## 3 Methodology
### Simultaneous Move Game Model
To capture the interactions, we propose a simultaneous move incomplete information game model in this section and solve the game model to perceive the behavior of the insiders and know how to respond to malicious insider threats. For this, we define the notations and terminologies that are used in the proposed game model (which is denoted as \(\Gamma\)) as follows: \(R_{\text{aut}}\) (request data access through authentication), \(R_{\text{cyb}}\) (request data access through cyberattack), \(D_{\text{accept}}\) (accept data access request and release data), \(D_{\text{reject}}\) (reject data access request and do not release data), and \(C_{\text{cyb}}\in(0,1)\) (cost of cyberattack). The action sets of an insider and the defender can be written as \(\mathcal{A}_{I}=\left\{R_{\text{aut}}\,,R_{\text{cyb}}\right\},\mathcal{A}_{ d}=\left\{D_{\text{accept}}\,,D_{\text{reject}}\right\}\). Also, the type set of insiders \(\Omega=\left\{\text{ malicious (M), legitimate (L)}\right\}\). The pure strategy set of an insider is given by \(S_{I}=\left\{R_{\text{aut}}^{M}R_{\text{aut}}^{L},R_{\text{cyb}}^{M}R_{\text {aut}}^{L}\right\}\), where \(R_{\text{cyb}}^{M}R_{\text{aut}}^{L}\) is the strategy with which the insider would launch a cyberattack if he/she is malicious (M). On the other hand, if he/she is legitimate (L), he/she would take the authentication process to access the data. Similarly, the other strategy, \(R_{\text{aut}}^{M}\)\(R_{\text{aut}}^{L}\), can be defined. In addition, the pure strategy set of the defender is given by \(S_{D}=\left\{D_{\text{accept}}\,,D_{\text{reject}}\,\right\}\). That is, the defender can respond to the data access request by either accepting or rejecting it. Nature's probability distribution on insider's type space is given by \(\Phi:\Omega\mapsto\left[0,1\right]\), such that \(\Phi(M)=\delta\) and \(\Phi(L)=1-\delta\). That is, the probability that an insider is malicious is \(\delta\), whereas the insider is legitimate with a probability of \(1-\delta\). This is common knowledge among the two players--the insider and the defender. Let \(\beta\in(0,1)\) denote the payoff assigned to a malicious insider and \(\omega\in(0,1)\) denote the payoff to the defender due to the discovery of a malicious insider identity or the protection of data (and \(-\omega\) reflects the loss as a result of data compromise or not detecting a malicious insider identity). In the case of identity detection, for example, the defender can improve the data security by removing the malicious insider from the project team. Furthermore, \(p_{1}\) is used to denote the probability that the identity of the malicious insider and his/her activity are discovered in the case of proper authentication. Let \(V_{i}(a,b\mid\theta),i=1,2\), denote the payoffs of player \(i\in\mathcal{N}=\left\{1\text{ (insider), 2 (defender) }\right\}\) corresponding to an action profile \((a,b)\in\mathcal{A}=\mathcal{A}_{I}\times\mathcal{A}_{d}\) and an insider of type \(\theta\in\Omega\), i.e., \(V_{i}:\mathcal{A}\times\Omega\mapsto\mathbb{R}\). The extensive form of the game model is shown in Figure 2. In the payoffs of Figure 2, the subscript \(a\) is used to represent authentication or accept as the case may be and \(r\) is used to represent reject. \(i_{0},i_{1},\ldots,i_{5}\) are used to denote different nodes of the game tree. The dotted oval denotes the information set of the defender. Furthermore, notations and their meanings used in the proposed models are given in Table 1 in Appendix D.