A survey of interdependent information security games

ACM Computing Surveys

Volumn 47, Issue 2, 2013, Pages

  Laszka, Aron ^a   Felegyhazi, Mark ^a,b   Buttyan, Levente ^b  

^a VANDERBILT UNIVERSITY   (United States)

^b BUDAPEST UNIVERSITY OF TECHNOLOGY AND ECONOMICS   (Hungary)

Author keywords

Externality; Interdependent security; Security economics; Security games

Indexed keywords

ECONOMICS; GAME THEORY; INFORMATION USE; SECURITY OF DATA; SURVEYS;

DEFENSE SOLUTIONS; EXTERNALITY; FUNDAMENTAL PROPERTIES; GAME-THEORETIC; INTERDEPENDENT SECURITY; SECURITY DEFENSE; SECURITY ECONOMICS; SECURITY GAMES; STRATEGIC INTERACTIONS; SYSTEM OPERATOR;

INFORMATION SYSTEMS;

EID: 84907442807     PISSN: 03600300     EISSN: 15577341     Source Type: Journal    
DOI: 10.1145/2635673     Document Type: Review

References (62)

1. G. A. Akerlof. 1970. Themarket for "lemons": Quality uncertainty and the market mechanism. The Quarterly Journal of Economics 84, 3 (Aug. 1970), 488-500.
2. S. Amin, G. A. Schwartz, and S. S. Sastry. 2011. On the interdependence of reliability and security in networked control systems. In Proceedings of the 50th IEEE Conference on Decision and Control and European Control Conference (CDC-ECC'11). 4078-4083.
3. S. Amin, G. A. Schwartz, and S. S. Sastry. 2012. Security of interdependent and identical Networked Control Systems. Automatica 42, 1 (2012), 186-192.
4. R. Anderson. 2001. Why information security is hard-An economic perspective. In Proceedings of the 17th Annual Computer Security Applications Conference (ACSAC'01). IEEE, 358-365.
5. R. Anderson and T. Moore. 2006. The economics of information security. Science 314, 5799 (Oct. 2006), 610-613.
6. J. Aspnes, K. Chang, and A. Yampolskiy. 2004. Inoculation Strategies for Victims of Viruses and the Sum-of- Squares Partition Problem. Technical Report YALEU/DCS/TR-1295. Yale University.
7. J. Aspnes, K. Chang, and A. Yampolskiy. 2006. Inoculation strategies for victims of viruses and the sum-ofsquares partition problem. Journal of Computing System Science 72, 6 (Sept. 2006), 1077-1093.
8. M. Babaioff, R. Kleinberg, and C. H. Papadimitriou. 2007. Congestion games with malicious players. In Proceedings of the 8th ACM Conference on Electronic Commerce (EC'07). 103-112.
9. B. Bencsáth, G. Pék, L. Buttyán, and M. Felegyhazi. 2012. Duqu: Analysis, detection, and lessons learned. In Proceedings of the 5th European Workshop on System Security (EuroSec'12). ACM. 1-6.
10. R. Böhme. 2012. Security audits revisited. In Proceedings of the 16th International Conference on Financial Cryptography and Data Security (FC'12). Springer, 129-147.
11. R. Böhme and G' Kataria. 2006. Models and measures for correlation in cyber-insurance. In Proceedings of the 5th Workshop on the Economics of Information Security (WEIS'06). 1-26.
12. R. Böhme and G. Schwartz. 2010. Modeling cyber-insurance: Towards a unifying framework. In Proceedings of the 9th Workshop on the Economics of Information Security (WEIS'10). 1-36.
13. M. Ceyko, H. Chan, and L. E. Ortiz. 2011. Interdependent defense games: Modeling interdependent security under deliberate attacks (extended abstract). In Proceedings of the International Conference on Game Theory, 22nd Stony Brook Game Theory Festival of the Game Theory Society. 1-11.
14. H. Chan, M. Ceyko, and L. E. Ortiz. 2012. Interdependent defense games: Modeling interdependent security under deliberate attacks. In Proceedings of the 28th Conference on Uncertainty in Artificial Intelligence (UAI'12).
15. Defence Signals Directorate. 2012. Top 35 Mitigation Strategies. Retrieved from infosec/top35mitigationstrategies.http://www.dsd.gov.au/infosec/top35mitigationstrategies.htm.
16. J Díaz, D. Mitsche, N. Rustagi, and J. Saia. 2009. On the power of mediators. In Proceedings of the 5th International Workshop on Internet and Network Economics (WINE'09). Springer, 455-462. DOI:http://dx. doi.org/10.1007/978-3-642-10841-9-42
17. T. Dumitras andD. Shou. 2011. Toward a standard benchmark for computer security research: Theworldwide intelligence network environment (WINE). In Proceedings of the 1st Workshop on Building Analysis Datasets and Gathering Experience Returns for Security (BADGERS'11). 89-96.
18. D. Fudenberg and J. Tirole. 1991. Game Theory. MIT Press, Cambridge, MA.
19. J. Gans, S. King, and G. Mankiw. 2011. Principles of Microeconomics. Cengage Learning, Australia.
20. L. A. Gordon and M. P. Loeb. 2002. The economics of information security investment. ACM Transactions on Information and System Security 5, 4 (Nov. 2002), 438-457. DOI:http://dx.doi.org/10.1145/581271.581274
21. L. A. Gordon, M. P. Loeb, and W. Lucyshyn. 2003. Sharing information on computer systems security: An economic analysis. Journal of Accounting and Public Policy 22, 6 (2003), 461-485.
22. J. Grossklags, N. Christin, and J. Chuang. 2008. Secure or insure? A game-Theoretic analysis of information security games. In Proceedings of the 17th International Conference onWorldWideWeb (WWW'08). ACM, 209-218.
23. J. Grossklags, B. Johnson, and N. Christin. 2010a. The price of uncertainty in security games. In Economics of Information Security and Privacy, T. Moore, D. Pym, and C. Ioannidis (Eds.). Springer, 9-32.
24. J. Grossklags, S. Radosavac, A. Cárdenas, and J. Chuang. 2010b. Nudge: Intermediaries' role in interdependent network security. In Proceedings of the 3rd International Conference on Trust and Trustworthy Computing (TRUST'10). 323-336.
25. K. Hausken. 2006. Income, interdependence, and substitution effects affecting incentives for security investment. Journal of Accounting and Public Policy 25, 6 (2006), 629-665.
26. G. Heal and H. Kunreuther. 2004. Interdependent Security: A General Model. Technical Report NBER Working Paper No. 10706. National Bureau of Economic Research.
27. G. Heal and H. Kunreuther. 2005. IDS models of airline security. Journal of Conflict Resolution 49, 2 (2005), 201-217.
28. C. Herley. 2010. The plight of the targeted attacker in a world of scale. In Proceedings of the 9th Workshop on the Economics of Information Security (WEIS'10).
29. C. Herley and D. Florêncio. 2009. A profitless endeavor: Phishing as tragedy of the commons. In Proceedings of the 2008 Workshop on New Security Paradigms (NSPW'08). ACM, 59-70.
30. C. Herley and D. Florêncio. 2010. Nobody Sells Gold for the Price of Silver: Dishonesty, Uncertainty and the Underground Economy. Springer, 33-53.
31. T. Holz, M. Engelberth, and F. Freiling. 2009. Learning more about the underground economy: A case-study of keyloggers and dropzones. Proceedings of the 14th European Symposium on Research in Computer Security (ESORICS'09). 1-18.
32. L. Jiang, V. Anantharam, and J. Walrand. 2011. How bad are selfish investments in network security? IEEE/ACM Transactions on Networking 19, 2 (Apr. 2011), 549-560. DOI:http://dx.doi.org/10.1109/ TNET.2010.2071397
33. B. Johnson, A. Laszka, and J. Grossklags. 2014. How many down? Toward understanding systematic risk in networks. In Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security (ASIACCS'14).
34. M. J. Kearns and L. E. Ortiz. 2003. Algorithms for interdependent security games. In Advances in Neural Information Processing Systems, S. Thrun, L. K. Saul, and B. Schölkopf (Eds.). MIT Press.
35. E. Koutsoupias and C. Papadimitriou. 1999. Worst-case equilibria. In Proceedings of the 16th Annual Symposium on Theoretical Aspects of Computer Science (STACS'99). Springer, 404-413.
36. P. Krugman, R. Wells, and E. Kelly. 2008. Study Guide for Microeconomics. Worth Publishers.
37. V. S. Kumar, R. Rajaraman, Z. Sun, and R. Sundaram. 2010. Existence theorems and approximation algorithms for generalized network security games. In Proceedings of the 30th International Conference on Distributed Computing Systems (ICDCS'10). IEEE, 348-357.
38. H. Kunreuther and G. Heal. 2003. Interdependent security. Journal of Risk and Uncertainty 26, 2 (2003), 231-249.
39. A. Laszka, B. Johnson, and J. Grossklags. 2013. Mitigating covert compromises: A game-Theoretic model of targeted and non-Targeted covert attacks. In Proceedings of the 9th Conference on Web and Internet Economics (WINE'13). Springer, 319-332.
40. A. Laszka, B. Johnson, J. Grossklags, and M. Felegyhazi. 2014. Estimating systematic risk in real-world networks. In Proceedings of the 18th International Conference on Financial Cryptography and Data Security (FC'14).
41. M. Lelarge. 2009. Economics of malware: Epidemic risks model, network externalities and incentives. In Proceedings of the 47th Annual Allerton Conference on Communication, Control, and Computing (Allerton'09). IEEE, 1353-1360.
42. M. Lelarge and J. Bolot. 2008. A local mean field analysis of security investments in networks. In Proceedings of the 3rd International Workshop on Economics of Networked Systems (NetEcon'08). ACM, 25-30.
43. K. Levchenko, N. Chachra, B. Enright, C. Felegyhazi, M. Grier, T. Halvorson, C. Kanich, C. Kreibich, H. Liu, A. McCoy, D. Pitsillidis, N. Weaver, V. Paxson, G. M. Voelker, and S. Savage. 2011. Click trajectories: End-To-end analysis of the spam value chain. In Proceedings of the 32nd IEEE Symposium on Security and Privacy (Oakland'11). 431-446.
44. M. Manshaei, Q. Zhu, T. Alpcan, T. Basar, and J. P. Hubaux. 2013. Game theory meets network security and privacy. Computing Surveys 45, 3 (2013).
45. A. Mas-Colell, M. D. Whinston, and J. R. Green. 1995. Microeconomic Theory. Oxford University Press.
46. D. Meier, Y. A. Oswald, S. Schmid, and R. Wattenhofer. 2008. On the windfall of friendship: Inoculation strategies on social networks. In Proceedings of the 9th ACMConference on Electronic Commerce (EC'08). ACM, 294-301.
47. Microsoft. 2011. Microsoft Security Intelligence Report. Technical Report, Vol. 12.
48. Piet Van Mieghem, Jasmina Omic, and Robert E. Kooij. 2009. Virus spread in networks. IEEE/ACM Transactions on Networking 17, 1 (2009), 1-14.
49. R. A. Miura-Ko, B. Yolken, N. Bambos, and J. Mitchell. 2008a. Security investment games of interdependent organizations. In Proceedings of the 46th Annual Allerton Conference on Communication, Control, and Computing (Allerton'08). IEEE, 252-260.
50. R. Miura-Ko, B. Yolken, J. Mitchell, and N. Bambos. 2008b. Security decision-making among interdependent organizations. In Proceedings of the 21st IEEE Computer Security Foundations Symposium (CSF'08). 66-80.
51. T. Moore and R. Clayton. 2008. The consequence of non-cooperation in the fight against phishing. In Proceedings of the eCrime Researchers Summit. IEEE, 1-14.
52. T. Moscibroda, S. Schmid, and R. Wattenhofer. 2006. When selfish meets evil: Byzantine players in a virus inoculation game. In Proceedings of the 25th ACM Symposium on Principles of Distributed Computing (PODC'06). ACM, 35-44.
53. H. Ogut, N. Menon, and S. Raghunathan. 2005. Cyber insurance and IT security investment: Impact of interdependent risk. In Proceedings of the 4th Workshop on the Economics of Information Security (WEIS'05).
54. J. Omic, A. Orda, and P. Van Mieghem. 2009. Protecting against network infections: A game theoretic perspective. In Proceedings of the 28th IEEE Conference on Computer Communications (INFOCOM 2009). IEEE, 1485-1493.
55. A. Ozment and S. E. Schechter. 2006. Bootstrapping the adoption of internet security protocols. In 5th Workshop on Economic of Information Security (WEIS'06).
56. R. Pal and P. Hui. 2011. Modeling internet security investments: Tackling topological information uncertainty. Proceedings of the 2nd Conference on Decision and Game Theory for Security (GameSec'11). 239-257.
57. S. Radosavac, J. Kempf, and U. C. Kozat. 2008. Using insurance to increase internet security. In Proceedings of the 3rd International Workshop on Economics of Networked Systems (NetEcon'08). ACM, 43-48.
58. W. Saad, T. Alpcan, T. Basar, and A. Hjorungnes. 2010. Coalitional game theory for security risk management. In Proceedings of the 5th International Conference on Internet Monitoring and Protection (ICIMP'10). IEEE, 35-40.
59. S. Sinha, M. Bailey, and F. Jahanian. 2008. Shades of grey: On the effectiveness of reputation-based "blacklists." In Proceedings of the 3rd International Conference on Malicious and Unwanted Software (MALWARE'08). IEEE, 57-64.
60. G. Stoltz and G. Lugosi. 2007. Learning correlated equilibria in games with compact sets of strategies. Games and Economic Behavior 59, 1 (2007), 187-208.
61. G. Theodorakopoulos, J. Y. L. Boudec, and J. S. Baras. 2013. Selfish response to epidemic propagation. IEEE Trans. Automat. Control 58, 2 (Feb. 2013), 363-376.
62. H. Varian. 2004. System reliability and free riding. In Economics of Information Security, L. Jean Camp and Stephen Lewis (Eds.). Advances in Information Security, Vol. 12. Springer, 1-15.