents and Multiagent Systems (AAMAS 2013), pp. 689–696 (2009)Google Scholar
  11. 11.
    Korzhyk, D., Yin, Z., Kiekintveld, C., Conitzer, V., Tambe, M.: Stackelberg vs. nash in security games: An extended investigation of interchangeability, equivalence, and uniqueness. Journal of Artificial Intelligence Research 41(2), 297–327 (2011)MATHMathSciNetGoogle Scholar
  12. 12.
    Ponemon Institute LLC. State of web application security. http://www.ponemon.org/library/2011-cost-of-data-breach-united-states
  13. 13.
    Lye, K.W., Wing, J.M.: Game strategies in network security. International Journal of Information Security 4(1-2), 71–86 (2005)CrossRefGoogle Scholar
  14. 14.
    Manshaei, M., Zhu, Q., Alpcan, T., Basar, T., Hubaux, J.: Game theory meets network security and privacy. ACM Transactions on Computational Logic, 25:1–25:39 (2011)Google Scholar

Copyright information

© IFIP International Federation for Information Processing 2014

Authors and Affiliations

  • Andrew Fielder
    • 1
  • Emmanouil Panaousis
    • 2
  • Pasquale Malacaria
    • 2
  • Chris Hankin
    • 1
  • Fabrizio Smeraldi
    • 2
  1. 1.Imperial College LondonUK
  2. 2.Queen Mary University of LondonUK

Personalised recommendations