Corruption and botnet defense: a mean field game approach

Recently developed toy models for the mean-field games of corruption and botnet defence in cyber-security with three or four states of agents are extended to a more general mean-field-game model with 2d states, d∈N\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$d\in \mathbf {N}$$\end{document}. In order to tackle new technical difficulties arising from a larger state-space we introduce new asymptotic regimes, namely small discount and small interaction asymptotics. Moreover, the link between stationary and time-dependent solutions is established rigorously leading to a performance of the turnpike theory in a mean-field-game setting.


Introduction
Toy models for the mean-field games of corruption and botnet defense in cyber-security were developed in [18] and [17].These were games with three and four states of the agents respectively.Here we develop a more general mean-field-game model with 2d states, d ∈ N, that extend the models of [18] and [17].In order to tackle new technical difficulties arising from a larger state-space we introduce new asymptotic regimes, small discount and small interaction asymptotics.Hence the properties that we obtain for the new model do not cover more precise results of [18] and [17] (with the full classification of the bifurcation points), but capture their main qualitative and quantitative features and provide regular solutions away from the points of bifurcations.Apart from new modeling, this paper contributes to one of the key questions in the modern study of mean-field games, namely, what is the precise link between stationary and time -dependent solutions.This problem is sorted out here for a concrete model, but the method can be definitely used in more general situations.
On the one hand, our model is a performance of the general pressure-and-resistancegame framework of [16] and the nonlinear Markov battles of [15], and on the other hand, it represents a simple example of mean-field-and evolutionary-game modeling of networks.Initiating the development of the latter, we stress already here that two-dimensional arrays of states arise naturally in many situations, one of the dimensions being controlled mostly by the decision of agents (say, the level of tax evasion in the context of inspection games) and the other one by a principal (major player) or evolutionary interactions (say, the level of agents in bureaucratic staircase, the type of a computer virus used by botnet herder, etc).
We shall dwell upon two basic interpretations of our model: corrupted bureaucrats playing against the principal (say, governmental representative, also referred in literature as benevolent dictator) or computer owners playing against a botnet herder (which then takes the role of the principal), which tries to infect the computers with viruses.Other interpretations can be done, for instance, in the framework of the inspection games (inspector and tax payers) or of the disease spreading in epidemiology (among animals or humans), or the defense against a biological weapon.Here we shall keep the principal in the background concentrating on the behavior of small players (corrupted bureaucrats or computer owners), which we shall refer to as agents or players.
The paper is organized as follows.In the next section we introduce our model specifying in this context the basic notions of the mean-field-game (MFG) consistency problem in its dynamic and stationary versions.In section 3 we calculate explicitly all non-degenerate solutions of the stationary MFG problem.In section 4 we show how from a stationary solution one can construct a class of full time-dependent solutions satisfying the so-called turnpike property around the stationary one.
We complete this introductory section with short bibliographical notes.Analysis of the spread of corruption in bureaucracy is a well recognized area of the application of game theory, which attracted attention of many researchers.General surveys can be found in [1], [14], [23].More recent literature is reviewed in [18], see also [26], [2] for electric and engineering interpretations of corruption games.
The use of game theory in modeling attacker-defender has been extensively adopted in the computer security domain recently, see [7], [24] and [25] and bibliography there for more details.

The model
We assume that any agent has 2d states: iI and iS, where i ∈ {1, • • • , d} and is referred to as a strategy.In the first interpretation the letters S or I designate the senior or initial position of a bureaucrat in the hierarchical staircase and i designates the level or type of corruptive behavior (say, the level of bribes one asks from customers or, more generally, the level of illegal profit he/she aims at).In the literature on corruption the state I is often denoted by R and is referred to as the reserved state.It is interpreted as a job of the lowest salary given to the not trust-worthy bureaucrats.In the second interpretation the letters S or I designate susceptible or infected states of computers and i denotes the level or the type of defense system available on the market.
We assume that the choice of a strategy depends exclusively on the decision of an agent.The control parameter u of each player may have d values denoting the strategy the agent prefers at a moment.As long as this coincides with the current strategy, the updating of a strategy does not occur.Once the decision to change i to j is made, the actual updating is supposed to occur with a certain rate λ.Following [17], we shall be mostly interested in the asymptotic regime of fast execution of individual decisions, that is, λ → ∞.
The change between S and I may have two causes: the action of the principal (pressure game component) and of the peers (evolutionary component).In the first interpretation the principal can promote the bureaucrats from the initial to the senior position or degrade them to the reserved initial position, whenever their illegal behavior is discovered.The peers can also take part in this process contributing to the degrading of corrupted bureaucrats, for instance, when they trespass certain social norms.In the second interpretation the principal, the botnet herder, infects computers with the virus by direct attacks turning S to I, and the virus then spreads through the network of computers by a pairwise interaction.The recovery change from I to S is due to some system of repairs which can be different in different protection levels i.
Let q i + denote the recovery rates of upgrading from iR to iS and q i − the rates of degrading (punishment or infection) from state iR to iS, which are independent of the state of other agents (pressure component), and let β ij denote the rates at which an agent in state iI can stimulate the degrading (punishment or infection) of another agent from jS to jI (evolutionary component).For simplicity we ignore here the possibility of upgrading changes from jS to jI due to the interaction with peers.
A state of the system is a vector n = (n 1S , n 1I , • • • , n dS , n dI ) with coordinates presenting the number of agents in the corresponding states, or its normalized version Therefore, assuming that all players have the same strategy u com t = {u com (iS), u com (iI)}, the evolution of states in the limit of large number of players N → ∞ is given by the equations ẋiI = λ for all i = 1, • • • , d.Here and below 1(M) denotes the indicator function of a set M.
Remark 1.It is well known that evolutions of this type can be derived rigorously as the dynamic law of large numbers for the corresponding Markov models of a finite number of players, see detail e.g. in [15] or [16].
To specify the optimal behavior of agents we have to introduce payoffs in different states and possibly costs for transitions.For simplicity we shall ignore here the latter.Talking about corrupted agents it is natural to talk about maximizing profit, while talking about infected computers it is natural to talk about minimizing costs.To unify the exposition we shall deal with the minimization of costs, which is equivalent to the maximization of their negations.
Let w i I and w i S denote the costs per time-unit of staying in iI and iS respectively.According to our interpretation of S as a better state, w i S < w i I for all i.Given the evolution of the states x = x(s) of the whole system on a time interval [t, T ], the individually optimal costs g(iI) and g(iS) and individually optimal control u ind s (iI) and u ind s (iS) can be found from the HJB equation ( The basic MFG consistency equation for a time interval [t, T ] can now be written as The reasonability of this condition in the setting of the large number of players is more or less obvious.And in fact in many situations it was proved rigorously that its solutions represent the ǫ-Nash equilibrium for the corresponding Markov model of N players, with ǫ → 0 as N → ∞, see e.g.[4] for finite state models considered here.
In this paper we shall mostly work with discounted payoff with the discounting coefficient δ > 0, in which case the HJB equation for the discounted optimal payoff e −sδ g of an individual player with any time horizon T writes down as Notice that since this is an equation in a Euclidean space with Lipschitz coefficients, it has a unique solution for s ≤ T and any given boundary condition g at time T and any measurable functions x iI (s).
For the discounted payoff the basic MFG consistency equation u com s = u ind s for a time interval [t, T ] can be reformulated by saying that x, u, g solve the coupled forward-backward system (1), (3), so that u com s used in (1) coincide with the minimizers in (3).The main objective of the paper is to provide a general class of solutions of the discounted MFG consistency equation with stationary (time-independent) controls u com s .
As a first step to this objective we shall analyse the fully stationary solutions, when the evolution (1) is replaced by the corresponding fixed point condition: (4) There are two standard stationary optimization problems naturally linked with a dynamic one, one being the search for the average payoff for long period game, and another the search for discounted optimal payoff.The first is governed by the solutions of HJB of the form (T − s)µ + g, linear in s (then µ describing the optimal average payoff), so that g satisfies the stationary HJB equation: In the second problem, if the discounting coefficient is δ, the stationary discounted optimal payoff g satisfies the stationary version of (3): In [18] and [17] we concentrated on the first approach, and here we shall concentrate on the second one, with a discounted payoff.The stationary MFG consistency condition is the coupled system of equations ( 4) and (6), so that the individually optimal stationary control u ind found from (6) coincides with the common stationary control u com from (4).
For simplicity we shall be interested in non-degenerate controls u ind characterized by the condition that the minimum in ( 6) is always attained on a single value of u.
A new technical novelty as compared with [17] and [18] will be systematic working in the asymptotic regimes of small discount δ and small interaction coefficients β ij .This approach leads to more or less explicit calculations of stationary MFG solutions and their further justification.

Stationary MFG problem
The following result identifies all possible stationary non-degenerate controls that can occur as solutions of (6).Proposition 3.1.Non-degenerate controls solving (6) could be only of the type [i(I), k(S)]: switch to strategy i when in I and to k when in S.
Proof.If moving from the strategy k to the strategy i is optimal, then g(i) < g(l) for all l and hence moving from m to i is optimal for any m.
Let us consider first the control [i(I), i(S)] denoting it by ûi : We shall refer to the control ûi as the one with the strategy i individually optimal.
The control ûi and the corresponding distribution x solve the stationary MFG problem if they solve the corresponding HJB (6), that is where for all j = i g(iI) ≤ g(jI), g(iS) ≤ g(jS), and x is a fixed point of the evolution (4) with u com = ûi , that is x jS = 0, This solution (û i , x) is stable if x is a stable fixed point of the evolution (1) with u com = ûi , that is, of the evolution Adding together the last two equations of ( 9) we find that x jI = x jS = 0 for j = i, as one could expect.Consequently, the whole system (9) reduces to the single equation , with the unique solution on the interval (0, 1): To analyze stability of the fixed point x iI = x * , x iS = 1 − x * and x jI = x jS = 0 for j = i, we introduce the variables y = x iI − x * .In terms of y and x jI , x jS with j = i, system (10) rewrites as (12) Its linearized version around the fixed point zero is x jI q j + − λx jS , j = i.Since the equations for x jI , x jS contain neither y nor other variables, the eigenvalues of this linear system are These eigenvalues being always negative, the condition of stability is reduced to the negativity of the first eigenvalue ξ i : But this is true due to (11) implying that this fixed point is always stable (by the Grobman-Hartman theorem).
Next, the HJB equation ( 7) takes the form Subtracting the first equation from the second one yields In particular, g(iI) > g(iS) always, as expected.Next, by the first equation of (13), Consequently, Subtracting the third equation of ( 13) from the fourth one yields 17) From the fourth equation of ( 13) it now follows that (δ + λ)g(jI) = w j I − q j + (g(jI) − g(jS)) + λg(iI), so that Consequently, g(jS) = g(jI) − (g(jI) − g(jS)) Thus the consistency conditions (8) in the main order in λ → ∞ become or equivalently In the first order in small β ii this gets the simpler form, independent of x * : Summarizing, we proved the following.
Proposition 3.2.If (21) holds for all j = i with the strict inequality, then for sufficiently large λ and sufficiently small β ij there exists a unique solution to the stationary MFG consistency problem (4) and (6) with the optimal control ûi , the stationary distribution is x I i = x * , x S i = 1 − x * with x * given by (11) and it is stable; the optimal payoffs are given by (15), ( 16), ( 18), (19).Conversely, if for all sufficiently large λ there exists a solution to the stationary MFG consistency problem (4) and (6) with the optimal control ûi , then (20) holds.

Let us turn to control [i(I), k(S)] with k
The fixed point condition under u com = ûi,k takes the form where l = i, k.
Adding the last two equations yields x lI + x lS = 0 and hence x lI = x lS = 0 for all l = i, k, as one could expect.Consequently, for indices i, k the system gets the form Adding the first two equation (or the last two equations) yields x kI = x iS .Since by normalization we are left with two equations only: From the first equation we obtain Hence x kI is of order 1/λ, and therefore In the major order in large λ asymptotics, the second equation of ( 24) yields , which is effectively the same equation as the one that appeared in the analysis of the control [i(I), i(S)].It has the unique solution on the interval (0, 1): Let us note that for small β ik it expands as Similar (a bit more lengthy) calculations, as for the control [i(I), i(S)] show that the obtained fixed point of evolution ( 1) is always stable.We omit the detail, as they are the same as given in [17] for the case d = 2.
Let us turn to the HJB equation ( 7), which under control [i(I), k(S)] takes the form supplemented by the consistency condition for all j, where we introduced the notation The first four equations do not depend on the rest of the system and can be solved independently.To begin with, we use the first and the fourth equation to find Then the second and the third equations can be written as the system for the variables g(kS) and g(iI): or simpler as Let us find the asymptotic behavior of the solution for large λ.To this end let us write with similar notations for other values of g.Dividing (32) by λ and preserving only the leading terms in λ we get the system Solving this system and using (31) to find the corresponding leading terms g 0 (iS), g 0 (kI) yields The remarkable equations g 0 (iS) = g 0 (kS) and g 0 (kI) = g 0 (iI) arising from the calculations have natural interpretation: for instantaneous execution of personal decisions the discrimination between strategies i and j is not possible.Thus to get the conditions ensuring (29) we have to look for the next order of expansion in λ.
Keeping in (32) the terms of zero-order in 1/λ yields the system Taking into account (34), conditions g(iI) ≤ g(kI) and g(kS) ≤ g(iS) turn to Solving (35) we obtain We can now check the conditions (36).Remarkably enough the r.h.s and l.h.s. of both inequalities always coincide for δ = 0, so that the actual condition arises from comparing higher terms in δ.In the first order with respect to the expansion in small δ conditions (36) turn out to take the following simple form From the last two equations of (28) we can find g(jS) and g(jI) for j = i, k yielding From these equations we can derive the rest of the conditions (29), namely that g(iI) ≤ g(jI) for j = k and g(kS) ≤ g(jS) for j = i.In the first order in the small δ expansion they become Since for small β ij , the difference qj − − q j − is small, we proved the following result.
Proposition 3.3.Assume (41) Then for sufficiently large λ, small δ and small β ij there exists a unique solution to the stationary MFG consistency problem (4) and (6) with the optimal control ûi,k , the stationary distribution is concentrated on strategies i and k with x * iI being given by ( 26) or (27) up to terms of order O(λ −1 ), and it is stable; the optimal payoffs are given by (34), (37), (39).
Conversely, if for all sufficiently large λ and small δ there exists a solution to the stationary MFG consistency problem (4) and (6) with the optimal control ûi,k , then (38) and (40) hold.

Main result
By the general result already mentioned above, see [4], a solution of MFG consistency problem constructed above and considered on a finite time horizon will define an ǫ-Nash equilibrium for the corresponding game of finite number of players.However, solutions given by Propositions 3.2 and 3.3 work only when the initial distribution and terminal payoff are exactly those given by the stationary solution.Of course, it is natural to ask what happens for other initial conditions.Stability results of Propositions 3.2 and 3.3 represent only a step in the right direction here, as they ensure stability only under the assumption that all (or almost all) players use from the very beginning the corresponding stationary control, which might not be the case.To analyse the stability properly, we have to consider the full time-dependent problem.For possibly time varying evolution x(t) of the distribution, the time-dependent HJB equation for the discounted optimal payoff e −tδ g of an individual player with any time horizon T has form (3).
In order to have a solution with a stationary u we have to show that solving the linear equation obtained from (3) by fixing this control will be consistent in the sense that this control will actually give minimum in (3) in all times.
For definiteness, let us concentrate on the stationary control ûi , the corresponding linear equation getting the form with the consistency requirement (8), but which has to hold now for time-dependent solution g.
Theorem 4.1.Assume the strengthened form of (21) holds, that is for all j = i.Assume moreover that for all j = i.Then for any λ > 0 and all sufficiently small β ij the following holds.For any T > t, any initial distribution x(t) and any terminal values g T such that g T (jI)−g T (jS) ≥ 0 for all j, g T (iI) − g T (iS) is sufficiently small and g T (iI) ≤ g T (jI) and g T (iS) ≤ g T (jS), j = i, there exists a unique solution to the discounted MFG consistency equation such that u is stationary and equals ûi everywhere.Moreover, this solution is such that, for large T − t, x(s) tends to the fixed point of Proposition 3.2 for s → T and g s stays near the stationary solution of Proposition 3.2 almost all time apart from a small initial period around t and some final period around T .

Remark 3. (i)
The last property of our solution can be expressed by saying that the stationary solution provides the so-called turnpike for the time-dependent solution, see e.g.[19] and [29] for for reviews in stochastic and deterministic settings.(ii) Condition (44) is strong and can possibly be dispensed with by a more detailed analysis.(iii) Similar time-dependent class of turnpike solutions can be constructed from the stationary control of Proposition 3.3.
Proof.To show that starting with the terminal condition belonging to the cone specified by (45) we shall stay in this cone for all t ≤ T , it is sufficient to prove that on a boundary point of this cone that can be achieved by the evolution the inverted tangent vector of system (42) is not directed outside of the cone.This (more or less obvious) observation is a performance of the general result of Bony, see e. g. [27].From (42) we find that ġ(jI) − ġ(iI) = (λ + δ)(g(jI) − g(iI)) + q j + (g(jI) − g(jS)) − q i + (g(iI) − g(iS)) − (w j I − w i I ).
Therefore, the condition for staying inside the cone (45) for a boundary point with g(jI) = g(iI) reads out as (w j I − w i I ) ≥ q j + (g(jI) − g(jS)) − q i + (g(iI) − g(iS)).
Therefore, the condition for staying inside the cone (45) for a boundary point with g(jS) = g(iS) reads out as (w j S − w i S ) ≥ (q i − + k β ki x kI )(g(iI) − g(iS)) − (q j − + k β kj x kI )(g(jI) − g(jS)).(51) Now 0 ≤ g(iI) − g(iS) ≤ g(jI) − g(jS), so that (51) is fulfilled if for all times.Taking into account the requirement that all β ij are sufficiently small, we find as above that it holds under the second assumptions of (43) and (44).The last statement of the theorem concerning x(s) follows from the observation that the eigenvalues of the linearized evolution x(s) are negative and well separated from zero implying the global stability of the fixed point of the evolution for sufficiently small β.The last statement of the theorem concerning g(s) follows by similar stability argument for the linear evolution (42) taking into account that away from the initial point t, the trajectory x(t) stays arbitrary close to its fixed point.