Fair and private rewarding in a coalitional game of cybersecurity information sharing

IET Information SecurityVolume 13, Issue 6 p. 530-540 Research ArticleFree Access Fair and private rewarding in a coalitional game of cybersecurity information sharing Iman Vakilinia, Corresponding Author ivakilinia@unr.edu orcid.org/0000-0003-3015-2518 Department of Computer Science and Engineering, University of Nevada Reno, 1664 N. Virginia Street, Reno, 89557 USASearch for more papers by this authorShamik Sengupta, Department of Computer Science and Engineering, University of Nevada Reno, 1664 N. Virginia Street, Reno, 89557 USASearch for more papers by this author Iman Vakilinia, Corresponding Author ivakilinia@unr.edu orcid.org/0000-0003-3015-2518 Department of Computer Science and Engineering, University of Nevada Reno, 1664 N. Virginia Street, Reno, 89557 USASearch for more papers by this authorShamik Sengupta, Department of Computer Science and Engineering, University of Nevada Reno, 1664 N. Virginia Street, Reno, 89557 USASearch for more papers by this author First published: 01 November 2019 https://doi.org/10.1049/iet-ifs.2018.5079Citations: 4AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onEmailFacebookTwitterLinked InRedditWechat Abstract Cybersecurity information sharing is a key factor of cyber threat intelligence, allowing organisations to detect and prevent malicious behaviours proactively. However, stimulating organisations to participate and deterring free-riding in such sharing is a big challenge. To this end, the sharing system should be equipped with a rewarding and participation-fees allocation mechanisms to encourage sharing behaviour. The problem of cybersecurity information sharing as a non-cooperative game has been studied extensively. In contrast, in this study, the authors model such a problem as a coalitional game. They investigate a rewarding and participation-fees calculation based on profit sharing in coalitional game theory. In particular, they formulate a coalitional game between organisations and analyse the well-known Shapley value and Nucleolus solution concepts in the cybersecurity information sharing system. Moreover, as the participation-fees may leak sensitive information about the organisations’ cyber-infrastructure, they study the application of differential privacy in the coalitional game theory to protect the organisation's fees while approximating the fairness. 1 Introduction The frequency and complexity of cyber-attacks have increased with the significant growth of our daily life dependency to the cyberspace. To get ahead of the security threats, it is crucial to have a proactive security approach to prevent any dangers before they occur. Cybersecurity information sharing is a key factor in proactively defending against sophisticated cyber-attacks [1]. Moreover, such sharing decreases the time and enhances the accuracy of the detection and prevention of malicious behaviours in the system. Due to the importance of cybersecurity information sharing, governmental laws/initiatives have been legislated to mandate/encourage governmental and private organisations to share their cybersecurity information [2]. For instance, the US Senate has passed the Cybersecurity Information Sharing Act (CISA) [3] federal law designed to improve cybersecurity through enhanced sharing of information about cybersecurity threats. The law allows the sharing of Internet traffic information between the US government and private companies. In the UK, Cybersecurity Information Sharing Partnership (CiSP) [4] is an initiative for industry and government that has been set up to exchange cyber threat information in real time, in a secure, confidential and dynamic environment to increase situational awareness and reduce the impact on UK business. EU has also launched several cross-sector and intra-sector initiatives to enhance the EU Member States capability for preparedness, cooperation, information exchange, coordination, and response to cyber threats [5]. In the private sector, the organisations act as self-interested rational players and sharing cybersecurity information can be costly for the information possessor. For example, attackers might utilise the shared information for reconnaissance, the competitive organisation might take advantage of the shared information which indirectly affects the organisation's utility, and sensitive private information (such as names and email addresses) might leak out. On the other hand, the finder of vulnerability can sell it on the black market. Thus, stimulating the owner of cybersecurity information to choose sharing behaviour is a big challenge. Recently, plenty of research has been done in modelling the benefit and cost of the cybersecurity information sharing by applying game theory [6-8]. Traditionally the cybersecurity information sharing is modelled as a non-cooperative game where the players are the organisations, and the strategies are choosing between sharing and not-sharing. In this case, we have the following conditions: if none of the organisations share their information, the organisations’ payoffs are zero, if some of the organisations participate in sharing, but the others refuse to reciprocate, then the organisations who refused, receive a better payoff than the rest of them. Finally, if all of the organisations share, then all of them benefit from sharing. This game resembles the well-known Prisoner's dilemma game [9]. Although the best payoff is received from mutual sharing, players choose not-sharing as their Nash equilibrium approach. To change the equilibrium point to the sharing strategy, we need a mechanism to stimulate the sharing behaviour. Here, choosing the proper rewarding value is a big challenge. To stimulate organisations to share applicable information, the reward should be an increasing function of the total benefits of the other organisations applying the information. Furthermore, as we assume the organisations are the only financial sources of the cybersecurity information sharing system, the total rewards are equal to the total amount of organisations’ participation-fee. The participation-fee calculation ought to prevent organisations from free-ride by taking advantage of shared information without participation. Furthermore, this fee should be fair, such that the organisations’ payment should be proportional to their benefits from the information. On the other hand, organisations’ participation-fees are classified as confidential information since they reveal the organisations’ cyber-infrastructure configuration through the organisations’ cybersecurity investment tendency [10]. Disclosure of organisations’ participation-fee, paves the attackers’ way for reconnaissance to exploit the organisations’ vulnerabilities. Thus, the value of organisations’ participation-fee should be protected. As an example, consider that a vulnerability in a specific database management system has been detected and an organisation is interested in paying a big amount of money to access such information. Such an investment tendency allows an attacker to have a better picture of the target's cyber-infrastructure configuration. In this paper, we investigate the fair and private rewarding and participation-fee calculation by applying the coalitional game theory and differential privacy in the cybersecurity information sharing system. The main objective of our proposed mechanism is to stimulate organisations to share more useful information to increase the organisations’ payoff fairly while preserving the participants’ participation-fee private. To achieve this goal, first, we investigate the solution concepts of Shapley value and Nucleolus allocations in the cybersecurity information sharing game. Second, we inspect the differential privacy concept in the coalitional cybersecurity information sharing rewarding. The main contributions of this paper are the two parts, as described below: We present a novel coalitional game for rewarding and participation-fee allocation in the cybersecurity information sharing, and then we investigate the Shapley value and Nucleolus distribution solution concepts of utility among organisations in the cybersecurity information sharing. We investigate the application of differential privacy in coalitional game theory. For this purpose, we relax the fairness definition by introducing -fair concept. Then, we study the rewarding mechanism in the coalitional cybersecurity information sharing environment, such that the organisations’ participation-fees are protected from an adversary with side information. To the best of our knowledge, this research is the first work to investigate the fair and differentially private rewarding and participation-fee allocation in the cybersecurity information sharing. Our mechanism can also apply to other profit sharing settings as well. A preliminary version of this work appeared in [11], where we modelled a cybersecurity information sharing platform as a cooperative game and we investigated the Shapley value and Nucleolus distribution solution concepts. We extend our previous work by proposing a new privacy-preserving model for profit sharing considering the fairness requirement. For this purpose, we have applied the differential privacy concept. The remaining of the paper is structured as follows. Next section reviews major related works in the cybersecurity information sharing, coalitional game, and differential privacy. In Section 3, we state the problem. We investigate the coalitional formation in the cybersecurity information sharing environment in Section 4. Section 5 presents our differentially private and fair profit sharing in the cybersecurity information sharing coalitional game. The simulation result is presented in Section 6. We conclude our paper in Section 7. 2 Related works 2.1 Cybersecurity information sharing Cybersecurity information sharing and risk interdependency have been studied extensively in [12-20]. Rutkowski et al. [12] have investigated the specification and use case of the cybersecurity information exchange framework. To facilitate sharing the cybersecurity information, various protocols and standards have been proposed such as TAXII, STIX, and CybOX [14, 15]. The cybersecurity information sharing in competitive environments with the game theory approach has been studied in [7, 8]. Economic analyses of cybersecurity information sharing and applying incentives for motivation have been studied in [6]. On the other hand, the role of a social planner to control free-riding in cybersecurity information sharing game has been investigated in [19]. Mandatory security breach reporting through security audits and imposing sanctions have been studied in [13]. Privacy risks in sharing cybersecurity information have been studied in [21]. In this work, the authors have studied the trade-off between the need for potentially sensitive data, and the perceived privacy risk of sharing that data. In [22], Garrido-Pelaz et al. analyse the benefits and drawbacks of information sharing by proposing a model among organisations with a different level of dependency. The proposed model applies a functional dependency network analysis to investigate the attacks propagation and game theory for information sharing management. Tosh et al. [23] present a game-theoretic framework to investigate the economic benefits of cyber-threat information sharing and analyse the impacts and consequences of not participating in the game of information exchange. They model the information exchange framework as distributed non-cooperative game among the firms and investigate the implications of information sharing and security investments. In [24], Tosh et al. have investigated the cybersecurity information sharing from an evolutionary game theoretic strategy and investigated the conditions under which the players’ self-enforced evolutionary stability can be achieved. Furthermore, the authors have presented a heuristic approach to obtain an evolutionary stable strategy. We have also studied the security and privacy issues of cybersecurity information sharing and proposed different mechanisms to overcome such challenges in our previous works [17, 25, 26]. A framework for privacy preservation of cybersecurity information sharing has been proposed in [26]. This scheme uses a group signature to hide the identities of the organisations. However, this scheme does not protect the participants’ information. Vakilinia et al. [25] have modelled the privacy issue in cybersecurity information sharing as a game between organisations and attackers. Although such a model helps the organisations to decide their sharing strategy, it does not provide any practical solution to protect the underlying information. However, in contrast to previous works, we model the cybersecurity information sharing as a cooperative game in this work, then, we analyse the rewarding and participation-fee allocation according to the organisation's benefits obtained from the sharing platform. We investigate the solution concepts for fair and differentially private allocation of utility among the players. Note that, although the problem of cybersecurity information sharing has similarities to the problem of secret sharing, they are not equal. The secret sharing is a well-known cryptographic primitive that allows an entity to share a secret among n other agents, so that any m of them may reconstruct it. The logic behind this protocol is that, of the n agents, at most are ‘bad’. While the bad agents might not cooperate, the good agents will follow the protocol and pool their share of the secret [27]. However, in the cybersecurity information sharing, there is no bad agent among organisations who want to access the information, on the other hand, the information owner is not willing to share its information unless it gets a reward from the sharing platform. In this scenario, there is no subset of n to open the information, and the information owner decides to share its data if the reward is satisfying. In the paper, we have modelled a cooperative game between organisations to study the fair profit sharing in cybersecurity information sharing platform. In this work, we are interested to analyse the fair profit sharing in a cooperative game setting. It is also worth to mention that Goldman and Zilberstein [28] have studied the problem of information exchange in the multi-agent systems where the problem is to decide the optimal rate of information exchange among agents considering the cost of sharing information with the risk of revealing it to competing agents in an unreliable connection. 2.2 Privacy preserving methods As in the cybersecurity information sharing, rewarding and participation-fee leaks sensitive information about the organisations’ cyber-infrastructure [10], we aim to protect those values. Applying cryptographic techniques, many research studies have been done to protect private information while allowing the computation of a function. For instance, secure multiparty computation [29] and homomorphic encryption [30] are introduced to compute the result of a function without revealing the sensitive input parameters belonging to the entities. Despite the benefit of such methods, an attacker with side information accessing the output value can still infer private information. To overcome this challenge, perturbation techniques have been introduced [31]. In such methods, the output is perturbed to preserve the individual values private in the result while keeping the output utility as much as possible. Differential privacy [32] is a well-known provable concept in the privacy literature which is independent of adversary and data. Differential privacy was first proposed to protect the statistical database where a trusted curator perturbs responses for the queries. Afterwards, this concept has been more developed in many other studies such as data-mining [33], mechanism design [34, 35], smart metering [36, 37], and distributed stream monitoring [38]. In this paper, we investigate differentially private profit sharing in the coalitional game setting. Specifically, we apply differential privacy to preserve the privacy of the participation-fee in the cybersecurity information sharing. To the best of our knowledge, this work is the first research to investigate the differential privacy in the fair profit sharing of the coalitional game theory. 3 Overview and problem statement Let represent the organisations participating in cybersecurity information sharing. Although various information can be shared among organisations such as raw network logs, attackers techniques, the signature of attacks, and the vulnerabilities’ details, in this work, we particularly focus on sharing discovered security vulnerabilities as in [8]. In each sharing cycle, a set of vulnerabilities will be detected by the participant organisations. For example, a cycle can be a time window of a year. Each vulnerability is associated with a unique feature set , which is the vulnerability specification. As an example, consider vulnerability CVE-2016-10012. The feature set of this vulnerability is shown in Table 1. In this table, CVSS (Common Vulnerability Scoring System, https://nvd.nist.gov/vuln-metrics/cvss) is a metric for the calculation of vulnerabilities’ impacts, and CWE (Common Weakness Enumeration, https://cwe.mitre.org/) represents the weakness category. Table 1. Feature Set of Vulnerability CVE-2016-10012 (http://www.cvedetails.com/cve/CVE-2016-10012/) Feature Description CVSS 7.2 Confidentiality impact Complete (There is total information disclosure, resulting in all system files being revealed.) Integrity impact Complete (There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the entire system being compromised.) Availability impact Complete (There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable.) Access complexity Low (Specialised access conditions or extenuating circumstances do not exist. Very little knowledge or skill is required to exploit.) Authentication Not required (Authentication is not required to exploit the vulnerability.) Gained access None Vulnerability type(s) Overflow Gain privileges CWE ID 119 Vendor, product, version Openbsd, Openssh, 7.3 Having , organisations can calculate the expected cost of vulnerability exploitation. For example, assume there is a vulnerability allowing the attackers to gain access to the data of a database system. This can be realised from the vulnerability properties CVE. The exposing of underlying data has different costs for the organisations. Therefore, the organisations would value the vulnerability information differently considering the cost and benefit of patching their vulnerable systems. Such valuations are performed considering the risk estimation of the exploitation of the vulnerabilities associated with the affected assets. Let be the expected cost of exploitation of vulnerability for . Let and denote the probability and the cost of successful exploitation of for , respectively. Thus, we can calculate the expected cost as (1)In the rest of the paper, we will denote with for simplicity. If patches the vulnerability by accessing the shared information before exploitation, then is the expected benefit of accessing the shared information for regarding the vulnerability . We assume there is a trusted third party server , verifying the vulnerability information and computing the participation-fee and reward for the players. Once submits the vulnerability information to , first verifies it and then calculate the reward . The reward is the total payment of the other participant organisations for accessing the vulnerability information . Let denote the ’s payment for accessing the shared information of the vulnerability . Hereafter, the term participation-fee represents . The possessor of vulnerability information decides whether to share the vulnerability information or not, based upon the proposed reward value . Let denote the membership-fee of at the end of cybersecurity information sharing, then is computed as (2)The steps of information sharing are as follows. At the first step, organisations register into the system by providing the certificates and their platform information to . As the vulnerability information is sensitive and can be used by malicious entities to attack the other systems, in the proposed model, the framework requires to authenticate the organisations to prevent the entrance of malicious entities. When a new vulnerability has been detected by one of the members, calculates the patching benefit and participation-fee for the organisations getting the advantage of such information. Then, based on the total participation-fee, computes the reward value for the information possessor. When a cybersecurity information sharing cycle ends, calculates the membership-fee . If is negative, then pays the corresponding amount to , and if is positive, then pays the corresponding amount to . Fig. 1 displays the general architecture of a cybersecurity information sharing system, and Fig. 2 depicts the overall picture of participation-fee and reward calculation. Fig. 1Open in figure viewerPowerPoint Cybersecurity information sharing platform Fig. 2Open in figure viewerPowerPoint Calculation of reward and participation-fee On the other hand, we assume there is an adversary accessing the reward value , and aiming to estimate the victim organisation's participation-fee. We assume adversary has side information and organisations might collude with an adversary by sharing their participation-fee. In this case, an adversary is interested in finding the organisation's participation-fee to gain information about the IT infrastructure of the victim. For example, if an adversary knows that the victim is willing to pay a large value for a vulnerability of specific database management system, it can conclude that the victim is using such a database management system to store valuable information. It is also worth to mention that, the proposed mechanisms are not limited to profit sharing in cybersecurity information sharing, but can also be applied to other profit sharing schemes which expect private profit allocation. Our goal is to present an efficient mechanism for preserving the privacy of an organisation's participation-fee while approximating fair profit sharing in the process of rewarding. More specifically, the fair and private mechanism should satisfy the following requirements. Fairness: The rewarding and participation-fee allocation should be fair, such that the reward is calculated based on the organisations’ advantage from the information, and participation-fee is calculated based on the advantage receives from the information. Furthermore, in the privacy-preserving model, the cost of augmented noise to the reward value should be distributed fairly among participants. Privacy: The mechanism should prevent an adversary with side information to infer an organisation's participation-fee. An adversary might have access to participation-fees of some organisations by colluding with them. Having this system model, first we study the fair profit sharing among organisations by investigating the Shapley value and Nucleolus solution concepts. Then, we examine the private rewarding method to protect an organisation's participation-fee from an adversary with the side information. To achieve this goal, we present a differentially private rewarding mechanism. 4 Rewarding in the coalitional game with transferable utility In this section, first, we introduce the coalitional games, then we investigate the requirements of participation-fee and reward calculation for cybersecurity information sharing system. Finally, we analyse the solution concepts for the coalitional formation of cybersecurity information sharing game. 4.1 Coalitional game Coalitional game theory studies the behaviour of rational self-interested players in strategic settings where players reach agreements to elevate their payoffs. The main question in a coalitional game is how to share the benefits among agents in a coalition. The most well-known solution concepts for such sharing are the Shapley value [39] and the Nucleolus [40]. Saad et al. [41] classify the coalitional game into three different groups as canonical coalitional games, coalition formation games, and coalitional graph games. In canonical coalitional games, the problem is to stabilise the grand coalition. The grand coalition of all users is an optimal structure. In coalition formation games, the network structure that forms depends on gains and costs from cooperation and the problem is how to form an appropriate coalitional topology. In coalitional graph games, players’ interactions are governed by a communication graph structure and the problem is to stabilise the grand coalition or form a network structure taking into account the communication graph. Since in cybersecurity information sharing system, the goal is to have the grand coalition of the entities to maximise the benefits of sharing information, the problem of proper rewarding and participation-fee allocation falls into canonical coalitional games category. Canonical coalitional games have been studied in the wireless network area. For instance, Singh et al. [42] discuss the profit sharing in coalition base resource allocation in wireless networks, and fair payoff allocation for cooperation in wireless ad-hoc networks using Shapley value is studied in [43]. Muto et al. [44] categorise a set of coalitional games as big-boss games. In such games, the coalition value is dependent on the existence of a specific player (namely big-boss) in the coalition. The coalition of subsets not containing the big-boss receives zero value. In this work, we model the cybersecurity information sharing as a coalitional game such that if the information possessor does not locate in the coalition, then there is no benefit for any member of the coalition. Hence, this game is a subset of big-boss games. Afterward, we investigate the solution concepts of profit sharing in the cybersecurity information sharing game. As pointed out earlier, typically organisations are not willing to share their cybersecurity information because of the sharing cost. Let denote the sharing cost of for , then would share if and only if . Besides that, the impacts of vulnerabilities are not equal and other organisations , would pay to access to patch their systems as long as the patching benefit outweighs the participation-fee, in other words, we have . If is small, then the reward may not be motivative for , and as a result, will not share the information, resulting in risk of vulnerability exploitation for . On the other hand, if is large, then the margin of profit for is small. Thus, in this setting, we are interested in the fair distribution of the utilities among organisations to satisfy all of them. To achieve this goal, first, we define the following features for the rewarding mechanism in cybersecurity information sharing. Definition 1.The rewarding mechanism of the cybersecurity information sharing is dynamic if it calculates the reward based on the overall benefits to the system. In the dynamic rewarding mechanism, the participants are motivated to share more useful information since the reward is an increasing function of the benefits achieved by the other organisations exploiting the shared information. Definition 2.The rewarding mechanism of the cybersecurity information sharing is fair if the participation-fee for beneficiary organisations is calculated based on their advantages from accessing the information. If the rewarding mechanism is not fair, organisations may not contribute to the reward value (since their benefits may not outweigh the payment cost). In this case, the reward may not be motivative for the information possessor and as a result, the information will not be shared in the system. Definition 3.The rewarding mechanism of the cybersecurity information sharing is stable, if it is dynamic and fair. As we are interested in finding a stable rewarding mechanism, we investigate the profit sharing in the coalition formation of cybersecurity information sharing. 4.2 Profit sharing In a coalitional game with transferable utility, an n -person game is given by the pair , where is the set of players and v is a real-valued payoff that the coalition's members can distribute among themselves. v is also called the characteristic function of the game, which returns a value for each subset of N. In other words . Superadditivity and Convexity of the game are defined as follows. Definition 4.(Superadditivity): A game is superadditive, if for all and , then . Definition 5.(Convexity): A game is convex if for all , then . While the characteristic function describes the payoff available to coalitions, it does not prescribe a way of distributing these payoffs. An allocation is a vector assigning payoff to each player. In the cybersecurity information sharing game, we are looking for an allocation which stimulates organisations to make the largest coalition. In other words, we are looking for an allocation which is located in the Core. Definition 6.(Co