Abstract

Nowadays, the Internet and computer networks play an increasing role in our modern society. However, we also witness new types of security and privacy incidents such as the propagation of malware, the growth of botnets, and denial-of-service (DoS) attacks against business and governments’ websites. Therefore, experts must investigate security solutions to defend against these well-organized and sophisticated adversaries. Instead of designing a defence against a specific attack, game theory attempts to design a quantitative decision framework to determine the possibility of adversaries’ attacks, and suggest defence strategies for the defenders. This thesis illustrates some examples for the potential usefulness of game theory in information systems security.
First, we present a game theoretic scenario to study the strategic behavior of two Internet Service Providers (ISPs) who have to decide whether to invest in deploying security technologies that detect and prevent malicious cyber-attacks. In particular, we consider the case where the ISPs can determine malware-infected machines among their subscribers, and their action (i.e., quarantining these infected machines) may well mitigate cyber security incidents. By analyzing the financial incentive for the ISPs to deploy security policy among their subscribers, we find the best action of the ISPs considering their customers’ security awareness and their market shares. We also identify the need for government regulations and incentives in order to better guide the role of ISPs in enhancing the global security of the Internet.
Then, we present a game theoretic model for analyzing the dynamic interaction between attackers and defenders as a two-player game with uncertainty while considering multi-level of detection for defence devices configurable by the defender and multi-level of severity for attacks chosen by the attacker. By assuming that higher levels of defence and high level of attack severity are associated with higher levels of investments by the defender and the attacker, respectively, we compute mixed strategy Nash Equilibria for both the attacker and defender considering the cases when the players’ valuation follows a uniform distribution and the case where it follows a truncated normal distribution. We then formulate an n-player game to capture competition among n attackers who aim to successfully attack the same target and analyze the mixed strategy Nash Equilibria in both models.
Finally, we consider networks in which the worm propagator and the defender can dynamically decide their optimal propagation rate for the warm and security patches, respectively, considering their associated cost. We combine the propagation process with a game theoretic model as a two-player non-zero sum differential game. Then we formulate the decision problem as a continuous-time optimal control problem and solve it using the Pontryagin’s maximum principle. The obtained result leads to a better understanding of the worm propagator behavior and can be utilized to inhibit the scale of loss resulting from Internet worms.