Game Theoretic Modeling to Enforce Security Information Sharing among Firms
Game Theoretic Modeling to Enforce Security Information Sharing among Firms
复制标题
通过博弈论建模加强企业之间的安全信息共享
DOI：
10.1109/cscloud.2015.81
复制
发表时间：
2015
期刊：
影响因子：
--
通讯作者：
K. Kwiat
中科院分区：
文献类型：
--
作者：
Deepak K. Tosh;S. Sengupta;S. Mukhopadhyay;Charles A. Kamhoua;K. Kwiat
强大的网络安全信息交换(Cybex)基础设施旨在通过协作威胁情报共享保护公司免受未来的网络攻击，这可能难以单靠努力实现。美国联邦政府的行政命令明确鼓励这些公司分享他们的网络安全漏洞，并在其他联邦和私营公司之间修补相关信息，以加强他们和国家的安全基础设施。在本文中，我们提出了一个博弈论框架来研究网络威胁信息共享的经济效益，并分析了不参与信息交换博弈的影响和后果。我们将信息交换框架建模为企业之间的分布式非合作博弈，并研究了信息共享和安全投资的含义。所提出的激励模型保证并自我强制企业真实地分享其违约信息，以最大化其总效用。对激励框架进行了理论分析，找出了企业共享证券信息和投资的净收益最大化的条件。数值结果验证了该模型促进了这种共享，这也有助于减轻他们的总安全技术投资。
Robust CYBersecurity information EXchange (CYBEX) infrastructure is envisioned to protect the firms from future cyber attacks via collaborative threat intelligence sharing, which might be difficult to achieve via sole effort. The executive order from the U. S. federal government clearly encourages the firms to share their cybersecurity breach and patch related information among other federal and private firms for strengthening their as well as nation's security infrastructure. In this paper, we present a game theoretic framework to investigate the economic benefits of cyber-threat information sharing and analyze the impacts and consequences of not participating in the game of information exchange. We model the information exchange framework as distributed non-cooperative game among the firms and investigate the implications of information sharing and security investments. The proposed incentive model ensures and self-enforces the firms to share their breach information truthfully for maximization of its gross utility. Theoretical analysis of the incentive framework has been conducted to find the conditions under which firms' net benefit for sharing security information and investment can be maximized. Numerical results verify that the proposed model promotes such sharing, which helps to relieve their total security technology investment too.