Behavioral and Game-Theoretic Security Investments in Interdependent Systems Modeled by Attack Graphs
Behavioral and Game-Theoretic Security Investments in Interdependent Systems Modeled by Attack Graphs
复制标题
DOI：
10.1109/tcns.2020.2988007
复制
发表时间：
2020-01
影响因子：
4.2
通讯作者：
Mustafa Abdallah;Parinaz Naghizadeh;A. Hota;T. Cason;S. Bagchi;S. Sundaram
中科院分区：
文献类型：
--
作者：
Mustafa Abdallah;Parinaz Naghizadeh;A. Hota;T. Cason;S. Bagchi;S. Sundaram
在本文中，我们考虑一个由多个相互依赖的资产和一组防御者组成的系统，每个防御者负责保护资产的一个子集免受攻击。资产之间的相互依赖性由攻击图捕获，其中从一个资产到另一个资产的边指示如果前一个资产受到损害，则可以对后一个资产发起攻击。每个边缘都有一个相关的成功攻击概率，可以通过防御者的安全投资来降低。在这样的情况下，我们调查的安全投资，已被确定在行为经济学的人类决策的某些功能下产生的。特别是，人类已经被证明以非线性的方式感知概率，通常高估低概率和低估高概率。我们表明，次优投资可能会出现在某些网络拓扑结构的权重。我们还表明，纯策略纳什均衡存在于多个（行为）后卫的设置，并研究行为后卫相比，集中的社会最优解的均衡投资的效率低下。
In this article, we consider a system consisting of multiple interdependent assets, and a set of defenders, each responsible for securing a subset of the assets against an attacker. The interdependencies between the assets are captured by an attack graph, where an edge from one asset to another indicates that if the former asset is compromised, an attack can be launched on the latter asset. Each edge has an associated probability of successful attack, which can be reduced via security investments by the defenders. In such scenarios, we investigate the security investments that arise under certain features of human decision making that have been identified in behavioral economics. In particular, humans have been shown to perceive probabilities in a nonlinear manner, typically overweighting low probabilities and underweighting high probabilities. We show that suboptimal investments can arise under such weighting in certain network topologies. We also show that pure strategy Nash equilibria exist in settings with multiple (behavioral) defenders, and study the inefficiency of the equilibrium investments by behavioral defenders compared to a centralized socially optimal solution.