## 3 Proposed Game Model
### Game Modeling  
This subsection presents the parameters used to describe the proposed game, as shown in Table 2. \begin{table}
\begin{tabular}{l l} \hline \hline
**Parameters** & **Descriptions** \\ \hline \(T\) & \(population_{1}\) invests in cybersecurity awareness training. \\ \(\hat{T}\) & \(population_{1}\) does not invest in cybersecurity awareness training. \\ \(S\) & \(population_{2}\) implements security best practices. \\ \(S\) & \(population_{2}\) does not implement security best practices. \\ \(A_{0}\) & \(population_{3}\) adopts the strategy of no attack. \\ \(A_{1}\) & \(population_{3}\) deceives \(population_{1}\) directly. \\ \(A_{2}\) & \(population_{3}\) deceives \(population_{1}\) after compromising \(population_{2}\). \\ \(P(A_{1}/T)\) & Probability of \(population_{3}\) compromising \(population_{1}\) given the strategy \(T\). \\ \(P(A_{1}/\hat{T})\) & Probability of \(population_{3}\) compromising \(population_{1}\) given the strategy \(\hat{T}\). \\ \(P(A_{2}/S)\) & Probability of \(population_{3}\) to compromise \(population_{2}\) given the strategy \(S\). \\ \(P(A_{2}/\hat{S})\) & Probability of \(population_{3}\) compromising \(population_{2}\) given the strategy \(\hat{S}\). \\ \(C_{10}\) & Cost of smart-home adoption. \\ \(C_{11}\) & Households’ expenditure. \\ \(C_{12}\) & Cost related to the strategy \(T\). \\ \(C_{13}\) & Cost of a security breach given the strategy \(\hat{S}\). \\ \(C_{14}\) & Cost of cyberattacks on \(population_{1}\) involving interruption costs of smart-home services and affecting \(population_{1}\)’s comfort and safety. \\ \(C_{20}\) & Cost of security implementation related to the strategy \(S\). \\ \(C_{21}\) & Cost of cyberattacks on \(population_{2}\) involving loss of intellectual property and customer confidential information, and lost revenue. \\ \(C_{30}\) & Cost of conducting a cyberattack targeting \(population_{1}\), given that \(population_{1}\) takes the strategy \(T\). \\ \(C_{31}\) & Cost of conducting a cyberattack targeting \(population_{1}\), given that \(population_{1}\) takes the strategy \(T\). \\ \(C_{32}\) & Cost of conducting a cyberattack targeting \(population_{2}\), given that \(population_{2}\) takes the strategy \(S\). \\ \(C_{33}\) & Cost of conducting a cyberattack targeting \(population_{2}\), given that \(population_{2}\) takes the strategy \(\hat{S}\). \\ \(I_{10}\) & Households’ income. \\ \(P_{20}\) & Amount of profit obtained by \(population_{2}\) from selling smart-home devices given the strategy \(S\). \\ \(P_{21}\) & Amount of profit obtained by \(population_{2}\) from selling smart-home devices given the strategy \(S\). \\ \hline \hline \end{tabular}
\end{table} 
Table 2: List of parameters used in the proposed evolutionary game model. Figure 2: Illustration of the proposed system model. Let \(T\) and \(\hat{T}\) respectively be the strategies that \(population_{1}\) invests in cybersecurity awareness training and that \(population_{1}\) does not invest in cybersecurity awareness training. Let \(S\) and \(\hat{S}\) be the security best practices strategies that \(population_{2}\) implements and does not implement, respectively, for IoT technology when manufacturing smart-home devices. Let \(A_{1}\) be the strategy in which \(population_{3}\) attacks \(population_{1}\) directly and let \(A_{2}\) be the strategy in which \(population_{3}\) attacks \(population_{1}\) after compromising \(population_{2}\). As we show that the attacker incurs costs for direct/indirect attacks, we consider the strategy of no attack as well, i.e., \(A_{0}\). In terms of probabilities, we consider \(P(A_{1}/T)\) and \(P(A_{1}/\hat{T})\) to be the respective probabilities of \(population_{3}\) compromising \(population_{1}\) given strategies \(T\) and \(\hat{T}\). Moreover, we consider \(P(A_{2}/S)\) and \(P(A_{2}/\hat{S})\) to be the respective probabilities of \(population_{3}\) compromising \(population_{2}\) given strategies \(S\) and \(\hat{S}\).