An Evolutionary Game Theoretic Analysis of Cybersecurity Investment Strategies for Smart-Home Users against Cyberattacks  
[PERSON]  
1 Graduate School of Science and Technology, Nara Institute of Science and Technology, Ikoma 630-0192, Japan; [EMAIL_ADDRESS] (M.  
rate of cyberattacks in smart homes that exploit human vulnerabilities. However, the financial costs of cybersecurity education programs are a crucial constraint [7]. For example, [PERSON], [PERSON], and [PERSON] [8] revealed that older adults might not engage in security behaviors because they believe that the costs of cybersecurity outweigh the benefits and do not want to do something wrong due to limited skills. Solving the problem of the costs of cybersecurity training is necessary for home users who have limited resources for daily life expenditures. Many studies have investigated the costs and benefits of cybersecurity education training. For example, [PERSON] et al. [9] conducted a cost-benefit analysis of cybersecurity awareness training programs to determine a company's optimal degree of security. Unfortunately, previous research has not considered trainees' perspectives and constraints. Additional cost-benefit analyses are needed to examine the typical case of smart-home users. By demonstrating that cybersecurity training can provide tangible benefits to smart-home users, they can be motivated to engage in cybersecurity training and security behaviors at home. To determine whether it is worthwhile for smart-home users to invest in cybersecurity, in this work we analyze smart-home environments, including many IoT devices, smart-home users, and multiple stakeholders (e.g., manufacturers) subject to cyberattacks. As mentioned in [10], attackers have a wide range of interests and potential targets in a dynamic and complex smart-home environment. We adopt evolutionary game theory (EGT) to model realistic attack scenarios based on direct attacks and supply chain attacks, which are indirect attacks in which an attacker compromises a part or parts of a supply chain in order to reach and compromise its primary target. We analyze the costs and benefits of the decision-making of three populations, i.e., smart-home users, smart-home stakeholders, and attackers, with regard to smart-home security. Previous research has used formal methods to address cybersecurity issues in IoT-based smart environments. For example, [PERSON] and [PERSON] [11] used attack trees to represent attack scenarios on IoT systems and transformed a given attack tree into a network of priced timed automata to test the security of IoT systems. [PERSON] and [PERSON] used model checking to automatically analyze and identify possible attacks on smart-home devices known as smart meters [12]. Similarly, [PERSON] et al. [13] used model checking to address authentication, anonymity, and integrity in a smart-home environment. In addition to these formal methods, EGT can be used to analyze decision-making in smart environments. The choice of EGT in the present study is motivated by its effectiveness in studying the decision-making of large populations of agents who repeatedly engage in strategic interactions [14]. Similar formal methods, such as classical game theory and agent-based modeling, have limitations when modeling the evolution of populations over time. Classical game theory assumes that all players are rational and make decisions based only on their payouts, which is often unrealistic in real-world scenarios. While agent-based modeling can be used to simulate the behavior of individual agents and their interactions with each other and the environment, it may not capture the strategic interactions between agents as effectively as EGT. In contrast, EGT focuses specifically on strategic interactions among agents and describes the outcomes of these interactions as payoff distributions. Using EGT, we can examine how the different costs and benefits of cybersecurity investment influence the behavior of smart-home users and stakeholders as well as how attackers might adapt to these changes.