A reputation game on cyber-security and cyber-risk calibration

TL;DR

This paper introduces a reputation game model for cyber-security, analyzing attacker and defender strategies, and offers methods to calibrate cyber-risk attack probabilities based on equilibrium analysis.

Contribution

It develops a new reputation game model with explicit equilibrium strategies and provides calibration methods for attack probabilities in cyber-risk assessment.

Findings

Existence and uniqueness of sequential equilibrium in Markov strategies.

Explicit characterization of players' equilibrium strategies.

Proposes empirical and theoretical calibration methods for attack probability.

Abstract

To analyze strategic interactions arising in the cyber-security context, we develop a new reputation game model in which an attacker can pretend to be a normal user and a defender may have to announce attack detection at a certain point of time without knowing whether he has been attacked. We show the existence and uniqueness of sequential equilibrium in Markov strategies, and explicitly characterize the players' equilibrium strategies. Using our model, we suggest empirical and theoretical ways of calibrating the attack probability, which is an important element of cyber-risks.