{"type":"ScholarlyArticle","title":"Who Should Pay the Cost: A Game-theoretic Model for Government Subsidized Investments to Improve National Cybersecurity","authors":[{"name":"Xinrun Wang","slug":"xinrun-wang","given":"Xinrun","family":"Wang","affiliation":"School of Computer Science and Engineering , Nanyang Technological University , Singapore"},{"name":"Bo An","slug":"bo-an","given":"Bo","family":"An","affiliation":"School of Computer Science and Engineering , Nanyang Technological University , Singapore"},{"name":"Hau Chan","slug":"hau-chan","given":"Hau","family":"Chan","affiliation":"University of Nebraska-Lincoln , Lincoln , NE , USA"}],"abstract":"Due to the recent cyber attacks, cybersecurity is becoming more critical in modern society. A single attack (e.g., WannaCry ransomware attack) can cause as much as $4 billion in damage. However, the cybersecurity investment by companies is far from satisfactory. Therefore, governments (e.g., in the UK) launch grants and subsidies to help companies to boost their cybersecurity to create a safer national cyber environment. The allocation problem is hard due to limited subsidies and the interdependence between self-interested companies and the presence of a strategic cyber attacker. To tackle the government's allocation problem, we introduce a Stackelberg game-theoretic model where the government first commits to an allocation and the companies/users and attacker simultaneously determine their protection and attack (pure or mixed) strategies, respectively. For the pure-strategy case, while there may not be a feasible allocation in general, we prove that computing an optimal allocation is NP-hard and propose a linear reverse convex program when the attacker can attack all users. For the mixed-strategy case, we show that there is a polynomial time algorithm to find an optimal allocation when the attacker has a single-attack capability. We then provide a heuristic algorithm, based on best-response-gradient dynamics, to find an effective allocation in the general setting. Experimentally, we show that our heuristic is effective and outperforms other baselines on synthetic and real data.","doi":"10.24963/ijcai.2019/834","url":"https://ijcai.org/proceedings/2019/834","pdf":"https://ijcai.org/proceedings/2019/0834.pdf","markdown":"https://ijcai.org/proceedings/2019/834.md","bibtex":"https://ijcai.org/proceedings/2019/bibtex/834","volume":{"slug":"2019","title":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2019","url":"https://ijcai.org/proceedings/2019/","year":2019,"location":"Macao","dates":"10-16 August 2019","editors":"Sarit Kraus","isbn":"978-0-9992411-4-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2019"},"section":"AI for Improving Human Well-being","track":"AI for Improving Human Well-being","number":834,"pages":{"first":6020,"last":6027},"keywords":["Special Track on AI for Improving Human-Well Being: Human wellbeing (Special Track on AI and Human Wellbeing)","Special Track on AI for Improving Human-Well Being: AI benefits to society AI applications (Special Track on AI and Human Wellbeing)"],"videos":[],"references":[{"position":1,"raw":"[Basilico et al., 2016] Nicola Basilico, Stefano Coniglio, and Nicola Gatti. Methods for finding leader-follower equilibria with multiple followers. In AAMAS, pages 1363-1364, 2016.","title":"Methods for finding leader-follower equilibria with multiple followers","authors":"Nicola Basilico, Stefano Coniglio, Nicola Gatti","year":"2016","venue":"AAMAS","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Böhme et al., 2010] Rainer Böhme, Galina Schwartz, et al. Modeling cyber-insurance: towards a unifying framework. In WEIS, 2010.","title":"Modeling cyber-insurance: towards a unifying framework","authors":"Rainer Böhme, Galina Schwartz","year":"2010","venue":"WEIS","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[CBS, 2017] CBS. Wannacry ransomware attack losses could reach $4 billion. https://www.cbsnews.com/news /wannacry-ransomware-attacks-wannacry-virus-losses/, 2017. Last accessed on 25 Feb 2019.","title":"CBS. Wannacry ransomware attack losses could reach $4 billion","authors":"Cbs","year":"2017","venue":null,"doi":null,"url":"https://www.cbsnews.com/news/wannacry-ransomware-attacks-wannacry-virus-losses/,2017","internal_url":null},{"position":4,"raw":"[Chan et al., 2012] Hau Chan, Michael Ceyko, and Luis E. Ortiz. Interdependent defense games: Modeling interde- pendent security under deliberate attacks. In UAI, pages 152-162, 2012.","title":"Interdependent defense games: Modeling interdependent security under deliberate attacks","authors":"Michael Hau Chan, Luis E Ceyko, Ortiz","year":"2012","venue":"UAI","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chan et al., 2017] Hau Chan, Michael Ceyko, and Luis Or- tiz. Interdependent defense games with applications to in- ternet security at the level of autonomous systems. Games, 8(1):13, 2017.","title":"Interdependent defense games with applications to internet security at the level of autonomous systems","authors":"Michael Hau Chan, Luis Ceyko, Ortiz","year":"2017","venue":"Games","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Coniglio et al., 2017] Stefano Coniglio, Nicola Gatti, and Alberto Marchesi. Pessimistic leader-follower equilibria with multiple followers. In IJCAI, pages 171-177, 2017.","title":"Pessimistic leader-follower equilibria with multiple followers","authors":"Stefano Coniglio, Nicola Gatti, Alberto Marchesi","year":"2017","venue":"IJCAI","doi":null,"url":null,"internal_url":"/proceedings/2017/25"},{"position":7,"raw":"[Czyzyk et al., 1998] Joseph Czyzyk, Michael P Mesnier, and Jorge J Moré. The NEOS server. IEEE Computational Science and Engineering, 5(3):68-75, 1998.","title":"The NEOS server","authors":"Joseph Czyzyk, Jorge J Michael P Mesnier, Moré","year":"1998","venue":"IEEE Computational Science and Engineering","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Fang et al., 2016] Fei Fang, Thanh H Nguyen, Rob Pickles, Wai Y Lam, Gopalasamy R Clements, Bo An, Amandeep Singh, Milind Tambe, and Andrew Lemieux. Deploying PAWS: Field optimization of the protection assistant for wildlife security. In IAAI, pages 3966-3973, 2016.","title":"Deploying PAWS: Field optimization of the protection assistant for wildlife security","authors":"Fei Fang, Thanh H Nguyen, Rob Pickles, Wai Y Lam, Gopalasamy R Clements, Bo An, Amandeep Singh, Milind Tambe, Andrew Lemieux","year":"2016","venue":"IAAI","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Fudenberg and Levine, 1998] Drew Fudenberg and David K Levine. The Theory of Learning in Games, volume 2. MIT press, 1998.","title":"The Theory of Learning in Games","authors":"Levine Fudenberg, Drew Fudenberg, David K Levine","year":"1998","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Gan et al., 2015] Jiarui Gan, Bo An, and Yevgeniy Vorob- eychik. Security games with protection externalities. In AAAI, pages 914-920, 2015.","title":"Security games with protection externalities","authors":"Jiarui Gan, Bo An, Yevgeniy Vorobeychik","year":"2015","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Gan et al., 2018] Jiarui Gan, Edith Elkind, and Michael Wooldridge. Stackelberg security games with multiple un- coordinated defenders. In AAMAS, pages 703-711, 2018.","title":"Stackelberg security games with multiple uncoordinated defenders","authors":"Jiarui Gan, Edith Elkind, Michael Wooldridge","year":"2018","venue":"AAMAS","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Gordon and Loeb, 2002] Lawrence A Gordon and Martin P Loeb. The economics of information security investment. ACM Transactions on Information and System Security (TISSEC), 5(4):438-457, 2002.","title":"The economics of information security investment","authors":"A Lawrence, Martin P Gordon, Loeb","year":"2002","venue":"ACM Transactions on Information and System Security (TISSEC)","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Gordon et al., 2003] Lawrence A Gordon, Martin P Loeb, and William Lucyshyn. Sharing information on computer systems security: An economic analysis. Journal of Ac- counting and Public Policy, 22(6):461-485, 2003.","title":"Sharing information on computer systems security: An economic analysis","authors":"Martin P Lawrence A Gordon, William Loeb, Lucyshyn","year":"2003","venue":"Journal of Accounting and Public Policy","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Grossklags et al., 2010] Jens Grossklags, Svetlana Ra- dosavac, Alvaro A Cárdenas, and John Chuang. Nudge: Intermediaries' role in interdependent network security. In TRUST, pages 323-336, 2010.","title":"Nudge: Intermediaries' role in interdependent network security","authors":"Grossklags","year":"2010","venue":null,"doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Guo et al., 2016] Qingyu Guo, Bo An, Yair Zick, and Chun- yan Miao. Optimal interdiction of illegal network flow. In IJCAI, pages 2507-2513, 2016.","title":"Optimal interdiction of illegal network flow","authors":"Qingyu Guo, Bo An, Yair Zick, Chunyan Miao","year":"2016","venue":"IJCAI","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Horst and Tuy, 2013] Reiner Horst and Hoang Tuy. Global Optimization: Deterministic Approaches. Springer Sci- ence & Business Media, 2013.","title":"Global Optimization: Deterministic Approaches","authors":"Tuy ; Horst, Reiner Horst, Hoang Tuy","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Jiang et al., 2011] Libin Jiang, Venkat Anantharam, and Jean Walrand. How bad are selfish investments in network security? IEEE/ACM Transactions on Networking (TON), 19(2):549-560, 2011.","title":"How bad are selfish investments in network security","authors":"Libin Jiang, Venkat Anantharam, Jean Walrand","year":"2011","venue":"IEEE/ACM Transactions on Networking (TON)","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Kearns and Ortiz, 2004] Michael Kearns and Luis E Ortiz. Algorithms for interdependent security games. In NIPS, pages 561-568, 2004.","title":"Algorithms for interdependent security games","authors":"Michael Kearns, Luis E Ortiz","year":"2004","venue":"NIPS","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Kunreuther and Heal, 2003] Howard Kunreuther and Geof- frey Heal. Interdependent security. Journal of Risk and Uncertainty, 26(2-3):231-249, 2003.","title":"Interdependent security","authors":"Heal Kunreuther, Howard Kunreuther, Geoffrey Heal","year":"2003","venue":"Journal of Risk and Uncertainty","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Laszka et al., 2015] Aron Laszka, Mark Felegyhazi, and Levente Buttyan. A survey of interdependent information security games. ACM Computing Surveys, 47(2):23, 2015.","title":"A survey of interdependent information security games","authors":"Aron Laszka, Mark Felegyhazi, Levente Buttyan","year":"2015","venue":"ACM Computing Surveys","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Omic et al., 2009] Jasmina Omic, Ariel Orda, and Piet Van Mieghem. Protecting against network infections: A game theoretic perspective. In INFOCOM, pages 1485- 1493, 2009.","title":"Protecting against network infections: A game theoretic perspective","authors":"Jasmina Omic, Ariel Orda, Piet Van Mieghem","year":"2009","venue":"INFOCOM","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Paruchuri et al., 2008] Praveen Paruchuri, Jonathan P Pearce, Janusz Marecki, Milind Tambe, Fernando Or- donez, and Sarit Kraus. Playing games for security: An efficient exact algorithm for solving bayesian Stackelberg games. In AAMAS, pages 895-902, 2008.","title":"Playing games for security: An efficient exact algorithm for solving bayesian Stackelberg games","authors":"Praveen Paruchuri, Jonathan P Pearce, Janusz Marecki, Milind Tambe, Fernando Ordonez, Sarit Kraus","year":"2008","venue":"AAMAS","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Schlenker et al., 2017] Aaron Schlenker, Haifeng Xu, Mina Guirguis, Chris Kiekintveld, Arunesh Sinha, Milind Tambe, Solomon Sonya, Darryl Balderas, and Noah Dun- statter. Don't bury your head in warnings: A game- theoretic approach for intelligent allocation of cyber- security alerts. In IJCAI, pages 381-387, 2017.","title":"Don't bury your head in warnings: A gametheoretic approach for intelligent allocation of cybersecurity alerts","authors":"Aaron Schlenker, Haifeng Xu, Mina Guirguis, Chris Kiekintveld, Arunesh Sinha, Milind Tambe, Solomon Sonya, Darryl Balderas, Noah Dunstatter","year":"2017","venue":"IJCAI","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Schlenker et al., 2018] Aaron Schlenker, Omkar Thakoor, Haifeng Xu, Fei Fang, Milind Tambe, Long Tran-Thanh, Phebe Vayanos, and Yevgeniy Vorobeychik. Deceiving cy- ber adversaries: A game theoretic approach. In AAMAS, pages 892-900, 2018.","title":"Deceiving cyber adversaries: A game theoretic approach","authors":"Aaron Schlenker, Omkar Thakoor, Haifeng Xu, Fei Fang, Milind Tambe, Long Tran-Thanh, Phebe Vayanos, Yevgeniy Vorobeychik","year":"2018","venue":"AAMAS","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Tambe, 2011] Milind Tambe. Security and Game Theory: Algorithms, Deployed Systems, Lessons Learned. Cam- bridge University Press, 2011.","title":"Security and Game Theory: Algorithms, Deployed Systems, Lessons Learned","authors":"Milind Tambe","year":"2011","venue":null,"doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Thycotic, 2017] Thycotic. 2017 state of cyber security metrics annual report. https://thycotic.com/wp-content/u ploads/2013/03/2017-Cyber-Security-Strategy-Executive -Summary.pdf, 2017. Last accessed on 25 Feb 2019.","title":"Thycotic. 2017 state of cyber security metrics annual report","authors":"Thycotic","year":"2017","venue":null,"doi":null,"url":"https://thycotic.com/wp-content/uploads/2013/03/2017-Cyber-Security-Strategy-Executive-Summary.pdf","internal_url":null},{"position":27,"raw":"[UK, 2015] UK. National Security Strategy and Strategic Defence and Security Review 2015. Government of the United Kingdom, 2015.","title":"National Security Strategy and Strategic Defence and Security Review","authors":null,"year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[UK, 2016] UK. National Cyber Security Strategy 2016- 2021. Government of the United Kingdom, 2016.","title":"UK. National Cyber Security Strategy 2016-2021","authors":null,"year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Vorobeychik and Letchford, 2015] Yevgeniy Vorobey- chik and Joshua Letchford. Securing interdependent assets. Autonomous Agents and Multi-Agent Systems, 29(2):305-333, 2015.","title":"Yevgeniy Vorobeychik and Joshua Letchford. Securing interdependent assets","authors":"Letchford Vorobeychik","year":"2015","venue":"Autonomous Agents and Multi-Agent Systems","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}