Cybersecurity: Effect of information availability in security games

Abstract

Cyber-attacks, i.e., disruption of normal functioning of computers and loss of information, are becoming widespread. Cyber security may be studied as a non-cooperative game as described by behavioral game theory. However, current game-theoretic approaches have based their conclusions on Nash equilibriums, while disregarding the role of information availability among hackers and analysts. In this study, we investigated how information availability affected behavior of analysts and hackers in 2×2 security games. In an experiment involving security games, interdependence information available to hackers and analysts was analyzed in two between-subjects conditions: “Info” and “No-Info”. In “Info” condition, both players had complete information about each other's actions and payoffs, while this information was missing in “No-Info” condition. Results showed that presence of information caused analysts and hackers to increase their proportion of defend and attack actions, respectively. We highlight the relevance of our results to cyber-attacks in the real world