Dynamics of targeted ransomware negotiation

TL;DR

This paper models targeted ransomware negotiations as a game, highlighting how imperfect information influences optimal strategies for attackers and targets, aiding better response strategies.

Contribution

It introduces a game-theoretic model of ransomware negotiations incorporating investment and imperfect information, providing insights into strategic decision-making.

Findings

Imperfect information significantly affects negotiation strategies.

Optimal strategies depend on the level of information asymmetry.

The model explains observed real-world ransomware behaviors.

Abstract

In this paper, we consider how the development of targeted ransomware has affected the dynamics of ransomware negotiations to better understand how to respond to ransomware attacks. We construct a model of ransomware negotiations as an asymmetric non-cooperative two-player game. In particular, our model considers the investments that a malicious actor must make in order to conduct a successful targeted ransomware attack. We demonstrate how imperfect information is a crucial feature for replicating observed real-world behaviour. Furthermore, we present optimal strategies for both the malicious actor and the target, and demonstrate how imperfect information results in a non-trivial optimal strategy for the malicious actor.