## 3 Methodology
### Sequential Move Game Model  
In the previous section, we considered a simultaneous move game model in which each of the players takes an action simultaneously without knowing the actions taken by the other player. In this section, we consider the attack dynamics where an insider makes a data access request, which is observed by a data defender who has prior beliefs about the insider and responds to the request based on the updated beliefs of the insider type. Let us recall that a malicious insider can request data access in two ways: (i) authentication (misuse of privilege) and (ii) cyberattack, such as defense bypass, to evade detection from the IDS [38]. When an insider makes a data request through authentication, the defender observes this activity. Although the defender perceives that the request is made using an authentication, he/she has prior beliefs that the access request comes from a malicious insider with probability \(\delta\). Hence, for the defender, accepting a request that comes from authentication is not always optimal. Moreover, when an insider tries to gain access to data through a cyberattack, another challenging decision problem faced by the defender would be whether it is always optimal to reject the suspicious request. This might not always be optimal because a malicious insider's identity cannot be discovered by rejecting the access request, thereby providing him/her with another opportunity to launch attacks in the future. In fact, accepting a suspicious request at the cost of data security can lead to the detection of malicious activity as well as the discovery of a malicious insider's identity. As a result, the project team can get rid of the malicious insider to enhance data security. However, at the same time, accepting a suspicious request is not always optimal, as there is a probability that the malicious insider identity might not be discovered at all. Thus, we develop a sequential move Bayesian game model (which is denoted as \(\Gamma_{2}\)) to capture this scenario and predict a malicious insider's behavior as well as the best strategies to respond to the attack. We assume that the defender employs an IDS to monitor access requests. When an insider (legitimate/malicious) makes a data access request through authentication, no alarm is triggered by the IDS for the request since the necessary authentication process is performed by the insider. However, when a malicious insider makes a data access request utilizing a cyberattack to gain access to data, an alarm is triggered by the IDS. The extensive form of the game model is shown in Figure 3. Note that in the sequential game model, the defender has two information sets denoted by a dotted oval. In contrast, in the simultaneous move game model, the defender has only one information set (see Figure 2). Now, the strategy sets of an insider and defender can be written as  
\[S^{\prime}_{I} =\Big{\{}R^{M}_{\text{natt}}\ R^{L}_{\text{natt}}\,R^{M}_{\text{cgb}}\ R^{L}_{ \text{natt}}\Big{\}}.\] \[S^{\prime}_{D} =\Big{\{}D^{\text{natt}}_{\text{nactpt}}\ D^{\text{cgb}}_{\text{ acccept}}\,D^{\text{natt}}_{\text{nactpt}}\ D^{\text{cgb}}_{\text{reject}}\,D^{\text{natt}}_{\text{nject}}\ D^{\text{cgb}}_{\text{ accept}}\,D^{\text{natt}}_{\text{reject}}\ D^{\text{cgb}}_{\text{ reject}}\Big{\}}.\]  
The meaning of elements in \(S^{{}^{\prime}}_{I}\) can be interpreted as in the case of the elements of \(S_{1}\) of the simultaneous move game model. The elements of \(S^{{}^{\prime}}_{D}\), however, have different interpretations. That is, \(D^{\text{natt}}_{\text{accept}}\ D^{\text{cgb}}_{\text{reject}}\) denotes the defender's strategy, in which the defender accepts the data request if he/she observes that it comes from an authentication process, whereas he/she rejects the access request if it comes through a cyberattack. The other strategies can be interpreted similarly. Thus, the payoff matrix of the game model can be written as  
\[R^{M}_{\text{natt}}\ R^{L}_{\text{natt}}\ R^{M}_{\text{cgb}}\ R^{L}_{\text{ autt}}\