## 5 Networked ATM-CPS Game Model
### A Game Modeling Method of Networked ATM-CPS Based on Bayesian Nash Equilibrium Strategy  
The information security assurance of ATM-CPS is actually a game between attackers and defenders in cyber space and physical space. When both sides of the game reach the dynamic equilibrium state, the ATM-CPS alternates between the initial normal state and the penetration state, and there is a Bayesian Nash equilibrium with mixed strategies. Therefore, the game modeling of ATM-CPS is to evaluate and predict the security status of ATM-CPS on the basis of security situation awareness and then determine the Bayesian Nash equilibrium strategy and establish the game model according to the evaluation and prediction results. 1. Security situation assessment method of networked ATM-CPS based on Bayesian game theory. The quantitative evaluation method based on naive Bayes is adopted to evaluate the security situation of networked ATM-CPS. The naive Bayesian quantitative evaluation method considers the fusion of multiple information sources and multi-level heterogeneous information in the ATM system, which can effectively handle uncertain factors and complete the quantitative evaluation of the security situation of the ATM system. The security situation assessment method of networked ATM based on Bayesian game theory is shown in Figure 7.  
In Figure 7, a networked ATM system defense model based on security baseline strategy and a hacker attack model based on utilization mechanism are established. According to Bayesian rule and game theory, the information security situation prediction method of networked ATM system is proposed. This method maps the causal relationship between alarm information to the Bayesian network in advance, establishes the information security situation prediction model of networked ATM system on the basis of Bayesian game, and then identifies the attacker's invasion or attack intention and predicts the threat degree according to the alarm information. Then, according to the intrusion or attack behavior that has been implemented by the attacker, the probability value on the ATM resource subsystem where the intrusion or attack behavior occurs is continuously revised according to Bayesian law. Finally, based on this probability value, the attack effect and security status of the attacker and the networked ATM information security assurance system are analyzed, and the probability of the attacker choosing the attack mode in the next game stage and the probability of the networked ATM information security assurance system choosing the defense in the next game stage are predicted. Figure 7: A security situation assessment method for networked ATM system based on Bayesian game theory. The steps of security situation assessment of networked ATM system based on Bayesian game theory are as follows. * Using Bayesian game theory to simulate the attack characteristics of the attack modes (deception attack and DDoS attack) in the real networked ATM system and the defense characteristics of networked ATM system based on security baseline strategy, forming a non-cooperative incomplete information game. * Analyzing the attack behavior of the networked ATM system and using Bayesian law to continuously modify the probability value of the resource subsystem or network containing malicious intrusion tendency in the networked ATM system. * Predicting the networked ATM system and attackers according to the information they have obtained and quantitatively describing and depicting the change trend of the networked ATM system. * Predicting the hacker's behavior according to the security status of the current networked ATM system to make a prediction and evaluation of the security situation of the networked ATM system. * Constructing the ATM-CPS game model based on Bayesian Nash equilibrium strategy. Combined with the networked ATM-CPS model, the security threats (hidden dangers and vulnerabilities) and attack methods facing the ATM system are classified.