Protecting shared information in networks: a network security game with strategic attacks

TL;DR

This paper models security investments in networks where agents share sensitive information, revealing that strategic attack types and network structure significantly influence whether agents under-invest or over-invest in security.

Contribution

It introduces a new security game model considering both strategic and random attacks, analyzing how network topology affects security investment behaviors.

Findings

Under-investment occurs at Nash equilibrium under random attacks.

Network topology influences whether agents over-invest or under-invest in security.

Higher information sharing increases the likelihood of under-investment due to elevated attack risks.

Abstract

A digital security breach, by which confidential information is leaked, does not only affect the agent whose system is infiltrated, but is also detrimental to other agents socially connected to the infiltrated system. Although it has been argued that these externalities create incentives to under-invest in security, this presumption is challenged by the possibility of strategic adversaries that attack the least protected agents. In this paper we study a new model of security games in which agents share tokens of sensitive information in a network of contacts. The agents have the opportunity to invest in security to protect against an attack that can be either strategically or randomly targeted. We show that, in the presence of random attack, under-investments always prevail at the Nash equilibrium in comparison with the social optimum. Instead, when the attack is strategic, either under-investments or over-investments are possible, depending on the network topology and on the characteristics of the process of the spreading of information. Actually, agents invest more in security than socially optimal when dependencies among agents are low (which can happen because the information network is sparsely connected or because the probability that information tokens are shared is small). These over-investments pass on to under-investments when information sharing is more likely (and therefore, when the risk brought by the attack is higher).

Equations

$$\tilde{A}(i,j)=\tilde{A}(j,i)=X_{ij}A(i,j)$$

$$P_{ij}$$

$$=\mathrm{Pr}\{\bigcup _{u\in U_{i,j}(\mathcal{G})}\{u\in U_{i,j}({\mathcal{T}}_i)\}\},$$

$$D_i=\sum _{j\in V}{P}_{ji}=\sum _{j\ne i}{P}_{ji}+1.$$

$$\mathrm{Pr}\{x_i=1\}$$

$$\mathbb{E}(|\mathbf{x}|)=$$

$$=$$

$$P_{1i}=p{P}_{i1}=p{P}_{ij}=p^2.$$

$$D_1=(n-1)p+1D_i=(n-2)p^2+1+p,$$

$$P_{ij}=p^{\mathrm{dist}(i,j)}+p^{n-\mathrm{dist}(i,j)}-p^n.$$

$$D=1+2\sum _{\ell =1}^{n-1}{p}^{\ell }-(n-1)p^n=\frac{1+p-p^n(n+1)+p^{n+1}(n-1)}{1-p}.$$

$$D^n=1+(n-1)P_{ij}^n$$

$$Q^k=1-\sum _{\ell =1}^{k-1}\left(\genfrac{}{}{0ex}{}{k-1}{\ell -1}\right)(1-p{)}^{\ell (k-\ell )}{Q}^{\ell }.$$

$$P_{ij}^n=\sum _{k=2}^n\left(\genfrac{}{}{0ex}{}{n-2}{k-2}\right)(1-p{)}^{k(n-k)}{Q}^k.$$

$$1-(1-p)(1-p^2{)}^{n-2}\le P_{ij}^n\le 1-(1-p{)}^{n-1}.$$

$$a_i=\frac{1}{n}\forall i,$$

$${\Pi }_i=1-\mathrm{Pr}\{x_i=1\}-c(q_i),$$

$$c(q)=\frac{1}{2}\alpha q^2$$

$${\Pi }_i(\{q_i^N,{\mathbf{q}}_{-i}^N\})\ge {\Pi }_i(\{q_i,{\mathbf{q}}_{-i}^N\}).$$

$$q_i^{N,R}=\frac{1}{\alpha n}\forall i.$$

$$S(\mathbf{q})$$

$$q_i^{O,R}=\frac{D_i}{\alpha n}\forall i.$$

$$\frac{{\partial }^{2}S}{\partial q_i^2}=-\alpha <0\frac{{\partial }^{2}S}{\partial q_i\partial q_j}=0,$$

$$q_i^{O,R}=\frac{1+p-p^n(n+1)+p^{n+1}(n-1)}{(1-p)n}i\in V,$$

$$q_i^{O,R}=\{\begin{array}{ll}\frac{(n-1)p+1}{n}& i=1\\ \frac{(n-2)p^2+p+1}{n}& i>1\end{array}$$

$$q_i^{O,R}\to 1\text{as n→∞},$$

$$\underset{\mathbf{a}}{\max }$$

$$|\mathbf{a}|=1\text{ and }{a}_i\ge 0\text{ for all }i\in V.$$

$$\psi (a)=\frac{1}{2}\omega a^2$$

$$\underset{\mathbf{a}}{\max }$$

$$|\mathbf{a}|=1\text{ and }{a}_i\ge 0\text{ for all }i\in V.$$

$$(1-q_i)D_i-\omega a_i+\lambda +{\kappa }_i=0,\forall i,$$

Full text

1 Introduction

Our society and economy have become largely dependent on sharing information over networks. Although in general computer networks provide benefits, they are also prone to cyber attacks, whose impact increases with our dependence on them. Security breaches can have various origins, such as the spread of malware, compromissions of social network accounts, or exploitations of system vulnerabilities. In this paper, we interested in cyber attacks where, without permission, confidential information is obtained. This information may represent for instance confidential documents, intellectual property or identity information. The impact of having sensitive information stolen can be destructive: bank accounts can be plundered, companies can be threatened that strategic decisions or sensitive information will be released or identities can be stolen for criminal purposes. These forms of cyber attacks where confidential information is obtained are occurring more often and keeping personal information out of the hands of thieves is becoming increasingly difficult [15].

From both the scientific literature and the general media [23], it is apparent that the variety of potential threats is huge. Depending on their purpose, some attacks aim at compromising a whole class of systems or devices, whereas others aim at precise targets. We shall refer to the former type of attacks as random attacks and to the latter type as strategic attacks [1, 20]. An example of a random cyber attack would be WannaCry. This is a ransomware virus that in 2017 infected about 200,000 computers worldwide, including computers of the National Health Service in the UK, Renault in France and Telefonica in Spain: these computers were all vulnerable because their operators failed to install in time a simple software patch - i.e. arguably under-invested in security measures. Examples of strategic cyber attacks are quite common. A well-known attack is the 2016 security breach against the Democratic National Committee, by which thousands of e-mails were stolen and subsequently leaked, including e-mails from Hillary Clinton.

Researchers have soon recognized that network security is not only a matter of devising suitable security measures, but also of making sure that individuals put them into practice [23]. Consequently, the adoption of security measures has been regarded as an economic problem and has been addressed with the tools of game theory. In this perspective, the key observation is that the presence of a network introduces interdependencies between risks and costs incurred by the individuals [14]. Hence, the interesting question becomes understanding the effects of these interdependencies. In order to answer this question, a large literature has been developed not only in the economic science but also in computer science [20] and in engineering, including security problems for wireless communication [19] and interdependent control systems by [2, 25, 24, 12]. These works have addressed an array of questions that are relevant in our own work, including security games featuring strategic attacks [7], multiple targets [20], multiple attackers and defenders [26]. In this Introduction, we will not trying to provide a complete literature survey on interdependent security, for which we can point the reader to sources like [3, 21, 17, 13]. Instead, we will more modestly highlight a few recurring issues that motivate our work on interdependencies in network security.

A number of papers [3, 18] have argued that security investments are not as high as they should be due to externalities in the network. These externalities originate because confidential information can be leaked through other channels than one’s own device. As a consequence, agents face risks whose magnitude depend not only on their own security levels but also on the security levels of others. In this setting, investments act like strategic complements as benefits of security adoption are not exclusively for the one that invested in the security. Consequently, a negligent agent who does not adequately protect his and others’ information due to free-riding, may cause considerable damage to other agents in the network. This leads to situations where benefits of security adoption might fall significantly below the cost of adoption, which causes under-investments.

More recently, the prediction of under-investments in information networks has been challenged. Acemoglu et al. [1] and Bachrach et al. [4] show that investments in security might as well be strategic substitutes when agents face an intelligent threat. In their setting, an attacker can aim at the weakest nodes: in this case, a negligent agent who does not invest in security has a relative higher chance that his information is stolen by a direct attack of the hacker. This eliminates the ability to free-ride on security investments of others and forces an agent to invest. In fact, this framework leads to incentives which correspond to an arms race: agents compete with each other leading to over-investments in security. Bachrach *et al. *even propose that an optimal policy requires taxing security, contrarily to subsidizing security as recommended by models that do not include an intelligent adversary.

Our work provides a tractable model of network security game that can explain both under-investments and over-investments, depending on the strategy of attack and on the amount of shared information, which eventually depends on the topology of the network connecting the agents. Our original framework and our results can be informally described as follows. Inspired by attacks that aim at recovering sensitive information, such as the DNC hack, we define a dissemination model where interconnected agents share confidential information (e-mails ) with each other with a certain probability $p$, resulting in a dissemination of information among peers that depends on the network structure. Agents store information (both their own and that received from others) and invest in security to protect it. A malignant and possibly intelligent attacker, who has the goal to obtain as much information as possible, attacks one of the agents. If the attack is successful, the attacker acquires all the information that was stored by the agent, thus making this agent and possibly also other agents, which have entrusted their information to the attacked agent, victims of the attack. If the attacker is able to optimally choose which agent to attack, the attack will be said to be strategic: otherwise, to be random. In our model, the security investments are the outcome of the resulting two-stage game between the agents and the attacker, where the attacker knows the investments of the agents, who in turn choose their investments anticipating the strategy of the attacker. Under this game structure, we show that when the attack is random, then the equilibrium investments are lower than the socially optimal investments. Instead, if the attack is strategic, then the relation between optimal and equilibrium investments depends on the amount of information shared: when the fraction of shared information is low, equilibrium investments are higher than optimal ones, whereas the opposite happens when the fraction of shared information is high. The fraction of shared information can be high for two distinct reasons: either the diffusion probability $p$ is high, or the network is tightly connected. The latter case shows our results to be consistent with those in [7], where the authors adapt interdependent security games to model strategic attacks and find that over-investments prevail in nondense networks.

In order to keep our analysis tractable, some of our results on strategic attacks make an assumption of homogeneity in the network, namely that the network is vertex-transitive. We complement these results with an analysis of the security game on star graphs, which we choose as a natural example of non-homogeneous topology: this case study shows that the essential lines of our findings, as we described them above, remain valid on general graphs.

This paper is structured as follows. Section 2 describes the problem that we want to address, introducing the dissemination model, the attack and the security investments. Subsequently, Section 3 examines the dissemination model that underlies the security game. Sections 4 and 5 are the core of our paper, as they study the security game when the attack is random and when the attack is strategic, respectively. Finally, Section 6 discusses the obtained results and complements them with numerical evaluations on complete, ring, and star graphs that we have selected as fundamental examples. Section 7 summarizes and concludes the paper. The body of the paper is complemented by an Appendix which is devoted to detailed derivations (for the examples of complete and star graphs) and proofs (of the main results about strategic attacks).

2 Information dissemination and network game

Our dynamics of interest take place on a network of agents that can share tokens of information, such as confidential documents, with each other. Let us think of $n$ agents in a set $V=\{1,\dots,n\}$. We say that two agents $i$ and $j$ are linked by an edge $(i,j)$ when $i$ and $j$ can share documents directly with each other. These edges create a (undirected) network $\mathcal{G}=\langle V,A\rangle$, where $A:V\times V\rightarrow\{0,1\}$ is the adjacency matrix in which $A(i,j)=A(j,i)=1$ if and only if $i$ and $j$ are linked by an edge. We denote the set of all edges in $\mathcal{G}$ as $E(\mathcal{G})$. In this graph theoretical context, we need to recall some standard definitions. A path $u$ in $\mathcal{G}$ between agent $i$ and $j$ is a sequence of distinct edges $u=\{(i,\kappa_{1}),(\kappa_{1},\kappa_{2}),\dots,(\kappa_{\ell-1},\kappa_{\ell}),(\kappa_{\ell},j)\}$, where $|u|=\ell$ is the length of the path. We assume that $\mathcal{G}$ is a network in which there exists a path between all pairs of agents, in other words, $\mathcal{G}$ is a connected network. A subnetwork $\mathcal{G}^{\prime}=(V^{\prime},A^{\prime})$ of $\mathcal{G}$ is a network such that $V^{\prime}\subset V$ and $E(\mathcal{G}^{\prime})\subset E(\mathcal{G})$. In Figure 1 we illustrate these concepts and show some networks of interest.

Our problem statement requires us to specify three key ingredients: (i) the dissemination of information, (ii) the adversary attack, (iii) the defensive investments.

Information dissemination model.

We assume that initially every agent owns a unique document which we will denote as $d_{i}$ for agent $i$. All the $n$ documents spread, independently of each other, over the network $\mathcal{G}$. Although the documents are confidential, it is not detrimental for an agent when his document is obtained by other agents. We assume that an agent obtains a document from another agent with probability $p$ when they are connected. This leads to a so-called transmission network for each document. A generic transmission network $\mathcal{T}$ is a random subnetwork of $\mathcal{G}$ and formally defined as $\langle V,\tilde{A}\rangle$, where

[TABLE]

where $X_{ij}$ are independent random variables identically distributed according to a Bernoulli distribution with parameter $p$. We are thus assuming that the probability of transmission between two neighboring nodes is identical for every document. Let $\mathcal{T}_{\ell}$ and $x_{ij,\ell}$ be instances of transmission networks and transmission probabilities for a dissemination starting from any $\ell\in V$. Then $\mathcal{T}_{\ell}=\langle V,\tilde{A}_{\ell}\rangle$ with $\tilde{A}_{\ell}(i,j)=\tilde{A}_{\ell}(j,i)=X_{ij,\ell}~{}A(i,j)$. Now, an agent obtains document $d_{\ell}$ when she is connected to agent $\ell$ in the transmission network $\mathcal{T}_{\ell}$. The spread of the $n$ documents then is described by the $n$ transmission networks.

The network structure determines the probability that a document spreads from its owner to another agent. We define the matrix $P$ with elements $P_{ij}$ representing the probability that agent $j$ owns document $d_{i}$ after dissemination

[TABLE]

where $U_{i,j}(\mathcal{G})$ is the set of all paths between agent $i$ and $j$ in network $\mathcal{G}$. Note that the matrix $P$ is symmetric and only depends on $\mathcal{G}$ and on $p$. Since we assumed that $\mathcal{G}$ is connected, $P$ contains only strictly positive elements. Although $P_{ij}=P_{ji}$, the event that $j$ obtains $d_{i}$ is independent of $i$ obtaining $d_{j}$, because they are respectively taking place on the transmission networks $\mathcal{T}_{i}$ and $\mathcal{T}_{j}$. Denote the expected number of documents obtained by agent $i$ as $D_{i}$ and note that

[TABLE]

We additionally denote $\mathbf{D}=\{D_{1},\dots,D_{n}\}$.

Attack model.

After the documents have spread through the network, the adversary attacks one agent. We model this attack by a random variable from a distribution over the agents. This distribution is conveniently represented by the probability vector $\mathbf{a}=\{a_{1},\dots,a_{n}\}$ which we call the attack vector. When an attack on an agent is successful the attacker will steal all the documents stored at the target. This always includes an agent’s own document, but may additionally include documents of other agents. We assume that the attack vector is established before the documents spread through the network.

Defense model.

Before the attack vector is chosen, agents have the opportunity to precautionary invest in security. We denote these investments $\mathbf{q}=\{q_{1},\dots,q_{n}\}$ as the security vector. These security investments are such that an attack on agent $i$ is successful with probability $1-q_{i}$. Let $x_{i}=1$ denote the event that the attacker obtains document $d_{i}$, and $x_{i}=0$ otherwise. Consequently, by conditioning and exploiting independence we establish that

[TABLE]

Recognize that the security of an agent $i$, that is, the privacy of his information $d_{i}$, does not only depend on his own investment, but also depends on the investments by the other agents. Furthermore, let $|\mathbf{x}|=\sum_{i\in V}x_{i}$. Observe that the expected number of stolen documents is

[TABLE]

because the attacker affects only one node directly.

Problem summary.

The timing in our problem is as follows. Firstly, the agents invest in security by selecting the security vector $\mathbf{q}$. Secondly, the attacker chooses the attack vector $\mathbf{a}$, possibly in order to maximize his reward. Hereafter, the documents spread through the network. Finally, one agent is attacked by the attacker. Since in our model the attacker observes the security levels of all the agents, the relevant equilibrium concept is that of the Stackelberg equilibrium of the resulting two-stage game [22]: the agents first select their security levels anticipating the decision of the attacker (as they know his strategy) and the attacker optimizes his attack strategy while having knowledge of the security choices. Let us note that the proposed sequence of players actions in the Stackelberg game (first defender, then attacker) is the interesting one to study. On the contrary, the reverse sequence would be unrealistic and would trivialize the game. Should the attacker go first, then the agents would just know who is to be attacked and would simply be able to optimally protect the target node.

More on the relation with literature on contagion and security games.

The two-stage scheme of the strategic security game that we study in this paper is adopted from the work [1] on cascading failures and contagion. However, our problem statement is different because the underlying diffusion/contagion model is different. In [1], each agents is susceptible to the attack with probability $1-q_{i}$ and the infection spreads from the attacked node to all nodes that are connected to it in the sub-network spanned by the susceptible nodes. Therefore, an investment in security prevents both contagion from a direct attack and contagion through the network. Instead, in our model the susceptibility is only realized at the attacked node, whereas the dissemination of information independently takes place across all edges for all pieces of information. Therefore, nodes cannot be safe from damage even if they invest maximally in security, since their private information is shared with other nodes. Another difference is the explicit presence of the variable $p$, the probability of diffusion: in our results the amount of over- or under-investments is dependent on the level of interdependence in the network, which is directly influenced by the network topology and by the probability $p$.

3 Information dissemination

The next proposition provides more insight about the value of $D_{i}$, the expected number of documents obtained by agent $i$. Its proof is straightforward and therefore omitted. In order to emphasize the dependence of $D_{i}$ on $p$ and $\mathcal{G},$ we shall use the notation $D_{i}(p,\mathcal{G})$. The result is illustrated in Figure 3.

Proposition 1** (Monotonicities).**

Given a network $\mathcal{G}$, $D_{i}(p,\mathcal{G})$ is strictly increasing in $p$ for all $i$. Given two networks $\mathcal{H}\subset\mathcal{G}$, $D_{i}(p,\mathcal{H})\leq D_{i}(p,\mathcal{G})$, provided node $i$ belongs to both networks.

Example 1** (Star graph).**

Consider a star graph with $n$ nodes: node $1$ is the center and the remaining $n-1$ nodes are the leaves. Note that (with $i,j>1$ and $i\neq j$)

[TABLE]

Hence,

[TABLE]

which implies that $D_{1}>D_{i}$.

In order to make our analysis tractable, we will often assume the networks to be vertex-transitive. Although this choice limits the scope of our results, we conjecture that economic forces in vertex-transitive networks extend to a broader class of networks. Informally, a vertex-transitive network is a network which ‘looks the same’ at every node. More precisely, we adopt the following definition.

Definition 1** (Vertex transitivity).**

A network $\mathcal{G}$ is vertex-transitive if and only if for any two nodes $i$ and $j$ there exists a mapping $\phi$ such that $\phi(i)=j$ while the structure of $\mathcal{G}$ is preserved: $A(\kappa_{1},\kappa_{2})=A(\phi(\kappa_{1}),\phi(\kappa_{2}))$ for all $\kappa_{1},\kappa_{2}\in V$.

The two leftmost networks in figure 2 are examples of vertex-transitive networks. While every agent in a vertex-transitive network has the same number of other agents whom she is linked to (regular network), the converse is not necessarily true. As an example, the last network in figure 2 is regular but not vertex-transitive.

It is no surprise that every agent in a vertex-transitive networks obtains — in expectation — the same number of documents. We state this formally in the next proposition.

Proposition 2** (Shared documents in vertex-transitive networks).**

In any vertex-transitive network, $D_{i}=D_{j}$ for all $i,j\in V$.

Proof.

By vertex-transitivity there exists a $\phi$ such that $\phi(i)=j$ while the structure is preserved, which means that $P_{\ell k}=P_{\phi(\ell)\phi(k)}$. Consequently by (3), $D_{i}=\sum_{k\in V}P_{k,i}=\sum_{\phi(k)\in V}P_{\phi(k),j}=D_{j},$ yielding the result. ∎

Since on vertex-transitive networks all elements in $\mathbf{D}$ are identical (for all values of $p$), we will adopt the notation $D_{i}=D$. Complete graphs and ring graphs are both examples of vertex-transitive networks.

Example 2** (Ring graph).**

Consider a ring graph with $n$ nodes (see Figure 1). Let ${\rm dist}(i,j)=\min\{|i-j|,n-|i-j|\}$ be the distance between nodes $i$ and $j$. By a simple inclusion-exclusion reasoning, observe that if $j\neq i$ then

[TABLE]

Hence, by summing over the nodes

[TABLE]

Note that $D\to\frac{1+p}{1-p}$ as $n\to\infty$. In contrast, recall from Example 1 that $D_{i}$ is unbounded in $n$ on star graphs.

Ring and star graphs are simple to deal with because the number of possible paths between two nodes is small. On the contrary, the complete graph has a very large number of possible connecting paths. Nevertheless, some quantities can be explicitly computed.

Example 3** (Complete graph).**

For the sake of clarity, we denote by $D^{n}$ and $P_{ij}^{n}$ the expected number of documents and the generic transmission probability on the complete graph $K_{n}$, respectively. Due to transitivity,

[TABLE]

and for small $n$ we easily see that $P_{ij}^{2}=p$ and $P_{ij}^{3}=p+p^{2}-p^{3}$. To obtain some more general expressions, let $Q^{n}$ denote the probability that any document reaches all nodes in $K_{n}$. Then, $Q^{1}=1$ and

[TABLE]

In turn,

[TABLE]

These formulas, proved in the Appendix, allow for the numerical evaluation of $D$ on graphs of moderate size, as shown in Figure 3. For large $n$, it is useful to consider the bounds

[TABLE]

The lower bound can be obtained by considering only propagation across paths of length at most two. The upper bound can be obtained by considering that the document from $i$ cannot reach vertex $j$ unless at least one edge reaches $j$ in graph $\mathcal{T}_{i}$. These two bounds together imply that $D_{i}$ is asymptotically linear in $n$.

4 Security under random attacks

Security investments are conveniently modeled as the outcome of a game between agents. In this section, we look at the social optimum and the equilibria of this security game in the presence of a random attack. The game with a strategic attack is considered in Section 5.

The security game with random attacks is defined as follows. A random attack is defined by the uniform attack vector

[TABLE]

which is known to all agents.The player set is the set of agents or nodes $V$. The strategy set of agent $i$ is $Q_{i}=[0,1]$. The reward of each agent $i$ is defined as the probability that her own document is safe minus the incurred cost, that is,

[TABLE]

where $\Pr\{x_{i}=1\}$ is given in (4) and $c(q_{i})$ is the cost agent $i$ incurs for choosing $q_{i}$. We assume that

[TABLE]

for some $\alpha\geq 1$. The choice of a quadratic cost is made for simplicity: the analysis can be extended to other smooth convex increasing functions. The choice of $\alpha$, instead, is meant to make the cost “large”, so to rule out trivial game outcomes with maximal investments. Also this assumption can be relaxed at the price of more involved analysis.

In this setting each agent attempts to maximize his/her reward while disregarding the utilities of the others. This is described by a noncooperative game $(V,\{Q_{i}\}_{i\in V},\{\Pi_{i}\}_{i\in V})$ with player set $V$. Any player $i\in V$ has strategy set $Q_{i}$ and payoff function $\Pi_{i}$. For these games, the classical definition of Nash equilibrium is of interest: an investment level $\mathbf{q}^{N}$ is a pure strategy Nash equilibrium if for any player $i$ and any investment level $q_{i}\in[0,1]$ unilateral deviation does not pay,

[TABLE]

Here $(\{q_{i},\mathbf{q}^{N}_{-i}\})$ denotes the vector $\mathbf{q}^{N}$ where component $i$ is replaced by $q_{i}$. In security games under random attack, the Nash equilibrium has a simple structure.

Theorem 1** (Equilibrium against random attack).**

In a security game facing a random attack, the pure strategy Nash equilibrium $\mathbf{q}^{N,R}$ is unique and is equal to

[TABLE]

Proof.

The utility of agent $i$ reads $\Pi_{i}=1-\frac{1}{n}\sum_{j}(1-q_{j})P_{ij}-\frac{1}{2}\alpha q_{i}^{2}.$ We easily see that $\frac{\partial\Pi_{i}}{\partial q_{i}}=\frac{1}{n}-\alpha q_{i}$ and $\frac{\partial^{2}\Pi_{i}}{\partial q_{i}^{2}}=-\alpha<0$. Since $\frac{\partial\Pi_{i}}{\partial q_{i}}(0,\mathbf{q}_{-i})>0$ and $\frac{\partial\Pi_{i}}{\partial q_{i}}(1,\mathbf{q}_{-i})<0$, we conclude that the largest utility is obtained with investment $q^{N,R}_{i}=\frac{1}{\alpha n}$, the unique only Nash equilibrium. ∎

Some remarks are in order. Firstly, the Nash equilibrium does not depend on $p$ or on the network. The economic motivation for this result is intuitive. As an agent cannot control a possible external loss in a random attack, an increase in investments does not lead to a reduced risk that his document is stolen through another agent. This forces an agent — in a non-cooperative setting — to ignore the external risk and to find the optimal trade-off between investment costs and protection against a direct loss. Secondly, the investment levels at the Nash equilibrium go to zero as the number of nodes goes to infinity. This is because the risk of being attacked is diluted in large networks.

In contrast with the above non-cooperative setting, we may consider a cooperative setting where all agents cooperate to maximize the social utility, which equals the sum of the agents’ utilities:

[TABLE]

By the continuity of $S$ on its compact domain $[0,1]^{n}$, the function $S$ must attain a maximum. That maximum is said to be the social optimum.

Theorem 2** (Social optimum against random attack).**

In a network facing a random attack, the social optimum $\mathbf{q}^{O,R}$ is unique and is equal to

[TABLE]

Proof.

By (2) the global utility reads $S(\mathbf{q})=n-\frac{1}{n}\sum_{j}(1-q_{j})D_{j}-\frac{\alpha}{2}\sum_{j}q_{j}^{2}.$ We easily see that $\frac{\partial S}{\partial q_{i}}=\frac{1}{n}D_{i}-\alpha q_{i}$ and

[TABLE]

implying that $S$ is a concave function of $\mathbf{q}$. Since $\frac{\partial S}{\partial q_{i}}(0,\mathbf{q}_{-i})>0$ and $\frac{\partial S}{\partial q_{i}}(1,\mathbf{q}_{-i})<0$ because $D_{i}\leq n$ and $\alpha\geq 1$, we conclude that $\mathbf{q}^{O,R}$ with $q^{O,R}_{i}=\frac{D_{i}}{\alpha n}$ is the unique maximizer. ∎

Comparing these results shows that the Nash equilibrium features under-investments relative to the social optimum. This happens because in the cooperative setting an agent also invests to protect documents of others. This additional effort leads to higher investments in security, which depend on the network and the probability $p$. The following examples illustrate these observations.

Example 4** (Ring network, cont’d).**

Consider the ring network studied in Example 2 and assume $\alpha=1$. Then, the socially optimal investments are

[TABLE]

and the Nash equilibrium investments remain $q^{N,R}_{i}=1/n$. Both these quantities decrease to zero as $n$ goes to infinity.

Example 5** (Star network, cont’d).**

Consider the star network studied in Example 1 and assume $\alpha=1$. Then, the socially optimal investments are

[TABLE]

Observe that all investments are non-vanishing for $n\to\infty$ and that the central node 1 supports the highest investment. On the contrary, the Nash equilibrium investments $q^{N,R}_{i}=1/n$ go to zero for $n\to\infty$.

Example 6** (Complete network, cont’d).**

Consider the complete network studied in Example 3 and assume $\alpha=1$. Then, the socially optimal investments converge (exponentially fast in $n$) to the maximum investment:

[TABLE]

while the equilibrium investments go to zero for $n\to\infty$.

Optimal investments are larger on networks that are well connected. Indeed, they are vanishing in the limit for large $n$ for the cycle graph, which is poorly connected, whereas investments are non-vanishing in the limit for large $n$ on well-connected networks such as stars and complete graphs. Consistently, the complete graph requires the highest security investments.

5 Security under strategic attacks

In the previous section we analysed the security game in the presence of a random attack. As of this section we allow for a strategic attack by the adversary. As such, the adversary and agents are involved in a two-stage game, the so-called Stackelberg game [22]. In the first stage, the agents determine their investments in security. Thereafter, in the second stage, the adversary selects an attack strategy. Such a game is solved by a Stackelberg equilibrium.

5.1 Definition of strategic attack

We start the analysis with the strategy of the attacker. The vector $\mathbf{a}$ is chosen by the attacker in an optimal way, based on the knowledge of the network and of the vector $\mathbf{q}$. More precisely, we assume that the strategy of the attacker is an optimal trade-off between the expected number of stolen documents and the cost of this attack, solving the following optimization problem

[TABLE]

Here the expected number of stolen documents is $\mathbb{E}(|\mathbf{x}|)$ and the function $\psi:[0,1]\rightarrow\mathbb{R}_{\geq 0}$ defines the cost the attacker incurs for choosing $\mathbf{a}$. Note that this framework is consistent with the attacker playing the Stackelberg game after the defending agents. In this paper we assume quadratic costs

[TABLE]

with $\omega\geq 1$. Note that this definition implies that a more precise attack is more costly than a more random one. Similarly to what was discussed for the agent’s cost $c$, extensions to other convex increasing functions are possible. By using the expression for $\mathbb{E}(|\mathbf{x}|)$ in (2), the problem becomes

[TABLE]

The Karush-Kuhn-Tucker (KKT) conditions can be used to solve (13). As the objective function is strictly concave, these conditions are necessary and sufficient to obtain the optimal solution. The KKT conditions read

[TABLE]

where $\lambda\in\mathbb{R}$ and $\kappa_{i}\in\mathbb{R}^{+}$ for all $i$ are the Lagrange multipliers corresponding to the constraints (14b) and (14c) respectively. Solving these conditions results in the following characterization of the optimal attack strategy.

Proposition 3** (Optimal attack vector).**

The optimal attack vector $\mathbf{a}^{*}$ chosen by the attacker, solving (13), is given by the unique solution $(\lambda^{*},\mathbf{a}^{*})$ to the equations

[TABLE]

Consequently, $\mathbf{a}^{*}$ is a function of $\mathbf{q}$ and $\mathbf{D}$ (and in turn of $p$ and of the topology of the network).

Proof.

By substituting (14a) into (14b) and noting that by (14e) $\kappa_{i}=0$ if $a_{i}>0$, the multiplier $\lambda^{*}$ must solve

[TABLE]

To show that $\lambda^{*}$ is unique, suppose that there are two solutions of (15a): $\lambda_{1}$ and $\lambda_{2}$. Without loss of generality, assume that $\lambda_{1}<\lambda_{2}$ and set $V_{k}=\{i\in V~{}|~{}(1-q_{i})D_{i}+\lambda_{k}>0\}$ for $k=1,2$. Obviously, $V_{1}\subseteq V_{2}$. Also note that

[TABLE]

which gives us a contradiction. So, $\lambda^{*}$ is unique. Next, (14a) directly leads to (15b) and $a_{i}(\mathbf{q})$ is a well-defined function of $q$ by the uniqueness of $\lambda^{*}$. ∎

The example below illustrates the optimal strategic attack probabilities for star networks.

Example 7** (Star network, cont’d).**

*Consider the star network studied in Example 1 and, by symmetry, assume that $q_{2}=\ldots=q_{n}$. We begin by looking for solutions to (LABEL:eq:findattack) such that $a^{*}_{i}>0$ for all $i$. In this case, equations (15a) and (15b) become *

[TABLE]

and $a^{*}_{k}=a^{*}_{2}$ for $k=3,\ldots,n$. Solving the first equation for $\lambda^{*}$ and substituting that in the other two equations yields

[TABLE]

Let $\Delta=(1-q_{1})D_{1}-(1-q_{2})D_{2}$ and observe that $\Delta$ can be either negative or positive and its magnitude is approximately linear in $n$. Since $a^{*}_{1}-a^{*}_{2}=\frac{1}{\omega}\Delta$, we observe that $a^{*}_{1}>a^{*}_{2}$ when

[TABLE]

Let us refer to $1-q_{i}$ as the “risk” taken by agent $i$. Since $D_{2}/D_{1}\to p$ when $n\to\infty$, we may say that on large star networks, the center is more likely to be attacked than the leaves when the center takes more than $p$ times the risk taken by the leaves.

When $n$ grows larger, the gap between the two attack probabilities increases, until $a^{*}_{1}=1$ and $a^{*}_{2}=0$ (if $\Delta>0$) or until $a^{*}_{1}=0$ and $a^{*}_{2}=\frac{1}{n-1}$ (if $\Delta<0$). The former vector is indeed the optimal solution when $\omega\leq\Delta$, whereas the latter is optimal when $\omega\leq-(n-1)\Delta.$

Since finding explicit solutions to (15) quickly becomes unfeasible on more complex graphs, we instead set to investigate qualitative properties of the optimal attack vector. In the next result, we derive how the optimal attack probabilities depend on the investment levels $\bf q$. The formulas confirm the intuition that the optimal attack probability $a^{*}_{i}$ is decreasing in the investments $q_{i}$ of agent $i$, and increasing in the investments $q_{j}$ of agents $j\neq i$.

Proposition 4** (How attacks depend on investments).**

The marginal changes of the optimal attack probability $a_{i}^{*}>0$ to $q_{i}$ and to $q_{j}$ for agent $j$ with $a^{*}_{j}>0$, are respectively given by

[TABLE]

where $n^{*}=|\{i\in V\,:\;a^{*}_{i}>0\}|$ is the number of agents with strict positive probability of being attacked. In particular, $a_{i}^{*}$ is nonincreasing in $q_{i}$ and nondecreasing in $q_{j}$.

Proof.

The marginal changes follow from the KKT-conditions in (14). First note that $\kappa_{i}=0$ when $a^{*}_{i}>0$. Consequently when we differentiate KKT-condition (14a) with respect to $q_{i}$ we get

[TABLE]

and — similarly — when we differentiate with respect to $q_{j}$

[TABLE]

Next we combine KKT-condition (14b) with the observations above. First recognize that the equation $\sum_{j}a^{*}_{j}=1$ is equivalent to $\sum_{j|a^{*}_{j}>0}a^{*}_{j}=1$. These equations imply

[TABLE]

By combining (5.1), (5.1) and (19b), it follows that

[TABLE]

where $n^{*}$ is the number of agents with strict positive probability of being attacked. By solving this expression for $\partial\lambda/\partial q_{i}$ and substituting the result in (5.1) and (5.1), we establish the statement. ∎

Proposition 4 bears further consequences for vertex-transitive networks, where each agent obtains the same number of documents in expectation, $D_{i}=D$. For this reason, more precise results can be obtained, including the following monotonicity property: if an agent invests more in security than another agent, then his attack probability is lower (and vice versa).

Proposition 5** (Attacks to vertex-transitive networks).**

If the network is vertex-transitive then $a^{*}_{i}<a^{*}_{j}$ if and only if $q_{i}>q_{j}$.

Proof.

Firstly, we rewrite (15a) to obtain

[TABLE]

Next if $a^{*}_{i}>0$ then

[TABLE]

It is then clear that, provided $a_{i}^{*}>0$, $a^{*}_{i}<a^{*}_{j}$ if and only if $q_{i}>q_{j}$. If instead $a^{*}_{i}=0$, then we derive the following equivalent inequalities.

[TABLE]

At the same time, $a^{*}_{j}>0$ is equivalent to

[TABLE]

Thus, $0=a^{*}_{i}<a^{*}_{j}$ is equivalent to $q_{i}>q_{j}$. ∎

This result immediately leads to the following implications: (a) maximal investments in security guarantee an upper bound on the attack probability; and (b) if all agents invest the same amount, then the attack vector is uniform.

Corollary 1**.**

For vertex-transitive networks, there hold true that:

1. (a)

if $q_{i}=1$ for some $i$, then $a^{*}_{i}\leq 1/n$; 2. (b)

if $q_{i}=\bar{q}$ for all $i$, then $a^{*}_{i}=1/n$ for all $i$.

5.2 Investments under strategic attacks

In stage 1 of the security game, the security investments are conveniently modeled as the outcome of a game between the agents. In this game, they take the best response $\mathbf{a}^{*}(\mathbf{q})$ of the adversary into account. The reward of agent $i$ equals (cf. (8))

[TABLE]

First we analyse the cooperative case, where the social utility

[TABLE]

is maximized. The proof of the following result is postponed to the Appendix.

Theorem 3** (Social optimum against strategic attacks).**

In a vertex-transitive network facing a strategic attack, the social optimum $\mathbf{q}^{O,S}$ is unique and equal to

[TABLE]

Remark 1** (Uniform investments, uniform attacks and sacrificial lambs).**

Theorem 3 indicates that it is socially optimal for an agent to invest the same as the others. As a consequence, one may immediately verify that $\mathbf{a}^{*}(\mathbf{q}^{O,S})=\frac{1}{n}$, that is, the socially optimal uniform investments imply uniform attack probability. In other words, we may say that the socially optimal investments make the strategic advantage of the adversary void.

This recommendation is in contrast with some previous studies, for instance [6] [16], suggesting that it might be optimal to leave some agents unprotected and make them sacrificing lambs. Our setting differs from theirs mainly in the definition of the cost function, which is quadratic in our case (as opposed to linear). We want to stress that the ineffectiveness of sacrificing lambs is not an artefact of our homogeneity assumption. Certainly, the homogeneity of the investments as predicted by Theorem 3 is indeed a consequence of the homogeneity of the networks. However, the indication that optimal investments make the attack probabilities uniform appear to be valid beyond this scenario. Indeed, detailed calculations on the star graphs (reported in the Appendix) show that also in that non-homogeneous network an investments strategy that makes the attack probability uniform outperforms a sacrificial lamb strategy.

Instead, if each agent optimizes his individual reward, the following equilibrium investment levels are attained.

Theorem 4** (Equilibrium against strategic attacks).**

In a vertex-transitive network facing a strategic attack, there is a unique pure strategy equilibrium vector of investment levels $\mathbf{q}^{N,S}$, which is symmetric and given by

[TABLE]

Theorem 4, whose proof is also postponed to the Appendix, shows that the first stage of the security game results in a unique and symmetric vector of investment levels. Combining this equilibrium with the outcome of the second stage, results in the Stackelberg equilibrium of our game.

Corollary 2** (Stackelberg equilibrium).**

The security game under strategic attack has a unique Stackelberg equilibrium with investment levels $\mathbf{q}^{N,S}$ and attack vector $\mathbf{a^{*}}(\mathbf{q}^{N,S})$ given by (15a), (15b) and (21).

The equilibrium investments in stage 1 are a function of $D$, the expected number of documents obtained, which in turn depends on the transmission probability $p$.

Remark 2** (Dependence on $p$).**

The equilibrium investments (21) are increasing in $p$ for small $p$, till the point where $D=n/2$, after which they are decreasing in $p$. Indeed,

[TABLE]

and thus

[TABLE]

In view of Proposition 1, the only root of (22) is given by $\hat{p}$ such that $D=n/2$. Further, $dq^{N,S}_{i}/dp>0$ when $D<n/2$ and $dq^{N,S}_{i}/dp<0$ when $D>n/2$.

Example 8** (Ring, cont’d).**

For ring networks we derive from Example 2 that, after neglecting exponential terms, $\hat{p}\simeq 1-\frac{4}{n+2}$: hence, as $n$ diverges, $\hat{p}$ converges to 1. Moreover,

[TABLE]

This value is strictly larger than the limit social optimum $\lim_{n\to\infty}q^{O,S}_{i}=0$ as seen in Example 4. We conclude that in large rings (which are sparse networks) strategic attacks lead to over-investments, $q^{N,S}_{i}>q^{O,S}_{i}$.

Example 9** (Complete, cont’d).**

For complete networks we derive from Example 3 that, after neglecting exponential terms, $D\simeq n$ as $n$ diverges. This implies that

[TABLE]

Comparing this value with the limit social optimum $\lim_{n\to\infty}q^{O,S}_{i}=\frac{1}{\alpha}$, we conclude that in large complete graphs strategic attacks lead to under-investments.

6 Discussion

The investment levels derived in the previous sections can easily be compared. A summary of the most relevant comparisons is given in the following statement.

Theorem 5** (Investments in vertex-transitive networks).**

Assume the graph $\mathcal{G}$ to be vertex-transitive.

Socially optimal investments do not depend on the type of attack, that is, $q_{i}^{O,R}=q_{i}^{O,S}$. 2. 2.

Equilibrium investments are smaller in case of random attacks than in case of strategic attacks, that is, $q_{i}^{N,R}\leq q_{i}^{N,S}$ and the inequality is strict unless $p=1$. 3. 3.

Random attacks lead to under-investments at equilibrium, that is, $q_{i}^{N,R}\leq q_{i}^{O,R}$ and the inequality is strict unless $p=0$. 4. 4.

Strategic attacks can lead to either under- or over-investments. The level of investment depends on the probability $p$: for smaller $p$, over-investments occur, $q_{i}^{N,S}>q_{i}^{O,S}$ and for larger $p$, it leads to under-investments occur, $q_{i}^{N,S}<q_{i}^{O,S}$. Moreover, the condition

[TABLE]

is sufficient to guarantee a unique transmission probability $p^{*}$ at which the equilibrium investments are socially optimal, $q_{i}^{N,S}=q_{i}^{O,S}$.

Proof.

The first three items may be verified immediately by inspection. For the fourth item, denote the investments by $q_{i}(p)$ to stress the dependence on $p$. Observe that that $q_{i}^{N,S}(1)=q_{i}^{O,S}(0)=\frac{1}{\alpha n}$, $q_{i}^{O,S}(1)=\frac{1}{\alpha}$ and $q_{i}^{N,S}(0)>\frac{1}{\alpha n}$. This implies that the graphs of $q_{i}^{N,S}(p)$ and $q_{i}^{O,S}(p)$ intersect at least once.

Applying the chain rule of differentiation and the fact that $D$ increases with $p$ lead to the following inequalities:

[TABLE]

A sufficient condition for the latter inequality to be true is given by (23). ∎

A few comments about this statement are in order. Regarding social optima, the reader may find surprising that optimal investments against random and strategic attacks coincide. Indeed, the optimal investments against strategic attacks trivialize the strategy of the attacker, that is, make the attack probabilities uniform. This observation is confirmed by the star graph example, described in the Appendix, where the investments that make the attack uniform yield higher reward than sacrificing lamb investments. In the special case of vertex-transitive networks, the uniformity in the attack probability is reflected in the uniformity of the investments.

Regarding equilibria, we observe that equilibrium investments against strategic attacks are always higher than against random attacks, which feature under-investment in comparison with the social optimum. In other words, players that are aware of the strategic nature of the attack shall invest more than against a random attack. This difference is consistent with intuition, since players facing a strategic attacker can be expected to invest more to divert attacks away from themselves. However, the theorem also shows that the awareness of strategic attacks is not sufficient to prevent under-investments (even though strategic investments remain larger than investments in the random setting). Actually, under-investments against strategic attacks appear precisely when the risk is higher, that is, in the presence of a larger transmission probability and a more tightly connected networks. Indeed, the turning point $p^{*}$ from over- to under-investments is lower in denser networks.

These general facts can be numerically verified in our running examples. We report in Figures 4, 5 and 6 the optimal and equilibrium investments as functions of the diffusion probability $p$, computed for complete, ring, and star topologies with $n=5$ nodes. Several observations can be made about the similarities and differences between these three very different networks (we remind that the star graph is not vertex-transitive, therefore not covered by Theorem 5).

On all these networks, strategic attacks make the agents invest more at equilibrium than random attacks. 2. 2.

On all these networks, the optimal strategic investments are increasing and become equal to $1/\alpha$ when $p=1$ and equal to $\frac{1}{\alpha n}$ when $p=0$: at that point they coincide with the equilibrium investments against random attack. Instead, equilibrium investments become equal to $\frac{1}{\alpha n}$ when $p=1$. The extreme values for $p=0,1$ do not depend on the topology. 3. 3.

On all these networks, the equilibrium results in over-investments for small transmission probabilities $p$ and in under-investments for large transmission probabilities. 4. 4.

For each node, there is a unique probability $p^{*}_{i}$ where over-investments pass on to under-investments and equilibrium investments are socially optimal. 5. 5.

The transition from over-investments to under-investments takes place at smaller transition probabilities where connectivity is stronger. Consistently, the probability with the largest equilibrium investment level is smaller where connectivity is stronger.

These observations are consistent with our theoretical results, even if some of them were proved for vertex-transitive networks only, thereby showing that their insights are valid on general networks.

7 Conclusion

In this paper, we studied in detail a model of strategic defensive allocation to elucidate the economic forces at play. We have shown how the type of attack by the adversary influences the investments by the agents. Equilibrium investments are larger under strategic attacks than under random attacks. Furthermore, in case of random attacks the equilibrium investments are always lower than socially optimal, which represents under-investments in security. Finally, in case of strategic attacks, there are over-investments for small transmission probabilities $p$ and under-investments for large probabilities. This transition takes place at lower probabilities $p$ in more dense networks. Indeed, those networks where the stakes are higher, because the number of shared documents is larger, are precisely those that are prone to under-investments.

In a large part of this work, the assumption of vertex-transitivity postulates a homogeneity in the network, which greatly simplifies the analysis. Another simplifying assumption is the choice of quadratic costs. Even though extending the scope of our analysis would certainly be of interest, we believe that our contribution already exemplifies the fundamental issues of these network privacy games and the key role of the network topology therein.

The importance of the network topology is reflected by the fact that optimal investments in random and strategic attacks and equilibrium investments in strategic attacks depend explicitly on the expected number of received documents and, therefore, on the topology. Therefore, the players need to know about the topology to implement their strategies. Since such a knowledge may be hard to obtain in practice, a relevant open question is defining a version of this security game that takes into account suitable limitations of such knowledge.

Appendix A Information dissemination on the complete graph

We begin by proving111The result in Proposition 6 is probably well known. For instance it can be found stated in slide 4 of http://keithbriggs.info/documents/connectivity-Manchester2004Nov19.pdf. Here we provide a proof for completeness. formula (6).

Proposition 6**.**

Let $Q^{n}$ be the probability that any document reaches all nodes in $K_{n}$. Then, for any $p$, it holds that $Q^{1}=1$ and

[TABLE]

Proof.

Let $\mathcal{T}_{i}^{n}$ be a transmission network in $K_{n}$ and observe that $Q^{n}$ is equal to the probability that $\mathcal{T}_{i}^{n}$ is connected. Let $C_{n}(i)$ be the component in which $i$ lies in the transmission network $\mathcal{T}_{i}^{n}$ and compute

[TABLE]

where $|C_{n}(i)|$ is the number of nodes in $C_{n}(i)$. To evaluate $\Pr\{|C_{n}(i)|=\ell\}$, let $\mathcal{V}_{\ell}$ be the set of the subsets of $V$ that include node $i$ and have cardinality $\ell$: recognize that there are $\binom{n-1}{\ell-1}$ such subsets. Next, by conditioning on all $\tilde{V}\in\mathcal{V}_{\ell}$ and exploiting the assumptions of independence between the edges, we can compute

[TABLE]

so concluding the proof. ∎

Next, we prove Equation (7).

Proposition 7**.**

In a complete network on $n$ nodes, for every $p$ and all $i\neq j$

[TABLE]

Proof.

By conditioning on the size of the component in which $j$ lies

[TABLE]

where we have used the fact that all nodes are equally likely to be in $C_{n}(j)$. The result follows by using (24). ∎

Appendix B Sacrificial vs uniform strategies on the star graph

Let us first consider the strategy that ensures uniform attack probabilities. From the derivations in Example 7, we observe that when $\Delta=0$, necessarily $a^{*}_{i}=\frac{1}{n}$ and $q_{1}=1-(1-q_{2})\frac{D_{2}}{D_{1}}$. Therefore,

[TABLE]

Its derivative is

[TABLE]

showing that the reward is optimal for

[TABLE]

Since the expression for the resulting optimal reward is cumbersome, we prefer to present an approximation for large $n$. In that limit, we find

[TABLE]

Moreover, notice that $q^{*}_{2}=\frac{p^{2}}{\alpha}+O\left(\frac{1}{n}\right)$ and $q^{*}_{1}=1-p+\frac{p^{3}}{\alpha}+O\left(\frac{1}{n}\right)$, where the latter quantity is larger than the former: the center has to invest more than the leaves to ensure uniform attacks.

Let us then compare this reward with that of a sacrificial lamb. In this strategy we assume that one of the leaves is left unprotected, $q_{\textup{lamb}}=0$. In this case, equations (15) imply that $a_{\textup{lamb}}=1$ as long as $q_{1}$ and $q_{2}$ are large enough: more precisely, as long as

[TABLE]

Note that the first quantity goes to zero in the limit of large networks, whereas the second one is approximated by $1-p$: therefore, the lamb strategy is feasible. Under conditions (25), we can calculate

[TABLE]

This quantity is smaller that $S^{*}$, thereby showing that the uniform strategy gives higher reward, at least for large enough networks.

Appendix C Proof of Theorem 3

The proof takes four steps. (i) We show that no component of $\mathbf{q}^{O,S}$ is either [math] or $1$. (ii) We deduce the first order conditions (FOC) for optimality of the social optima. (iii) We show that there is no asymmetric investment level which solves this FOC. (iv) We find a symmetric social optimum and prove that this (symmetric) optimum is unique.

(i) Preliminary, we compute the gradient of $S$ as

[TABLE]

By the assumption of vertex-transitivity this reduces to

[TABLE]

Next, we show that the gradient of $S$, $\nabla(S)$, does not point outward at the boundary of $[0,1]^{n}$. First,

[TABLE]

where the final equality follows from (19a). Second,

[TABLE]

where the weak inequality follows from $a^{*}_{i}D-\alpha\leq 0$ due to $D\leq n$, $a^{*}_{i}\leq 1/n$ due to Corollary 1.(a), and $1\leq\alpha$.

(ii) The social optimum $\mathbf{q}^{O,S}$ thus belongs to $(0,1)^{n}$. From (26) and $\partial S/\partial q_{i}=0$ the social optimum solves for each agent $i$

[TABLE]

(iii) In order to prove that all components of $\mathbf{q}^{O,S}$ are equal, without loss of generality let $q_{1}=\max{\mathbf{q}^{O,S}}$ and $q_{2}=\min{\mathbf{q}^{O,S}}$ and assume that $q_{1}>q_{2}$. We derive a contradiction. Observe that by (27)

[TABLE]

where the last equality is due to (19a) for $i=1$. Similarly

[TABLE]

with the last equality due to (19a) for $i=2$. Observe that $a^{*}_{1}<a^{*}_{2}$, the definition of $q_{1}$ implies $0\leq 1-q_{1}\leq 1-q^{O,S}_{i}$ and that $\partial a^{*}_{i}/\partial q_{1}\geq 0$ for all $i\neq 1$ by (16). Then

[TABLE]

with the final equality due to (27) and the inequality follows from $q_{1}-q_{\ell}>0$ for at least one $\ell$. By a similar line of arguments

[TABLE]

These two inequalities prove that the right-hand side of (C) is larger than the right-hand side of (C), which contradicts $q_{1}>q_{2}$. Therefore, $q_{1}=q_{2}$ and all components of $\mathbf{q}^{O,S}$ are equal.

(iv) Now we have established that $\mathbf{q}^{O,S}$ is a symmetric social optimal investment level, we elaborate (27) to derive $\alpha q_{i}^{O,S}=a^{*}_{i}D-D(1-q_{i}^{O,S})\sum_{j}\frac{\partial a^{*}_{j}}{\partial q_{i}}=a^{*}_{i}D$ by (19). By summing $q_{i}^{O,S}=a^{*}_{i}D/\alpha$ over all $i$ and using symmetry we obtain (20).

Appendix D Proof of Theorem 4

Notice that the agents play a strategic game amongst themselves in stage 1. We refer to the outcome of that stage as an equilibrium. The proof is divided into three intermediate steps.

We prove that there exists at least one pure strategy equilibrium. 2. 2.

We prove that the equilibrium is unique and symmetric. 3. 3.

We exhibit a symmetric equilibrium.

Let us preliminary recall the reward of agent $i$,

[TABLE]

and that the equilibrium solves $\frac{\partial\Pi_{i}}{\partial q_{i}}=0$. The derivative of (30) is given by

[TABLE]

Step 1. We prove that $\Pi_{i}$ is quasi-concave in $q_{i}$. The derivative of (31) is given by

[TABLE]

where the second equality follows from (16) and $\frac{\partial^{2}a^{*}_{j}}{\partial q_{i}^{2}}=0$. As the second derivative of the utility of agent $i$ is negative, we conclude that $\Pi_{i}$ is actually concave. We are now in the position to apply the result by Debreu, Fan, Glicksberg [8, 9, 11] who showed that a pure strategy Nash equilibrium exists in the strategic form game of stage 1 when the strategy sets are compact and convex, and the utility of each agent is quasi-concave in the agent’s own strategy and continuous in the strategy of other agents.

Step 2. We start by finding the second order derivatives of $\Pi_{i}$. In (D) we already computed this derivative to $q_{i}$. Additionally note that the derivative of (31) to $q_{j}$ for $j\neq i$ is given by

[TABLE]

where $\frac{d^{2}a^{*}_{\kappa}}{dq_{i}dq_{j}}=0$ is used in the second equality.

Secondly, we determine the number of agents having a positive probability of being attacked, $n^{*}$. For any agent $i$

[TABLE]

This implies that $q_{i}>0$: that is, it is not optimal not to investment, since slightly increasing the investment level will result in larger rewards. Now assume that $a^{*}_{i}=0$. By (30), the rewards of agent $i$ will be

[TABLE]

Since the equilibrium investments $q_{i}$ maximize these rewards, we should have $q_{i}=0$. But this contradicts our conclusion from (33). Therefore, our assumption $a^{*}_{i}=0$ was false and we must have $a^{*}_{i}>0$ for all agents $i$. This implies $n^{*}=n$, all agents have a positive probability of being attacked.

Combining these results, the negated Jacobian $-J$ with $J_{ij}=\frac{\partial^{2}\Pi_{i}}{\partial q_{i}\partial q_{j}}$ becomes

[TABLE]

Next we show that the matrix $-J$ is diagonally dominant.

[TABLE]

Because the matrix $-J$ is also symmetric, all principal minors in the negated Jacobian are positive [5]. Because of this, the Nash equilibrium in a symmetric game is unique [10]. As we already concluded that a pure Nash equilibrium always exists, we are able to conclude that this equilibrium is unique and symmetric.

Step 3. Finally, we exhibit the symmetric equilibrium $\mathbf{q}=q\mathbf{1}$. Because of this symmetry, $a^{*}_{i}=1/n$ by Corollary 1. Starting from (31) we obtain

[TABLE]

Since the equilibrium solves $\partial\Pi_{i}/\partial q_{i}=0$, the expression (21) follows immediately.