Nowadays, both the amount of cyberattacks and their sophistication have considerably increased, and their prevention is of concern of most of organizations. Cooperation by means of information sharing is a promising strategy to address this problem, but unfortunately it poses many challenges. Indeed, looking for a win-win environment is not straightforward and organizations are not properly motivated to share information. This work presents a model to analyse the benefits and drawbacks of information sharing among organizations that presents a certain level of dependency. The proposed model applies functional dependency network analysis to emulate attacks propagation and game theory for information sharing management. We present a simulation framework implementing the model that allows for testing different sharing strategies under several network and attack settings. Experiments using simulated environments show how the proposed model provides insights on which conditions and scenarios are beneficial for information sharing.
Several works have proposed the use of game theory to analyse the trade-off in terms of incentives and costs of sharing information among entities. Naghizadeh et Liu @cite_21 propose folk theorems and use an analytical method to study how the role of private and public monitoring through inter-temporal incentives can support degree of cooperation. Similar to this work, we also propose a game theory based model where utilities of sharing information are calculated upon gains and costs. However, instead of using historical public available actions, we propose immunization factor and reputation as the main variables for incentive sharing. Furthermore, the work in @cite_21 identifies the cost of disclosure as one of the main drawbacks related with information sharing. While we also consider privacy and disclosure costs as two key drawbacks for sharing, we also introduce a third variable that affects costs, i.e. trust.
@cite_21
2579399277 2119486295 2153344215 1530305922
Sharing of security information among organizations has often been proposed as a method for improving the state of cyber-security for all. However, such disclosure entails costs for the reporting entity, including a drop in market value, loss of customer confidence, and bureaucratic burdens. By adopting a game-theoretic approach for understanding firms' incentives, we first show that in one shot interactions, disclosure costs act as disincentives for sharing, leading to no information sharing at equilibrium. We then consider a repeated game formulation that enables the use of inter-temporal incentives (i.e., the conditioning of future decisions on the history of past interactions) to support firms' cooperation on information sharing. We show that the nature of the monitoring available to firms greatly affects the possibility of sustaining nearly efficient outcomes through repeated interactions. Specifically, we first illustrate the limitations arising when firms' have independent and imperfect private monitoring technologies. We then consider the role of a public monitoring assessment system, and show that despite using the same imperfect technology as the individual firms, the monitor can facilitate cooperation among participants. Our results therefore illustrate the impact of a public rating reputation system on the viability of security information sharing agreements. The advent of the Internet has made the transmission of personally identifiable information more common and often unintended by the user. As personal information becomes more accessible, individuals worry that businesses misuse the information that is collected while they are online. Organizations have tried to mitigate this concern in two ways: (1) by offering privacy policies regarding the handling and use of personal information and (2) by offering benefits such as financial gains or convenience. In this paper, we interpret these actions in the context of the information-processing theory of motivation. Information-processing theories, also known as expectancy theories in the context of motivated behavior, are built on the premise that people process information about behavior-outcome relationships. By doing so, they are forming expectations and making decisions about what behavior to choose. Using an experimental setting, we empirically validate predictions that the means to mitigate privacy concerns are associated with positive valences resulting in an increase in motivational score. In a conjoint analysis exercise, 268 participants from the United States and Singapore face trade-off situations, where an organization may only offer incomplete privacy protection or some benefits. While privacy protections (against secondary use, improper access, and error) are associated with positive valences, we also find that financial gains and convenience can significantly increase individuals' motivational score of registering with a Web site. We find that benefits-monetary reward and future convenience-significantly affect individuals' preferences over Web sites with differing privacy policies. We also quantify the value of Web site privacy protection. Among U.S. subjects, protection against errors, improper access, and secondary use of personal information is worth @math 44.62. Finally, our approach also allows us to identify three distinct segments of Internet users-privacy guardians, information sellers, and convenience seekers. We study a spectrum sharing problem in an unlicensed band where multiple systems coexist and interfere with each other. We first analyze a cooperative setting where all the systems collaborate to achieve a common goal. Under the assumptions that the systems communicate with Gaussian signals and treat interference as noise, we study the structure of the optimal power allocations. We show that any Pareto efficient vector of rates can be achieved with piece-wise constant power allocations. Moreover, if a strong interference condition among all the systems is satisfied, we show that frequency division multiplexing is optimal. We then consider a non-cooperative situation, where the systems act in a selfish and rational way, and investigate how the lack of cooperation can affect performance. Using game theory, we first analyze the possible outcomes of a one shot game, and observe that in many cases an inefficient solution results. We show that by extending the game definition to that of a repeated game, the possibility of building reputations and applying punishments allows to enlarge the set of achievable rates. We present examples that show that in many cases, the performance loss due to lack of cooperation is small. We also provide a converse theorem that proves that our results are tight and quantify the best achievable performance in a non-cooperative scenario Many natural games have both high and low cost Nash equilibria: their Price of Anarchy is high and yet their Price of Stability is low. In such cases, one could hope to move behavior from a high cost equilibrium to a low cost one by a "public service advertising campaign" encouraging players to follow the low-cost equilibrium, and if every player follows the advice then we are done. However, the assumption that everyone follows instructions is unrealistic. A more natural assumption is that some players will follow them, while other players will not. In this paper we consider the question of to what extent can such an advertising campaign cause behavior to switch from a bad equilibrium to a good one even if only a fraction of people actually follow the given advice, and do so only temporarily. Unlike the "value of altruism" model, we assume everyone will ultimately act in their own interest. We analyze this question for several important and widely studied classes of games including network design with fair cost sharing, scheduling with unrelated machines, and party affiliation games (which include consensus and cut games). We show that for some of these games (such as fair cost sharing), a random α fraction of the population following the given advice is sufficient to get a guarantee within an O(1 α) factor of the price of stability for any α > 0. For other games (such as party affiliation games), there is a strict threshold (in this case, α 1 2 is enough to reach near-optimal behavior). Finally, for some games, such as scheduling, no value α < 1 is sufficient. We also consider a "viral marketing" model in which certain players are specifically targeted, and analyze the ability of such targeting to influence behavior using a much smaller number of targeted players.