## 3 Methodology
### Simultaneous Move Game Model
#### 3.2.3 Extended Simultaneous Move Game Model  
In the previous game model, the probability that a malicious insider who launches a cyberattack is detected is not considered. Therefore, the game model is insufficient to capture the behavior of malicious insiders who can carry out a cyberattack to gain data access. Hence, we consider this aspect and discuss the extended model (denoted by \(\Gamma_{1}\)) by incorporating this probability. To this end, let \(p_{2}\) denote the probability that the identity of the malicious insider and his/her activity are discovered and assume that \(p_{1}>p_{2}\). Recall that \(\beta\) is the payoff (or gain) to the attacker due to the data compromised and \(-\beta\) measures the intensity of penalty to the attacker if detected, i.e., the higher the value of \(\beta\), the greater the severity of the penalty, and \(\omega\in(0,1)\) is the payoff to the defender due to the discovery of a malicious insider identity or the protection of data. Additionally, \(-\omega\) measures the loss due to data compromise or failure to discover the malicious insider identity. Furthermore, corresponding to the proper/smooth functioning of the project work, payoff 1 is assigned. In contrast, penalty 0 is assigned to both the legitimate insider and the defender for rejecting a legitimate data access request. In this case, the data are withheld, causing inefficiency in the project work. Now, suppose that an insider of the legitimate type sends a data access request to the data defender. This request is responded to by the defender using accept \(\left(D_{\text{accept}}\ \right)\). Therefore, the corresponding payoff functions can be written as \(V_{i}\big{(}R_{\text{aut}}\,D_{\text{accept}}\ \mid\ L\big{)}=1,i\in \mathcal{N}\). On the other hand, rejecting the request results in the payoff function \(V_{i}\big{(}R_{\text{aut}}\,D_{\text{reject}}\ \mid\ L\big{)}=0,i\in \mathcal{N}\). Consider that a malicious insider sends a data access request through authentication, and this is accepted by the defender; the payoff of the malicious insider can be written as \(V_{1}\big{(}R_{\text{aut}}\,D_{\text{accept}}\ \mid\ M\big{)}=p_{1}(-\beta) +(1-p_{1})\beta\). On the other hand, if the request is accepted, the payoff to the defender is given by \(V_{2}\big{(}R_{\text{aut}}\,D_{\text{accept}}\ \mid\ M\big{)}=p_{1} \omega+(1-p_{1})(-\omega)\). Also, consider that a malicious insider sends a data request through authentication and the request is rejected by the defender. In this case, both the malicious insider and the defender receive the payoff 0. Therefore, the insider's payoff function is given by \(V_{i}\big{(}R_{\text{aut}}\,D_{\text{reject}}\ \mid\ M\big{)}=0,i\in \mathcal{N}\). Furthermore, if an insider makes a data access request through a cyberattack and the request is accepted, then the corresponding payoff functions can be written as \(V_{1}\Big{(}R_{cyb},D_{\text{accept}}\ |\ M\Big{)}=p_{2}(-\beta)+(1-p_{2}) \beta-C_{cyb}\). Moreover, as for the defender, the payoff function is \(V_{2}\Big{(}R_{\text{cyb}}\,D_{\text{accept}}\ |\ M\Big{)}=p_{2}(\omega)+(1-p_{2})(-\omega)\). Also, when the malicious insider request is rejected by the defender, we have \(V_{1}\Big{(}R_{cyb},D_{\text{reject}}\ |\ M\Big{)}=-C_{cyb}\) and \(V_{2}\Big{(}R_{\text{cyb}}\,D_{\text{reject}}\ |\ M\Big{)}=0\). Thus, we can write the expected payoff function of \(i\in\mathcal{N},U_{i}:S_{I}\times S_{D}\mapsto\mathbb{R}\), where  
\[ \begin{array}{l}U_{1}\big{(}R_{aut}^{M}\ R_{aut}^{L}\,D_{accept}\big{)}= \delta V_{1}\big{(}R_{aut}\,D_{accept}\ |\ M\big{)}+(1-\delta)V_{1}\big{(}R_{aut}\,D_{ accept}\ |\ L\big{)}.\\ \text{or}\ U_{1}\big{(}R_{aut}^{M}\ R_{aut}^{L}\,D_{accept}\big{)}=\delta[p_{1}(- \beta)+(1-p_{1})\beta]+(1-\delta).\end{array}