Modeling Internet Security Investments: The Case of Dealing with Information Uncertainty

TL;DR

This paper models how individual Internet users decide on security investments considering partial information and externalities, revealing equilibrium behaviors and strategies under realistic uncertainty conditions.

Contribution

It introduces a non-cooperative game-theoretic model accounting for partial information and externalities, analyzing equilibrium efforts and utilities in Internet security investments.

Findings

Existence of symmetric Bayesian Nash equilibria.

Higher connected nodes tend to invest less but gain higher security utility.

Investments are influenced by network connectivity and information uncertainty.

Abstract

Modern distributed communication networks like the Internet and censorship-resistant networks (also a part of the Internet) are characterized by nodes (users) interconnected with one another via communication links. In this regard, the security of individual nodes depend not only on their own efforts, but also on the efforts and underlying connectivity structure of neighboring network nodes. By the term 'effort', we imply the amount of investments made by a user in security mechanisms like antivirus softwares, firewalls, etc., to improve its security. However, often due to the large magnitude of such networks, it is not always possible for nodes to have complete effort and connectivity structure information about all their neighbor nodes. Added to this is the fact that in many applications, the Internet users are selfish and are not willing to co-operate with other users on sharing effort information. In this paper, we adopt a non-cooperative game-theoretic approach to analyze individual user security in a communication network by accounting for both, the partial information that a network node possess about its underlying neighborhood connectivity structure, as well as the presence of positive externalities arising from efforts exerted by neighboring nodes. We investigate the equilibrium behavior of nodes and show 1) the existence of symmetric Bayesian Nash equilibria of efforts and 2) better connected nodes choose lower efforts to exert but earn higher utilities with respect to security improvement irrespective of the nature of node degree correlations amongst the neighboring nodes. Our results provide ways for Internet users to appropriately invest in security mechanisms under realistic environments of information uncertainty.