Behavioral and Game-Theoretic Security Investments in Interdependent Systems Modeled by Attack Graphs

Document pages: 22 pages

Abstract: We consider a system consisting of multiple interdependent assets, and a setof defenders, each responsible for securing a subset of the assets against anattacker. The interdependencies between the assets are captured by an attackgraph, where an edge from one asset to another indicates that if the formerasset is compromised, an attack can be launched on the latter asset. Each edgehas an associated probability of successful attack, which can be reduced viasecurity investments by the defenders. In such scenarios, we investigate thesecurity investments that arise under certain features of human decision-makingthat have been identified in behavioral economics. In particular, humans havebeen shown to perceive probabilities in a nonlinear manner, typicallyoverweighting low probabilities and underweighting high probabilities. We showthat suboptimal investments can arise under such weighting in certain networktopologies. We also show that pure strategy Nash equilibria exist in settingswith multiple (behavioral) defenders, and study the inefficiency of theequilibrium investments by behavioral defenders compared to a centralizedsocially optimal solution.