Interdependent Strategic Security Risk Management with Bounded Rationality in the Internet of Things

TL;DR

This paper models security decision-making in IoT networks considering users' limited attention and bounded rationality, proposing a game-theoretic framework and an algorithm to identify critical users affecting overall security.

Contribution

It introduces a holistic game-in-games model with a novel GNE solution for IoT security under bounded rationality and develops an algorithm to find critical decision-makers.

Findings

The proposed algorithm effectively identifies critical users in IoT security networks.

The GNE framework captures the interdependence of bounded rational decisions and cognitive network formation.

Case studies demonstrate the model's applicability to smart community scenarios.

Abstract

With the increasing connectivity enabled by the Internet of Things (IoT), security becomes a critical concern, and the users should invest to secure their IoT applications. Due to the massive devices in the IoT network, users cannot be aware of the security policies taken by all its connected neighbors. Instead, a user makes security decisions based on the cyber risks he perceives by observing a selected number of nodes. To this end, we propose a model which incorporates the limited attention or bounded rationality nature of players in the IoT. Specifically, each individual builds a sparse cognitive network of nodes to respond to. Based on this simplified cognitive network representation, each user then determines his security management policy by minimizing his own real-world security cost. The bounded rational decision-makings of players and their cognitive network formations are interdependent and thus should be addressed in a holistic manner. We establish a games-in-games framework and propose a Gestalt Nash equilibrium (GNE) solution concept to characterize the decisions of agents, and quantify their risk of bounded perception due to the limited attention. In addition, we design a proximal-based iterative algorithm to compute the GNE. With case studies of smart communities, the designed algorithm can successfully identify the critical users whose decisions need to be taken into account by the other users during the security management.

Tables

Table 1. TABLE I: Nomenclature

$𝒩$	$𝒩:=\{1,2,\dots ,N\}$, set of players/users
$R_{ii}^i$	security investment cost coefficient of player $i$
$R_{ij}^i$	security investment influence coefficient of player $j$ on player $i$
$r_i$	unit return of security investment of player $i$
$r$	$r:=[r_1,r_2,\dots ,r_N]$
$u_i$	security investment decision of player $i$
$u$	$u:=[u_1,u_2,\dots ,u_N]$
$u_{-i}$	set of decisions of all players except $i$-th one
$𝒰$	set of decisions of all players
$m^i$	$m^i:={\left[m_j^i\right]}_{j\ne i,j\in 𝒩}$, $m_j^i\in [0,1]$, the attention network of player $i$
$u_j^{c_i}$	$u_j^{c_i}=m_j^i{u}_j$, decision of player $j$ perceived by player $i$
$J_i$	cost function of player $i$
$\widetilde{J^i}$	cost function of player $i$ under bounded rationality
$B{R}^i$	best response of player $i$
${\Lambda }^i$	${\Lambda }^i:={\left[{\Lambda }_{jk}^i\right]}_{j\ne i,k\ne i,j\in 𝒩,k\in 𝒩}$, ${\Lambda }_{jk}^i:=\frac{1}{R_{ii}^i}{R}_{ij}^i{R}_{ik}^i{u}_j{u}_k$
$e_{N-1}$	an $N-1$-dimensional column vector with all one entries
${\alpha }_i$	weighting factor quantifying the unit cost of player $i$’s cognition
${\beta }_i$	total number of links in the cognitive network of player $i$
$\left|\right|\cdot |{|}_1$	standard L-1 norm
$\left|\right|\cdot \left|\right|$	standard L-2 norm
${\iota }_C$	indicator function on set $C$
${\mathrm{prox}}_{\cdot }$	proximal operator

Equations

$$J^i(u_i,u_{-i})=F_1^i(u_i)-F_2^i(u_i)-F_3^i(u_i,u_{-i}),$$

$$J^i(u_i,u_{-i})=\frac{1}{2}{R}_{ii}^i{u}_i^2-r_i{u}_i-\sum _{j\ne i,j\in \mathcal{N}}{R}_{ij}^i{u}_i{u}_j,$$

$$R_{ii}^i{u}_i-\sum _{j\ne i,j\in \mathcal{N}}{R}_{ij}^i{u}_j-r_i=0,\forall i\in \mathcal{N}.$$

$$\left[\begin{array}{cccc}{R}_{11}^1& -R_{12}^1& \cdots & -R_{1N}^1\\ -R_{21}^2& R_{22}^2& \cdots & -R_{2N}^2\\ ⋮& ⋮& \ddots & ⋮\\ -R_{N1}^N& -R_{N2}^N& \cdots & R_{NN}^N\end{array}\right]\left[\begin{array}{c}{u}_1\\ u_2\\ ⋮\\ u_N\end{array}\right]=\left[\begin{array}{c}{r}_1\\ r_2\\ ⋮\\ r_N\end{array}\right]\iff Ru=r,$$

$$\widetilde{J^i}(u_i,u_{-i}^{c_i},m^i)$$

$$=\frac{1}{2}{R}_{ii}^i{u}_i^2-r_i{u}_i-\sum _{j\ne i,j\in \mathcal{N}}{R}_{ij}^i{u}_i{u}_j^{c_i},$$

$$\begin{array}{rl}\left[\begin{array}{cccc}{R}_{11}^1& -m_2^1{R}_{12}^1& \cdots & -m_N^1{R}_{1N}^1\\ -m_1^2{R}_{21}^2& R_{22}^2& \cdots & -m_N^2{R}_{2N}^2\\ ⋮& ⋮& \ddots & ⋮\\ -m_1^N{R}_{N1}^N& -m_2^N{R}_{N2}^N& \cdots & R_{NN}^N\end{array}\right]\left[\begin{array}{c}{u}_1\\ u_2\\ ⋮\\ u_N\end{array}\right]& =\left[\begin{array}{c}{r}_1\\ r_2\\ ⋮\\ r_N\end{array}\right]\\ \iff R^{s}u& =r.\end{array}$$

$$u_i=B{R}^i(u_{-i}^{c_i})=\frac{1}{R_{ii}^i}\left(\sum _{j\ne i,j\in \mathcal{N}}{R}_{ij}^i{u}_j^{c_i}+r_i\right),$$

$$J^i$$

$$-\sum _{k\ne i,k\in \mathcal{N}}\left[\frac{1}{R_{ii}^i}{R}_{ik}^i{u}_k\left(\sum _{j\ne i,j\in \mathcal{N}}{R}_{ij}^i{u}_j^{c_i}+r_i\right)\right]$$

$$-\frac{r_i}{R_{ii}^i}\left(\sum _{j\ne i,j\in \mathcal{N}}{R}_{ij}^i{u}_j^{c_i}+r_i\right)$$

$$=$$

$$-\sum _{k\ne i,k\in \mathcal{N}}\left(\sum _{j\ne i,j\in \mathcal{N}}{u}_j^{c_i}{R}_{ij}^i\right)\frac{1}{R_{ii}^i}{R}_{ik}^i{u}_k-\sum _{k\ne i,k\in \mathcal{N}}\frac{1}{R_{ii}^i}{r}_i{R}_{ik}^i{u}_k.$$

$$\begin{array}{rl}{J}^i& (B{R}^i(u_{-i}^{c_i}),u_{-i})=\\ & \frac{1}{2}\sum _{j\ne i,j\in \mathcal{N}}\sum _{k\ne i,k\in \mathcal{N}}{m}_j^i\frac{1}{R_{ii}^i}{R}_{ij}^i{R}_{ik}^i{m}_k^i{u}_j{u}_k-\frac{1}{2R_{ii}^i}{\left(r_i\right)}^2\\ & -\sum _{k\ne i,k\in \mathcal{N}}\sum _{j\ne i,j\in \mathcal{N}}{m}_j^i\frac{1}{R_{ii}^i}{R}_{ij}^i{R}_{ik}^i{u}_j{u}_k-\sum _{k\ne i,k\in \mathcal{N}}\frac{1}{R_{ii}^i}{r}_i{R}_{ik}^i{u}_k.\end{array}$$

$$m^{i\ast }=$$

$$=$$

$$-\sum _{j\ne i,j\in \mathcal{N}}\sum _{k\ne i,k\in \mathcal{N}}\frac{1}{R_{ii}^i}{R}_{ij}^i{R}_{ik}^i{u}_k{u}_j{m}_j^i+{\alpha }_i\Vert m^i{\Vert }_1$$

$$=$$

$$\begin{array}{rl}\underset{m_j^i,j\ne i,j\in \mathcal{N}}{\min }& \frac{1}{2}{m^i}^T{\Lambda }^i{m}^i-e_{N-1}^T{\Lambda }^i{m}^i+{\alpha }_i\Vert m^i{\Vert }_1\\ s.t.& 0\le m_j^i\le 1,j\ne i,j\in \mathcal{N},(\mathrm{Risk}\mathrm{perception}),\end{array}$$

$$\begin{array}{rl}\underset{m_j^i,j\ne i,j\in \mathcal{N}}{\min }& \frac{1}{2}{m^i}^T{\Lambda }^i{m}^i-e_{N-1}^T{\Lambda }^i{m}^i\\ s.t.& 0\le m_j^i\le 1,j\ne i,j\in \mathcal{N},(\mathrm{Risk}\mathrm{perception}),\\ & \Vert m^i{\Vert }_1={\beta }_i,(\mathrm{Limited}\mathrm{attention}),\end{array}$$

$${\tilde{J}}^i(u_i^{\ast },u_{-i}^{\ast },m^{i\ast })\le {\tilde{J}}^i(u_i,u_{-i}^{\ast },m^i),\forall u_i\in {\mathcal{U}}_i,\forall m^i\in [0,1{]}^{N-1}.$$

$$u_{i,k+1}=B{R}^i(u_{-i,k}^{c_i})=\frac{1}{R_{ii}^i}\left(\sum _{j\ne i,j\in \mathcal{N}}{R}_{ij}^i{u}_{j,k}^{c_i}+r_i\right),$$

$$L_i(m^i,u_{-i})=J^i(B{R}^i(u_{-i}^{c_i}),u_{-i})-J^i(B{R}^i(u_{-i}),u_{-i}),$$

$$L_i(m^i,u_{-i})=\frac{1}{2}\sum _{j\ne i,j\in \mathcal{N}}\sum _{k\ne i,k\in \mathcal{N}}(1-m_j^i)(1-m_k^i)\frac{1}{R_{ii}^i}{R}_{ji}^i{R}_{ik}^i{u}_j{u}_k.$$

$$\underset{m_j^i,j\ne i,j\in \mathcal{N}}{\min }{Q}_i(m^i):=\frac{1}{2}{m^i}^T{\Lambda }^i{m}^i-e_{N-1}^T{\Lambda }^i{m}^i+{\alpha }_i\Vert m^i{\Vert }_1+{\iota }_C(m^i),$$

$${\iota }_C(x)=\{\begin{array}{ll}0,& \mathrm{if}x\in C,\\ +\infty ,& \mathrm{otherwise}.\end{array}$$

$$\begin{array}{rl}{f}_1^i(m^i)& =\frac{1}{2}{m^i}^T{\Lambda }^i{m}^i-e_{N-1}^T{\Lambda }^i{m}^i,(\mathrm{Security}\mathrm{loss}),\\ f_2^i(m^i)& ={\alpha }_i\Vert m^i{\Vert }_1,(\mathrm{Cognition}\mathrm{cost}),\\ f_3^i(m^i)& ={\iota }_C(m^i),(\mathrm{Feasible}\mathrm{risk}\mathrm{perception}),\end{array}$$

$${\mathrm{prox}}_{\lambda g}(x)=\arg \underset{l}{\min }g(l)+\frac{1}{2\lambda }\Vert l-x{\Vert }^2.$$

$${\left[{\mathrm{prox}}_{\lambda f_2^i}(x)\right]}_j=\{\begin{array}{ll}{x}_j-\lambda {\alpha }_i,& x_j\ge \lambda {\alpha }_i,\\ 0,& |x_j|<\lambda {\alpha }_i,\\ x_j+\lambda {\alpha }_i,& x_j\le -\lambda {\alpha }_i,\end{array}$$

$${\mathrm{prox}}_{\lambda f_2^i}(x)=(x-\lambda {\alpha }_i{e}_{N-1}{)}_{+}-(-x-\lambda {\alpha }_i{e}_{N-1}{)}_{+}.$$

$${\left[{\mathrm{prox}}_{\lambda f_3^i}(x)\right]}_j={\left[{\mathrm{proj}}_C(x)\right]}_j=\{\begin{array}{ll}1,& \mathrm{if}{x}_j>1,\\ x_j,& \mathrm{if}0\le x_j\le 1,\\ 0,& \mathrm{if}{x}_j<0,\end{array}$$

$${\mathrm{prox}}_{\lambda (f_2^i+f_3^i)}(x)$$

$$=\arg \underset{l\in C}{\min }{f}_2^i(l)+\frac{1}{2\lambda }\Vert l-x{\Vert }^2.$$

$$\underset{y\ne x,y\to x}{\lim \inf }\frac{1}{\Vert y-x\Vert }\left[f(y)-f(x)-⟨p,y-x⟩\right]\ge 0.$$

$$\displaystyle\partial f(x):=\Big{\{}p\in\mathbb{R}^{n}:\exists x_{n}\rightarrow x,f(x_{n})\rightarrow f(x),$$

Full text

I Introduction

Recent years have witnessed a significant growth of urban population. As the growth continues, cities need to become more efficient to serve the surging population. To achieve this objective, cities need to become smarter with the integration of information and communication techniques (ICTs) and urban infrastructures. Driven by the advances in sensing, computing, storage and cloud technologies, the Internet of Things (IoT) plays a central role in supporting the development of smart city. Though IoT enables a highly connected world, the security of IoT becomes a critical concern. There are 5.5 million new things connected every day in 2016, as we head toward more than 20 billion by 2020 [1]. These IoT devices come from different manufacturers, and they have heterogeneous functionalities and security configurations and policies. No uniform security standards are used for IoT devices as they are developed using different system platforms for various functionalities. Moreover, due to the connections between IoT devices, the security of one device is also dependent on the security of other devices to which it connects. Therefore, the heterogeneity and the interconnectivity of massive heterogeneous IoT have created significant challenges for security management. Fig. 1 depicts a highly connected smart community enabled by IoT devices. Each household needs to take into account the cyber risks coming from their connected neighbors when securing their devices.

In cyber networks, security management and practices of users are often viewed as the weakest link [2]. The lack of security awareness and expertise at the user’s end creates human-induced vulnerabilities that can be easily exploited by an adversary, exacerbating the insecurity of IoT. To this end, it is critical to enhance the security by strengthening security management in a decentralized way. Hence, in the IoT, each device owner or system manager needs to allocate resources (e.g. human resources, computing resources, investments or cognition) to secure his applications. For example, the smart building operator can spend resources on upgrading the hardware, hiring staff members for network monitoring and forensics, and developing tailored security solutions to the smart building. A smart home user, on the other hand, can safely configure its network and regularly updates its software and password of the IoT devices as illustrated in Fig. 1.

The devices in the IoT networks and their interconnections can be modeled as nodes and links, respectively. The security policy of one device can have an impact on the security risk of nodes that are connected to it. Since various users own different devices, the security management in IoT is decentralized in nature. Therefore, the process of decentralized security decision-making can be modeled as a game problem in which each user strategically allocates his resources to secure the devices [3]. In this game, the users’ risks are reduced when their connected neighbors are of high-level security. Due to the complex and massive connections, users cannot be aware of the security policies taken by all its connected neighbors. Instead, a user can only make security decisions based on the cyber risk he perceives by observing a selected number of nodes. This fact indicates that the game model needs to take into account the bounded rationality of players [4]. Therefore, in the game framework, we use a cognition vector representing the observation structure of each IoT user. Specifically, a sparser cognition vector represents a user with weaker cognition ability, and he observes a smaller number of other users’ behaviors when deciding his strategy. Thus, the limited attention nature of users creates a bounded perception of cyber risks.

In the established bounded rational game model, the users need to make security management decisions as well as design their cognition networks in a holistic manner. In order to achieve this goal, we define a new solution concept called Gestalt Nash equilibrium (GNE) to capture the cognitive network formation and the security management under the bounded rationality simultaneously. The analysis of the GNE provides a quantitative method to understand the risk of massive IoTs and gives tractable security management policies. We further design a proximal-based iterative algorithm to compute the GNE of the game. The GNE resulting from the algorithm reveals several typical phenomena that match well with the real-world observations. For example, when the network contains two groups of users, then under the limited attention, all users will allocate their cognition resources to the same group which demonstrates the law of partisanship. Further, in a heterogeneous massive IoT, the equilibrium successfully identifies the set of agents that are invariably paid attention to by other users, demonstrating the phenomenon of attraction of the mighty. Since the framework predicts the high-level systemic risk of the IoT network, it also can be used to inform the design of security standards and incentive mechanisms, e.g., through contracts and cyber insurance.

The developed security management model provides an essential framework to assess IoT security risks when applied to various applications. For example, in smart home communities, the households are connected together to share heterogeneous information, e.g., electricity prices and temperature readings through smart meters, and real-time information of items in local stores and shops by wireless sensors. The connections of IoT devices thus create security interdependencies between households. Another broader application lies in the different components in smart cities. Due to the interconnectivity between large-scale infrastructures including the transportation, power grids, and communications, the manager of each sector needs to take into account the cyber risks coming from other components when adopting security solutions.

The contributions of this paper are summarized as follows:

We propose a holistic framework to investigate the security management of users with bounded rationality in the IoT networks. 2. 2.

We model the cognition of users with a sparse vector and quantify users’ risk of bounded perception resulting from the underperceived cyber threats in the network. 3. 3.

We design a proximal-based algorithm to compute the GNE which contains security management strategy and cognitive network of agents. The algorithm discovers several phenomena including emergence of partisanship, filling the inattention, and attraction of the mighty. 4. 4.

We apply the proposed model to a smart community, and demonstrate that the designed algorithm can identify the most critical households in the network.

I-A Related Work

Security management has been investigated in various research fields including computer networks [5], communications [6], cloud computing [7] and infrastructures [8]. With the advances in ICTs, a growing number of works have focused on the emerging critical issue of IoT security [9, 10]. Due to the interconnectivity between different agents, the security of one agent is also dependent on its connected ones which gives rise to the notion of “interdependent security” [11]. The authors in [12, 13, 14, 15] have further investigated the security interdependencies in multilayer cyber-physical systems. The authors in [16, 17, 18] have developed optimal contracts to address the cyber-physical security issues in IoT. In [19, 20, 21], the authors proposed optimal schemes for designing secure and resilient multi-layer IoT networks through graph-theoretical approaches.

Games over networks have caught a lot of attention recently especially from the economics perspective [22, 23, 24]. The couplings between players in the network can be either in a strategic exclusive or strategic complement manner. Based on the features of security management in IoT, our problem falls into the latter class. For the engineering applications, the authors in [8, 25] have studied the resource allocation game over interdependent critical infrastructures where both players aim to increase the connectivity of the network. Huang et.al [26, 27, 28, 29] have adopted a stochastic Markov game model to design resilient operating strategies for multilayer networks. Zhu et.al [30] have proposed a game-theoretic framework for collaborative intrusion detection systems through resource management to mitigate network cyber threats. Our work differs from [30] in that we take into account the cognitive factors of human behaviors during decision making.

Humans with limited knowledge or cognitive resources are bounded rational, since they cannot pay attention to all the information [31, 32]. Gabaix has proposed a “sparse max” operator to model the limited attention of players in which each agent builds a simplified model of the network based on an $l_{1}$ norm [4]. Built upon [33] which includes some preliminary results, our work leverages on the established “sparse max” operator and formulates a constrained game program to capture the bounded cognition ability of players in the IoT. In addition, we further consider the risk management of each user based on their underperceived cyber risks over the network.

I-B Organization of the Paper

The rest of the paper is organized as follows. Section II formulates a security management game over IoT networks with bounded rational players. Section III analyzes the problem. Section IV designs a proximal-based iterative algorithm to compute the GNE. Case studies are given in Section V, and Section VI concludes the paper.

I-C Summary of Notations

For convenience, we summarize the notations used in the paper in Table I. Note that notations associated with $*$ refer to the value at equilibrium. Furthermore, notations with index $k$ stands for its value at step $k$ during the iterative updates.

II Problem Formulation

In this section, we formulate a problem involving strategic security decision making and cognitive network formation of players in the IoT networks.

II-A Security Management Game over Networks

In an IoT user network including a set $\mathcal{N}$ of nodes111The terms of node, agent and player refer to the user in the IoT, and they are used interchangeably., where $\mathcal{N}:=\{1,2,...,N\}$, each node can be seen as a player that makes strategic decisions on the security management to secure their IoT devices. For instance, in Fig. 1, each smart home is a player securing their smart things to mitigate the cyber threats. We define $\mathcal{U}:=\{u_{1},...,u_{N}\}$ by the decision profile of all the players. Specifically, $u_{i}$ is a one-dimensional decision variable representing player $i$’s security management effort. For convenience, we denote $u_{-i}:=\mathcal{U}\setminus\{u_{i}\}$. The objective of player $i$, $i\in\mathcal{N}$, is to minimize his security risk strategically by taking the costly action $u_{i}$. We define by $F_{1}^{i}:\mathbb{R}_{+}\rightarrow\mathbb{R}_{+}$ the cost of security management effort of player $i$ which is an increasing function of $u_{i}$. The corresponding benefit of security management is captured by a function $F_{2}^{i}:\mathbb{R}_{+}\rightarrow\mathbb{R}_{+}$. Intuitively, a larger $u_{i}$ yields a higher return, and hence $F_{2}^{i}$ is monotonically increasing. Due to the interconnections in the IoT, the risk of player $i$ is also dependent on his connected users. Then, we use a function $F_{3}^{i}:\mathbb{R}_{+}\times\mathbb{R}_{+}^{N-1}\rightarrow\mathbb{R}_{+}$ to represent the influence of player $i$’s connected users on his security. The coupling between players in the IoT is in a strategic complement fashion with respect to the security decisions. More specifically, a larger security investment $u_{j}$ of player $j$, a connected node of player $i$, decreases the cyber risks of player $i$ as well. Therefore, the cost function of player $i$ can be expressed as the following form:

[TABLE]

where $J^{i}:\mathbb{R}_{+}\times\mathbb{R}_{+}^{N-1}\rightarrow\mathbb{R}$. To facilitate the analysis and design of security risk management strategies, we specify some appropriate forms of functions in (1). In the following, we focus on player $i$ taking the quadratic form: $F_{1}^{i}(u_{i})=\frac{1}{2}R_{ii}^{i}u_{i}^{2}$, $F_{2}^{i}(u_{i})=r_{i}u_{i}$, and $F_{3}^{i}(u_{i},u_{-i})=\sum_{j\neq i,j\in\mathcal{N}}R_{ij}^{i}u_{i}u_{j}$. Thus, (1) can be detailed as

[TABLE]

where $R_{ii}^{i}>0,\ r_{i}>0,\ \forall i$, and $R_{ij}^{i}\geq 0$, $\forall j\neq i,i\in\mathcal{N}$. Note that parameters $R_{ij}^{i}$, $i,j\in\mathcal{N}$, represent the risk dependence network of player $i$ in the IoT, and the value of $R_{ij}^{i}$ indicates the strength of risk influence of player $j$ on player $i$ which is given as a prior. The first term $\frac{1}{2}R_{ii}^{i}u_{i}^{2}$ in (2) is the cost of security management with an increasing marginal price. The second term $r_{i}u_{i}$ denotes the corresponding payoff of cyber risk reduction. Then, the first two terms capture the fact that increasing a certain level of cyber security becomes more difficult in a secure network than a less secure one. The last term $\sum_{j=1,j\neq i}^{N}R_{ij}^{i}u_{i}u_{j}$ is the aggregated security risk effect from connected users of player $i$. Specifically, the structure of $F_{3}^{i}$ in $u_{i}$ and $u_{j}$ indicates that the risk measure $J^{i}$ of player $i$ decreases linearly with respect to user $j$’s action. Hence, in the established model, larger investment from a user helps reduce cyber risk influence in a linear way. We have following assumption on the security influence parameters.

Assumption 1**.**

$R_{ii}^{i}>\sum_{j\neq i,j\in\mathcal{N}}R_{ij}^{i},\ \forall i\in\mathcal{N}$.

Assumption 1 has a natural interpretation which indicates that the security of a user is mainly determined by his own strategy rather than other users’ decisions in the IoT network. Moreover, based on the heterogeneous influence networks characterized by Assumption 1, each node designs its own security investment strategy which enables the decentralized decision-making. The strategies of nodes are interdependent due to the coupling between their cost functions shown in (2).

Through the first order optimality condition (FOC), we obtain

[TABLE]

Putting (3) in a matrix form yields

[TABLE]

where $r:=[r_{i}]_{i\in\mathcal{N}}$, $u:=[u_{i}]_{i\in\mathcal{N}}$.

For convenience, we denote this security management game by $\mathcal{G}$. One solution concept of game $\mathcal{G}$ is Nash equilibrium (NE) which is defined as follows.

Definition 1** (Nash Equilibrium of Game $\mathcal{G}$ [3]).**

The strategy profile $u^{*}=[u_{i}^{*}]_{i\in\mathcal{N}}$ constitutes a Nash equilibrium of game $\mathcal{G}$ if $J^{i}(u_{i},u_{-i}^{*})\geq J^{i}(u_{i}^{*},u_{-i}^{*}),\ \forall i\in\mathcal{N},\ \forall u_{i}\in\mathcal{U}_{i}.$

The NE of game $\mathcal{G}$ yields strategic security management policies of players under the condition that they can perceive all the cyber risks in the IoT network.

II-B Bounded Rational Security Management Game

In reality, the users in IoT are connected with numerous other agents. For example, a single household can be connected with a number of other houses in terms of various types of IoT products in the smart communities. Therefore, when making security management strategies, each user may not be capable to observe all its connected neighbors. Instead, a user can only respond to a selected number of other players’ decisions. Then, this bounded rational response mechanism creates a cognitive network formation process for the players in the network. Specifically, player $i$’s irrationality is captured by a vector $m^{i}:=[m^{i}_{j}]_{j\neq i,j\in\mathcal{N}}$, $m^{i}_{j}\in[0,1]$, which stands for the attention network that player $i$ builds. When $m^{i}_{j}=0$, user $i$ pays no attention to user $j$’s behavior; when $m^{i}_{j}=1$, user $i$ observes the true value of security management $u_{j}$ of user $j$. The value that $m^{i}_{j}$ admits between 0 and 1 can be interpreted as the trustfulness of user $i$ on the perceived $u_{j}$. Another interpretation of $m^{i}_{j}$ can be the probability that user $i$ observes the behavior of user $j$ at each time instance on the security investment over a long period. Hence, the decision of player $j$ perceived by player $i$ becomes $u_{j}^{c_{i}}=m_{j}^{i}u_{j}$. Then, player $i$ minimizes the modified cost function with bounded rationality defined as:

[TABLE]

where $\tilde{J^{i}}:\mathbb{R}_{+}\times\mathbb{R}_{+}^{N-1}\times[0,1]^{N-1}\rightarrow\mathbb{R}$.

The FOC of (5) gives $R_{ii}^{i}u_{i}-\sum_{j\neq i,j\in\mathcal{N}}R_{ij}^{i}u_{j}^{c_{i}}-r_{i}=0,\ \forall i\in\mathcal{N},$ which is equivalent to

[TABLE]

The bounded rational best-response of player $i$, $i\in\mathcal{N}$, then becomes

[TABLE]

where $u_{j}^{c_{i}}=m_{j}^{i}u_{j}$.

We denote the security management game of players with limited attention by $\tilde{\mathcal{G}}$. Comparing with the solution concept NE of game $\mathcal{G}$, the one of game $\tilde{\mathcal{G}}$ is generalized to bounded rational Nash equilibrium (BRNE). The formal definition of BRNE is as follows.

Definition 2** (Bounded Rational Nash Equilibrium of Game $\tilde{\mathcal{G}}$).**

With given cognition vectors $m^{i}$, $\forall i\in\mathcal{N}$, the strategy profile $u^{*}=[u_{i}^{*}]_{i\in\mathcal{N}}$ constitutes a BRNE of game $\tilde{\mathcal{G}}$ if $\tilde{J}^{i}(u_{i},u_{-i}^{*},m^{i})\geq\tilde{J}^{i}(u_{i}^{*},u_{-i}^{*},m^{i}),\ \forall i\in\mathcal{N},\ \forall u_{i}\in\mathcal{U}_{i}.$

Note that the cognitive network each user built has an impact on the BRNE of game $\tilde{\mathcal{G}}$. Hence, how the users determine the cognition vector $m^{i}$, $i\in\mathcal{N}$, becomes a critical issue. In the ensuing section, we introduce the cognitive network formation of players in the IoT.

II-C Cognitive Network Formation

Due to the massive connections in IoT, each user builds a sparse cognitive network containing the agents to observe. To this end, the real cost of user $i$ by taking the bounded rationality into account becomes

[TABLE]

Incorporating the cognition vector $m^{i}$ into the real cost of player $i$ further yields

[TABLE]

Recall that each user aims to minimize the security risk based on the risks he perceives. Thus, by considering the real cost induced by the bounded rationality constraint, the strategic cognitive network formation problem of player $i$ can be formulated as

[TABLE]

where $\Lambda^{i}:=[\Lambda^{i}_{jk}]_{j\neq i,k\neq i,j\in\mathcal{N},k\in\mathcal{N}}$, $\Lambda^{i}_{jk}=\frac{1}{R_{ii}^{i}}R_{ij}^{i}R_{ik}^{i}{u_{j}}u_{k}$, $e_{N-1}$ is an $N-1$-dimensional column vector with all one entries, and $\alpha_{i}$ is a weighting factor capturing the unit cost of cognition of player $i$ and it can be tuned to match with experimental data. The term $\|m^{i}\|_{1}$ is a convex relaxed version of $\|m^{i}\|_{0}$ which approximately maintains the sparse property of player $i$’s cognitive network [34, 35]. The integrated term $\alpha_{i}\|m^{i}\|_{1}$ can be interpreted as the cognitive cost of user $i$.

Therefore, for player $i$, we need to solve the following constrained optimization problem:

[TABLE]

where the constraints $m^{i}_{j}\in[0,1]$, $\forall j\neq i$, indicate the risk perception behavior of user $i$.

The number of cognitive links that player $i$ can form is generally a positive integer, i.e., $\|m^{i}\|_{1}=\beta_{i}\in\mathbb{N}^{+}$. Note that $\beta_{i}$ here and $\alpha_{i}$ in (9) have the same interpretation which both quantify the cognition ability of player $i$. Then, by choosing $\alpha_{i}$ strategically, the problem in (9) is equivalent to the following problem:

[TABLE]

where $\beta_{i}\in\mathbb{N}^{+}\leq N-1$ is the total number of links that player $i$ can form in his cognitive network, quantifying his limited attention. Simulation studies in Section V reflect that considering $\|m^{i}\|_{1}=\beta_{i}$ yields sparser cognitive networks. Note that we still solve (9) by selecting a proper $\alpha_{i}$ which yields equivalent (9) and (10).

II-D Gestalt Nash Equilibrium

The formulated security management under bounded rationality problem boasts a games-of-games structure. The users make decisions strategically in the IoT network as well as form their cognitive networks selfishly. The security management game and cognitive network formation game are interdependent. Therefore, the cognitive and IoT user layers shown in Fig. 2 constitute a network-of-networks framework. In this paper, we aim to design an integrated algorithm to design the cognitive networks and determine the security risk management decisions of users in a holistic manner.

To this end, we present the solution concept, Gestalt Nash equilibrium, of the bounded rational security risk management game as follows.

Definition 3** (Gestalt Nash Equilibrium).**

The Gestalt Nash equilibrium (GNE) of the security risk management game under bounded rationality is a profile $(m^{i*},u_{i}^{*})$, $\forall i\in\mathcal{N}$, that satisfies

[TABLE]

At the GNE, all the players in the network do not change their action $u_{i}$ and cognition vector $m^{i}$, $\forall i\in\mathcal{N}$, simultaneously.

Remark: The strategic security management profile $u^{*}=[u_{i}^{*}]_{i\in\mathcal{N}}$ at GNE is also a BRNE.

In the following, we aim to analyze the GNE of the game and compute it by designing algorithms.

III Problem Analysis

We first analyze the convergence of the bounded rational best-response dynamics of players in Section II-B. Then, we quantify the risk of bounded perception due to limited attention of players. We further reformulate the cognitive network formation problem presented in Section II-C.

III-A Bounded Rational Best Response Dynamics

Based on Section II-B, the bounded rational best-response dynamics of player $i$ under cognitive network $m^{i}$, $i\in\mathcal{N}$, can be written as

[TABLE]

where $u_{j,k}^{c_{i}}=m_{j}^{i}u_{j,k}$ and $k$ denotes the iteration index. Then, we obtain the following convergence result of security management strategy updates of users under given cognition networks.

Lemma 1**.**

Under Assumption 1, the sparse best-response dynamics (11) for all players converge to a unique BRNE.

Proof.

In the sparse cognition networks, $R_{ii}^{i}>\sum_{j\neq i,j\in\mathcal{N}}m^{i}_{j}R_{ij}^{i},\ \forall i\in\mathcal{N}$, since $m^{i}_{j}\in[0,1]$. Then, $R^{s}$ defined in (6) is strictly diagonal dominant by rows, and $u$ admits a unique solution. In addition, both Gauss-Seidel and Jacobi types of best-response dynamics (11) converges [36]. ∎

Note that Assumption 1 is a sufficient condition. In some cases, the best-response dynamics (11) may still converge when Assumption 1 does not hold. We focus on the scenarios under Assumption 1 in this paper which exhibit a natural security dependence interpretation.

III-B Risk of Bounded Perception

When making security strategies in the IoT, the risk of bounded perception (RBP) of users due to irrationality/limited attention is defined as follows.

Definition 4** (RBP).**

With the cognition vector $m^{i}$, the RBP of player $i$, $i\in\mathcal{N}$, is defined as

[TABLE]

where $L_{i}:\mathcal{M}_{i}\times\mathcal{U}_{-i}\rightarrow\mathbb{R}$.

Note that RBP is defined over the real-world cost functions (2), quantifying the security loss of the users due to limited attention. We further present the following lemma.

Lemma 2**.**

Under the bounded rational model, each user in the network has a degraded security level comparing with the one obtained from the model containing fully rational users. The RBP of player $i$, $i\in\mathcal{N}$, with bounded rationality is

[TABLE]

Proof.

See Appendix A. ∎

Remark: Note that the RBP of each player is nonnegative from Lemma 2, since the coefficients and security investments are nonnegative and the cognition variable admits a value between 0 and 1. Intuitively, if player $i$ is able to perceive all the cyber risks in the network, i.e., $m^{i}_{j}=1$, $\forall j\neq i,\ j\in\mathcal{N}$, then the RBP is $L_{i}(m^{i},u_{-i})=0$. In this scenario, the bounded rational model degenerates to the fully rational one. This indicates that, with more observations, the IoT users can design security management strategies better to lower their security risks. This fact also leads to the conclusion that more information (better cognitive ability) is beneficial for the users in our security management game. The result in Lemma 2 is further illustrated and corroborated through case studies in Section V.

III-C Problem Reformulation

We can rewrite the constrained optimization program (9) as

[TABLE]

where $Q_{i}:[0,1]^{N-1}\rightarrow\mathbb{R}\cup\{+\infty\}$, $C:=\{m^{i}|0\leq m^{i}_{j}\leq 1,j\neq i,j\in\mathcal{N}\}$, and $\iota_{C}$ is an indicator function, i.e.,

[TABLE]

For convenience, we decompose the function $Q_{i}$ into three parts and define

[TABLE]

where $f_{1}^{i}:\mathbb{R}^{N-1}\rightarrow\mathbb{R},$ $f_{2}^{i}:\mathbb{R}^{N-1}\rightarrow[0,+\infty)$ and $f_{3}^{i}:\mathbb{R}^{N-1}\rightarrow\{0,+\infty\}$. Specifically, for user $i\in\mathcal{N}$, $f_{1}^{i}$ quantifies a modified security loss; $f_{2}^{i}$ captures the cognition cost; and $f_{3}^{i}$ ensures a feasible risk perception over the IoT.

The optimization problem (13) is quite challenging to solve. First, note that the convexity of $f_{1}^{i}$ depends on the characteristics of matrix $\Lambda^{i}$. Specially, when $\Lambda^{i}$ is positive definite, then $f_{1}^{i}$ is convex in $m^{i}$. When $\Lambda^{i}$ is not definite, then solving the quadratic program is an NP hard problem. Second, the $l_{1}$ norm-based function $f_{2}^{i}$ and the indicator function $f_{3}^{i}$ are nonsmooth and not differentiable, though they are convex. The traditional gradient-based optimization tools are not sufficient to deal with this type of optimization problem in (13) [37]. To this end, we aim to design a proximal algorithm to solve this problem.

IV Computing GNE via Algorithm Design

In this section, our goal is to design an algorithm to solve problem (13). We further characterize the closed form solutions for a special case with homogeneous agents for comparison during case studies in Section V. In addition, we present an integrated algorithm that computes the GNE of the bounded rational security management game.

IV-A Basics of Proximal Operator

To address (13), we leverage the tools from proximal operator theory. We first present the definition of proximal operator as follows.

Definition 5** (Proximal Operator [38]).**

Let $g\in\Gamma_{0}$, where $\Gamma_{0}$ denotes the set of proper lower semicontinuous convex functions. The proximal mapping associated to $g$ is defined as

[TABLE]

Note that the proximal mapping is unique, since the optimization problem in (16) is convex. Specifically, for function $f_{2}^{i}$ in (15), we have

[TABLE]

for $j\neq i,\ j\in\mathcal{N}$, which can be put in a compact form as [39]

[TABLE]

In addition, $\mathrm{prox}_{\lambda f_{3}^{i}}(x)=\mathrm{proj}_{C}(x),\ C=[0,1]^{N-1},$ which is equivalent to

[TABLE]

where “proj” denotes the projection operator.

The following lemma characterizes the aggregated proximal operator of functions $f_{2}^{i}$ and $f_{3}^{i}$ which is useful in designing the proximal algorithm.

Lemma 3**.**

Functions $f_{2}^{i}$ and $f_{3}^{i}$ defined in (15), $\forall i\in\mathcal{N}$, satisfy the property: $\mathrm{prox}_{\lambda(f_{2}^{i}+f_{3}^{i})}=\mathrm{proj}_{C}\circ\mathrm{prox}_{\lambda f_{2}^{i}}$.

Proof.

We proof for single dimensional case, i.e., $C=[0,1]$, and the analysis can be generalized for higher dimensional cases. By definition, we obtain

[TABLE]

Let $l^{*}=\arg_{l}\left(\frac{\partial\left(f_{2}^{i}(l)+\frac{1}{2\lambda}\|l-x\|^{2}\right)}{\partial x}=0\right)=\mathrm{prox}_{\lambda f_{2}^{i}}(x)$. In addition, function $f_{2}^{i}(l)+\frac{1}{2\lambda}\|l-x\|^{2}$ is decreasing in $l<l^{*}$ and increasing in $l\geq l^{*}$. Remind that $C=[0,1]$ is a closed set. Hence, when $0\leq l^{*}\leq 1$, $\mathrm{prox}_{\lambda(f_{2}^{i}+f_{3}^{i})}(x)=l^{*}$; when $l<l^{*}$, $\mathrm{prox}_{\lambda(f_{2}^{i}+f_{3}^{i})}(x)=0$; and when $l>l^{*}$, $\mathrm{prox}_{\lambda(f_{2}^{i}+f_{3}^{i})}(x)=1$. In all three cases, we obtain $\mathrm{prox}_{\lambda(f_{2}^{i}+f_{3}^{i})}(x)=\mathrm{proj}_{C}(l^{*})=\mathrm{proj}_{C}(\mathrm{prox}_{\lambda f_{2}^{i}}(x)).$ ∎

Lemma 3 indicates that we can deal with the convex terms of cognitive cost and feasible risk perception jointly. The security loss term $f_{1}^{i}$ is addressed in the ensuing section.

IV-B Design of Proximal Algorithm

Recall that $f^{i}_{2}$ and $f_{3}^{i}$, $\forall i\in\mathcal{N}$, are nonsmooth and not differentiable. To characterize the optimal cognition vector in $f^{i}_{2}$ and $f_{3}^{i}$, we first present the definition of subdifferential of a function which can be nonconvex and nonsmooth as follows.

Definition 6** (Subdifferential [40]).**

Let $f:\mathbb{R}^{n}\rightarrow\mathbb{R}$ be a proper and lower semicontinuous function.

The domain of $f$ is denoted by $\mathrm{dom}\ f:=\{x\in\mathbb{R}^{n}:f(x)<+\infty\}$. 2. 2.

For $x\in\mathrm{dom}\ f$, the Fréchet subdifferential of $f$ at $x$ is the set of vectors $p\in\mathbb{R}^{n}$, denoted by $\hat{\partial}f(x)$, that satisfy

[TABLE] 3. 3.

The limiting-subdifferential (or subdifferential) of $f$ at $x\in\mathrm{dom}\ f$, denoted by $\partial f(x)$, is defined by

[TABLE]

Remark: Based on the subifferential, a necessary condition for $x\in\mathbb{R}^{n}$ being a minimizer of $f$ is

[TABLE]

Note that the points satisfying (18) are called critical points of $f$. Our goal is to find a critical point $\bar{m}^{i}\in\mathrm{dom}\ Q_{i}$ that can be characterized by the necessary FOC: $0\in\partial Q_{i}(\bar{m}^{i})$.

Note that $f_{1}^{i}$ is continuously differentialble with Lipschitz continuous gradient, i.e.,

[TABLE]

where $L_{i}$ is the Lipschitz constant of $f_{1}^{i}$. Specifically, $\nabla f_{1}^{i}(m^{i})=\Lambda^{i}m^{i}-\Lambda^{i}e_{N-1}$, which further yields

[TABLE]

The main steps in solving (13) for a general $\Lambda^{i}$ of user $i$ are designed as follows:

[TABLE]

where the step constants $\lambda_{x}^{i}$ and $\lambda_{y}^{i}$ satisfy $0<\lambda_{x}^{i}<1/L_{i}$ and $0<\lambda_{y}^{i}<1/L_{i}$, respectively. If the algorithm converges, the values of $x_{k}^{i},\ y_{k}^{i},\ z_{k}^{i}$ and $v_{k}^{i}$ are the same which give the optimal cognition vector $m^{i}$.

Remark: Note that (22) serves as a monitor of the update in (21). Together with the condition in (24), each player updates their cognitive network when there is a sufficient decrease of the security management cost.

Before presenting the convergence results of the algorithm (20)-(24), we first characterize a critical property of function $Q_{i}(m^{i})$ defined in (13).

Definition 7** (Kurdyka-Łojasiewicz (KL) Property [41]).**

A function $f:\mathbb{R}^{n}\rightarrow(-\infty,+\infty]$ has the KL property at $x^{*}\in\mathrm{dom}\ \partial f:=\{x\in\mathbb{R}^{n}:\partial f(x)\neq\emptyset\}$ if there exists $\eta\in(0,+\infty]$, a neighborhood $U$ of $x^{*}$, and a desingularising function $\phi\in\Phi_{\eta}$, such that $\forall x\in U\cap\{x\in\mathbb{R}^{n}:f(x^{*})<f(x)<f(x^{*})+\eta\}$, the following KL inequality holds,

[TABLE]

where $\Phi_{\eta}$ includes a class of function $\phi:[0,\eta)\rightarrow\mathbb{R}^{+}$ satisfying: (1) $\phi$ is concave and $\phi\in C^{1}((0,\eta))$; (2) $\phi$ is continuous at [math] with $\phi(0)=0$; and (3) $\phi^{\prime}(x)>0,\ \forall x\in(0,\eta)$. In addition, $\mathrm{dist}(0,\partial f(x)):=\inf\left\{\|z\|:z\in\partial f(x)\right\}.$

Note that a proper lower semicontinuous function $f$ having the KL property at each point of $\mathrm{dom}\ \partial f$ is called a KL function. KL inequality (25) ensures that, by choosing a proper desingularising function $\phi$, we can reparameterize the values of function $f$ near its critical points to avoid flatness. Thus, $\phi$ has an impact on the convergence rate of the designed algorithm which will be presented in Theorem 1. KL property is general in functions. Notably, the semi-algebraic functions satisfy the KL property [41]. Some examples include real polynomial functions, indicator functions of semi-algebraic sets and $\|\cdot\|_{p}$ with $p\geq 0$. Furthermore, the semi-algebraic property preserves under composition, finite sums and products of semi-algebraic functions [42].

Lemma 4**.**

Functions $f_{1}^{i},\ f_{2}^{i}$ and $f_{3}^{i}$ in (15) satisfy the KL property, and thus $Q_{i}$ in (13) is a KL function. In addition, the desingularising function $\phi(u)$ can be chosen as $\phi(u)=\frac{\kappa}{\theta}u^{\theta}$ for some $\theta\in(0,\frac{1}{2}]$ and $\kappa>0$.

Proof.

We know that $f_{1}^{i},\ f_{2}^{i}$ and $f_{3}^{i}$ are semi-algebraic functions, and thus $Q_{i}$ satisfies the KL property [41]. Remind that when $m^{i}\notin C:=\{m^{i}|0\leq m^{i}_{j}\leq 1,j\neq i,j\in\mathcal{N}\}$, $Q_{i}(m^{i})\rightarrow+\infty$. Based on Definition 6, we obtain $\mathrm{dom}\ \partial Q_{i}=C$. Therefore, $Q_{i}(m^{i})$ is analytic over $\mathrm{dom}\ \partial Q_{i}$. In addition, the desingularising function of real-analytical functions satisfying inequality (25) can be chosen as $\phi(u)=u^{1-\delta}$, where $\delta\in[\frac{1}{2},1)$ [42]. ∎

Based on Lemma 4, we present the convergence result of the designed algorithm (20)-(24) in Theorem 1.

Theorem 1**.**

The algorithm given by (20)-(24) converges to a critical point with rates related to the parameters $\kappa$ and $\theta$, where $\kappa$ and $\theta$ are defined in Lemma 4. Specifically, there exists a $k_{0}$ such that $\forall k>k_{0}$,

[TABLE]

*where $Q_{i}^{*}$ is the function value achieved at critical points of $\{x_{k}\}$, $d_{2}=\min\left\{\frac{1}{2d_{1}\kappa},\sigma(Q_{i}(v_{0})-Q_{i}^{*})^{2\theta-1}\right\}$, $d_{1}=2\alpha(\frac{1}{\lambda_{x}}+L)^{2}/(1-2\alpha)$, and $\sigma=\frac{\kappa}{1-2\theta}\left(2^{\frac{2\theta-1}{2\theta-2}}-1\right)$. *

Proof.

See Appendix B. ∎

For a special case where $f_{1}^{i}$ is convex, the following simplified steps (26)-(29) can be adopted to accelerate the computation. The monitoring update step $v_{k+1}$ is omited due to the convexity of $f_{1}^{i}$. This algorithm is slightly different with the one in [43] in terms of the projection step. Since $Q_{i}$ is convex, then algorithm (26)-(29) converges to a unique optimal solution.

[TABLE]

Similar to (20)-(24), when the algorithm (26)-(29) converges, the values of $x_{k}^{i},\ y_{k}^{i}$ and $z_{k}^{i}$ are the same which give the optimal cognition vector $m^{i}$.

Homogeneous Users Case: When the agents in the IoT network are homogeneous, i.e., $R_{ii}^{i}=R_{jj}^{j}$, $R_{ij}^{i}=R_{ji}^{j}$, $r_{i}=r_{j}=r$, $\beta_{i}=\beta_{j}=\beta\leq N-1$, $\forall i,j\in\mathcal{N}$, we can characterize the closed form solutions of decisions $u_{i}$ and $m^{i}$, $\forall i\in\mathcal{N}$. Specifically, we obtain, $\forall i\in\mathcal{N}$,

[TABLE]

where $R_{1}=R_{ii}^{i}$ and $R_{2}=R_{jk}^{i}$ for $j\neq i$ and $k\neq i$. The results indicate that, at GNE, the cognitive network that each user $i$ forms, $i\in\mathcal{N}$, is symmetric, i.e., the allocated attention to other users $j\neq i$ by user $i$ is the same. In addition, with a larger $\beta$, the users spend more effort on the security management at GNE. This can be interpreted as follows: with a better perception of cyber risks in the IoT, the users becomes better informed of the risks and make best effort to reduce the security loss.

IV-C Integrated Algorithm and Discussions

For clarity, we summarize the combined algorithm including the strategic security decision-makings of players in the IoT networks and their corresponding cognitive network formations together in Algorithm 2. The integrated algorithm exhibits an alternating pattern between the best-response of security management and the strategic cognitive network formation of IoT users.

We next discuss some observations obtained from the algorithm. The steps $z_{k+1}^{i}$ and $v_{k+1}^{i}$ in (21) and (22) of the algorithm can be simplified further. Here, we only analyze $z_{k+1}^{i}$, and the procedure follows for $v_{k+1}^{i}$. First, we have $\nabla f_{1}^{i}(y_{k}^{i})=\Lambda^{i}(y_{k}^{i}-e_{N-1})$. Then, $[y_{k}^{i}-\lambda_{y}^{i}\nabla f_{1}^{i}(y_{k}^{i})]_{j}=[y_{k}^{i}-\lambda_{y}^{i}\Lambda^{i}(y_{k}^{i}-e_{N-1})]_{j}\geq 0$, $\forall j\neq i,j\in\mathcal{N}$. Thus, based on (17), we obtain

[TABLE]

The update of player $i$’s attention on player $j$ at step $k+1$, $j\neq i$, can be expressed as

[TABLE]

When $\frac{R_{ij}^{i}}{R_{ii}^{i}}u_{j}\sum_{p\neq i,p\in\mathcal{N}}R_{ip}^{i}u_{p}\left(1-[y^{i}_{k}]_{p}\right)\geq\alpha_{i}$ which is equivalent to $\sum_{p\neq i,p\in\mathcal{N}}R_{ip}^{i}u_{p}[y^{i}_{k}]_{p}\leq\sum_{p\neq i,p\in\mathcal{N}}R_{ip}^{i}u_{p}-\frac{R_{ii}^{i}}{R_{ij}^{i}u_{j}}\alpha_{i}$, we know that $[z_{k+1}^{i}]_{j}\geq[z_{k}^{i}]_{j}$. The player $i$’s attention on player $j$ increases at step $k+1$, since there remains extra cognition resources to be allocated which corresponds to a phenomenon called filling the inattention. In addition, a smaller cognition cost $\alpha_{i}$ yields a larger upper bound for $\sum_{p\neq i,p\in\mathcal{N}}R_{ip}^{i}u_{p}[y^{i}_{k}]_{p}$, and hence player $i$ can pay more attention to other players which again leads to the observation of filling the inattention.

In the IoT network, user $j$’s decision has an impact on the strategy of user $i$. To illustrate the discovery, we consider two groups of IoT users, and one group of users have more incentive to secure the devices, i.e., their security investment is larger. Then, from user $i$’s perspective, his attention on user $j$ is influenced by the term ${R_{ii}^{i}}/({R_{ij}^{i}u_{j}})$. When user $j$ lies in the group of a higher investment $u_{j}$, then the upper bound $\sum_{p\neq i,p\in\mathcal{N}}R_{ip}^{i}u_{p}-\frac{R_{ii}^{i}}{R_{ij}^{i}u_{j}}\alpha_{i}$ is larger. Therefore, each IoT user will allocate more cognition resources to the users in the group with a higher security standard which exposes the phenomenon of emergence of partisanship.

In a heterogeneous IoT network, the system parameters $R_{ij}^{i}$, $R_{ii}^{i}$, and decisions $u_{i}$ are generally different. Then, for player $i\in\mathcal{N}$, the term $\frac{R_{ij}^{i}}{R_{ii}^{i}}u_{j}\sum_{p\neq i,p\in\mathcal{N}}R_{ip}^{i}u_{p}$, $j\neq i,\ j\in\mathcal{N}$, identifies the most influential agents in the network. Moreover, the critical agents to pay attention to for each user almost overlap, resulting the phenomenon of attraction of the mighty during the cognitive network formation.

We illustrate the discovered phenomena in Section V.

V Case Studies

We use case studies of IoT-enabled smart communities shown in Fig. 1 to corroborate the designed algorithms and illustrate the security management of bounded rational agents in this section.

V-A Effectiveness of Algorithm 1

First, we verify the effectiveness of Algorithm 1. Specifically, we choose $N=10$, $\alpha=100$ and generate a $9\times 9$ random matrix which is not definite for $\Lambda^{i}$. Thus, $f_{2}^{i}$ in (15) is not convex. The iterative updates through the designed proximal algorithm are presented in Fig. 3 which reveal fast convergence to the steady state. In addition, the algorithm yields a sparse cognition vector $m=[1,0,0,0,0.41,1,0,0.30,0.26]$. To investigate the robustness of the algorithm, we study the same network as in Fig. 3(a) with different initial conditions. The results are shown in Figs. 3(b) and 3(c). We can verify that the steady states in Figs. 3(b) and 3(c) are the same as the ones in Fig. 3(a) which corroborate the robustness of the algorithm to initial conditions. To further verify the algorithm, we also investigate the network containing different numbers of agents. The results with 7 and 15 agents are presented in Figs. 3(d) and 3(e). Both results indicate that the designed algorithm is reliable in computing the sparse steady strategy. After conducting sufficient number of case studies, we conclude that the algorithm is effective with probability 1 under arbitrary number of agents.

V-B Homogeneous Smart Homes

In this case study, we consider $N=10$ homogeneous households in the smart community, i.e., all the parameters are the same for each agent. Specifically, the parameters are chosen as follows: R_{jk}^{i}=20\ \mathrm{unit}/\mathrm{k}\^{2}$if$j=k=i$, otherwise$R_{jk}^{i}=1\ \mathrm{unit}/\mathrm{k}$^{2}$,$\forall i$;$r_{i}=25\ \mathrm{unit}/\mathrm{k}$$,$\forall i\in\mathcal{N}$and$\alpha^{i}=\alpha$,$\forall i$, is chosen to satisfy$\beta=|m^{i}|{1}=3. The selected parameters indicate that the security level of a household is mainly determined by its own security management policy rather than the ones of connected households. Recall that we have obtained the analytical solutions for homogeneous case in ([30](#S4.E30)) which yield m^{i}{j}=\frac{1}{3},\ \forall j\neq i,j\in\mathcal{N}$and$u_{i}=\frac{25}{17}=1.47\mathrm{k}$$. Thus, each agent allocates attention resource equally to their connected neighbors. Fig. 4 presents the results by using Algorithm 2, where the step index represents an iteration between two components of cognitive network formation and security investment. We can conclude that the rational decision yields less cost for players compared with their irrational decision counterparts due to the bounded rationality. Furthermore, the algorithm gives the same cognitive network structure as the one obtained from the analytical results which corroborates the proposed integrated algorithm.

V-C Emergence of Partisanship

We next investigate a smart community including two groups of agents denoted by $G1$ and $G2$, respectively. Specifically, $G1$ includes 5 agents, $G1=\{1,...,5\}$, and $G2$ contains 10 agents, $G2=\{6,...,15\}$. The parameters are the same as those in Section V-B except that for agents in $G1$, r_{i}=40\ \mathrm{unit}/\mathrm{k}\$$, \forall i\in G1$, to distinguish two groups of users. Thus, the agents in$G1$have more incentives to secure their IoT products than those in$G2. Fig. [5](#S5.F5) shows the results. For agents in G1$, the cognitive network is characterized by$m^{i}=[0.75,...,0.75,0,...,0]$,$i\in G1$, and for agents in$G2$,$m^{j}=[0.6,...,0.6,0,...,0]$,$j\in G2$. Therefore, with limited cognition, all agents only pay attention to the security decisions made by smart homes in$G1$ which yields the phenomenon of partisanship. We also verify that the RBP increases due to the bounded rationality.

V-D Filling the Inattention

Under the setting of Section V-C, we further assume that the agents have better cognitive ability and can perceive more cyber risks in the smart community in a way that $\beta=\|m^{i}\|_{1}=8$. Other parameters are the same as those in Section V-C. Fig. 6 presents the results. Specifically, we obtain $m^{i}=[1,...,1,0.4,...,0.4]$ for $i\in G1$ and $m^{j}=[1,...,1,0.33,...,0.33]$ for $j\in G2$, which show that the agents in $G1$ play a critical role in the security risk management of smart community. Furthermore, with more cognition resource, the agents in $G2$ that are not paid attention to previously in Section V-C are considered by other households. This phenomenon is termed as filling the inattention.

V-E Attraction of the Mighty

The critical agents in the IoT-enabled smart community are those households whose security management policies will be taken into account by the other agents during their decision makings. Specifically, the nodes who often appear in the cognitive networks of other nodes can be regarded as critical agents. In the following case study, we aim to identify the critical agents in a smart community with $N=10$ households using Algorithm 2. To model the heterogeneity of smart homes, we choose R_{jk}^{i}=3\sin(i)+20\ \mathrm{unit}/\mathrm{k}\^{2}$for$j=k=i$. Otherwise,$R_{jk}^{i}=1\ \mathrm{unit}/\mathrm{k}$^{2}$,$\forall i$;$r_{i}=15+2i\ \mathrm{unit}/\mathrm{k}$$for$i\in\mathcal{N}$; and other parameters are the same as those in Section V-B. The results are shown in Fig. 7. Specifically, Fig. 7(e) shows the established cognitive network of each player. For example, during the cognitive network formation, player 1 chooses to observe the strategies of players 5, 9, and 10 in the network, and player 5’s cognitive network includes players 6, 9, and 10. Furthermore, agents 5, 9 and 10 present in all agents’ cognitive networks, and hence they constitute a critical community in this smart home network. In addition, agent 6 also plays a critical role in agents 5, 9 and 10’s cognitive networks. Therefore, the behavior of agents paying attention to a specific set of households can be described by the attraction of mighty. This case study demonstrates that Algorithm 2 is able to identify the critical components in the smart communities.

VI Conclusion

In this paper, we have investigated the security management of users with limited attention over IoT networks through a two-layer framework. The proposed Gestalt Nash equilibrium (GNE) has successfully characterized the bilevel decision makings, including the security management policies and the cognitive network formations of users. Under the security interdependencies, users with a better cognition ability can reduce their cyber risks by making mature decisions. Furthermore, the designed proximal-based algorithm for the computation of GNE has revealed some phenomena that match well with the real-life observations, including the emergence of partisanship and attraction of the mighty. The future work would be extending the framework to incorporate hidden information of unperceived cyber risks of IoT users and design mechanisms to mitigate security loss. Another interesting research direction is to extend the current model to scenarios when a set of users are not fully strategic in minimizing their own risks and analyze the impact of this class of users’ misbehavior on the network security risk.

Appendix A Proof of Lemma 2

Proof.

Based on (8), we can compute the RBP of node $i$ as

[TABLE]

Further, we can rewrite $\sum_{j\neq i,j\in\mathcal{N}}\sum_{k\neq i,k\in\mathcal{N}}\frac{1}{R_{ii}^{i}}R_{ji}^{i}R_{ik}^{i}{u_{j}}u_{k}=\sum_{j\neq i,j\in\mathcal{N}}\sum_{k\neq i,k\in\mathcal{N}}m_{j}^{i}\frac{1}{R_{ii}^{i}}R_{ji}^{i}R_{ik}^{i}{u_{j}}u_{k}+\sum_{j\neq i,j\in\mathcal{N}}(1-m_{j}^{i})\sum_{k\neq i,k\in\mathcal{N}}(1-m_{k}^{i})\frac{1}{R_{ii}^{i}}R_{ji}^{i}R_{ik}^{i}{u_{j}}u_{k}+\sum_{j\neq i,j\in\mathcal{N}}(1-m_{j}^{i})\sum_{k\neq i,k\in\mathcal{N}}m_{k}^{i}\frac{1}{R_{ii}^{i}}R_{ji}^{i}R_{ik}^{i}{u_{j}}u_{k}.$ Therefore, we obtain

[TABLE]

∎

Appendix B Proof of Theorem 1

Proof.

The main idea of the proof follows [44] with several differences. Especially the imposed conditions for showing convergence in [44] are different. In addition, our algorithm contains projections and an auxiliary parameter $v_{k+1}$ during updates. First, based on Definition 5, $v_{k+1}=\mathrm{proj}_{C}\left(\mathrm{prox}_{\lambda_{x}f_{2}^{i}}(x_{k}-\lambda_{x}\nabla f_{1}^{i}(x_{k}))\right)=\arg\min_{x\in C}\ \langle\nabla f_{1}^{i}(x_{k}),x-x_{k}\rangle+\frac{1}{2\lambda_{x}}\|x-x_{k}\|^{2}+f_{2}^{i}(x).$ Then, $\langle\nabla f_{1}^{i}(x_{k}),v_{k+1}-x_{k}\rangle+\frac{1}{2\lambda_{x}}\|v_{k+1}-x_{k}\|^{2}+f_{2}^{i}(v_{k+1})\leq f_{2}^{i}(x_{k})$. Based on the Lipschitz continuous condition of $f_{1}^{i}$, we obtain

[TABLE]

When $Q_{i}(z_{k+1})\leq Q_{i}(v_{k+1})$, $x_{k+1}=z_{k+1},\ Q_{i}(x_{k+1})=Q_{i}(z_{k+1})\leq Q_{i}(v_{k+1}),$ and when $Q_{i}(z_{k+1})>Q_{i}(v_{k+1})$, $x_{k+1}=v_{k+1},\ Q_{i}(x_{k+1})=Q_{i}(z_{k+1}).$ Hence,

[TABLE]

Based on (31) and (32),

[TABLE]

In addition,

[TABLE]

Furthermore, $\{x_{k}\}$ and $\{v_{k}\}$ have the same accumulation points. Let $\Psi$ be the set containing all the accumulation points of $\{x_{k}\}$. Note that $Q_{i}$ admits the same value $Q_{i}^{*}$ at all accumulation points in $\Psi$ due to the non-increasing $Q_{i}(v_{k})$. Then, $Q_{i}(v_{k})\geq Q_{i}^{*}$ and $Q_{i}(v_{k})\rightarrow Q_{i}^{*}$. If there exists an $n$ such that $Q_{i}(v_{n})=Q_{i}^{*}$, the algorithm converges. If $Q_{i}(v_{k})\geq Q_{i}^{*}$, $\forall k$, then there exists a $\tilde{k}_{1}$ such that $Q_{i}(v_{k})<Q_{i}^{*}+\eta$ for $k>\tilde{k}_{1}$. Since $\mathrm{dist}(v_{k},\Psi)\rightarrow 0$, there exists a $\tilde{k}_{2}$ such that $\mathrm{dist}(v_{k},\Psi)<\epsilon$ for $k>\tilde{k}_{2}$. Thus, when $k>k_{0}=\max\{\tilde{k}_{1},\tilde{k}_{2}\}$, $v_{k}\in\{v,\mathrm{dist}(v_{k},\Psi)<\epsilon\}\cap\{Q_{i}^{*}<Q_{i}(v)<Q_{i}^{*}+\eta\}$. Based on the KL property in Definition 7, there exists a concave function $\phi$ such that

[TABLE]

Define $r_{k}:=Q_{i}(v_{k})-Q_{i}^{*}$, and we further assume that $r_{k}>0,\ \forall k$. Otherwise, the algorithm converges in finite steps by definition. Then, $\forall k>k_{0}$,

[TABLE]

where $d_{1}=2\alpha(\frac{1}{\lambda_{x}}+L)^{2}/(1-2\alpha)$. Besides, $\phi$ admits the form $\phi(u)=\frac{\kappa}{\theta}u^{\theta}$. Then, (36) can be rewritten as

[TABLE]

Lemma 4 indicates that $0<\theta\leq\frac{1}{2}$, then, we have $-1\leq\theta-1<-\frac{1}{2}$ and $-1<2\theta-1<0$. When $r_{k-1}>r_{k}$, we obtain $r_{k-1}^{2(\theta-1)}<r_{k}^{2(\theta-1)}$ and $r_{0}^{2\theta-1}<r_{1}^{2\theta-1}<...<r_{k}^{2\theta-1}$. In addition, define $\zeta(u)=\frac{\kappa}{1-2\theta}u^{2\theta-1}$, and then $\zeta^{\prime}(u)=-\kappa u^{2\theta-2}$. When $r_{k}^{2(\theta-1)}\leq 2r_{k-1}^{2(\theta-1)}$, then $\forall k>k_{0}$,

[TABLE]

When $r_{k}^{2(\theta-1)}>2r_{k-1}^{2(\theta-1)}$, then $r_{k}^{2\theta-1}>2^{\frac{2\theta-1}{2(\theta-1)}}r_{k-1}^{2\theta-1}$, and

[TABLE]

Let $\sigma=\frac{\kappa}{1-2\theta}(2^{\frac{2\theta-1}{2(\theta-1)}}-1)$ and $d_{2}=\min\{\frac{1}{2\kappa d_{1}},\sigma r_{0}^{2\theta-1}\}$, then $\forall k>k_{0}$, $\zeta(r_{k})-\zeta(r_{k-1})\geq d_{2}$, and $\zeta(r_{k})\geq\zeta(r_{k})-\zeta(r_{k_{0}})\geq\sum_{t=k_{0}+1}^{k}\zeta(r_{t})-\zeta(r_{t-1})\geq(k-k_{0})d_{2}$. Hence, $r_{k}^{2\theta-1}\geq\frac{d_{2}}{\kappa}(k-k_{0})(1-2\theta)$, leading to $r_{k}\leq\frac{\kappa}{d_{2}(k-k_{0})(1-2\theta)}^{\frac{1}{1-2\theta}}.$ Therefore, we obtain $Q_{i}(x_{k})-Q_{i}^{*}\leq Q_{i}(v_{k})-Q_{i}^{*}=r_{k}=\left(\frac{\kappa}{d_{2}(k-k_{0})(1-2\theta)}\right)^{\frac{1}{1-2\theta}}.$ ∎