## 3 Methodology
### Simultaneous Move Game Model
#### 3.2.1 Payoff Functions  
Now, we describe the payoff functions of the game model. Consider a strategy profile \(\left(R_{\text{aut}}\,,D_{\text{accept}}\,\right)\) for \(i\in\mathcal{N}\) given an insider is of legitimate type \(L\). In this case, a legitimate insider sends a data access request and the defender accepts it. As a result, both the insider and the defender receive a certain payoff whose value is normalized to \(1\), i.e., \(V_{i}\left(R_{\text{aut}}\,,D_{\text{accept}}\,\mid L\right)=1\), whereas a legitimate insider and the defender receive payoff zero if the access request is rejected, i.e., \(V_{i}\left(R_{\text{aut}}\,,D_{\text{reject}}\,\mid L\right)=0\), \(i\in\mathcal{N}\). In the case of a malicious insider, if the data access request is accepted, the insider receives payoff \(\beta\) with probability \((1-p_{1})\), and this is represented as \(V_{1}\left(R_{\text{aut}}\,,D_{\text{accept}}\,\mid M\right)=(1-p_{1})\beta\). On the other hand, the defender receives payoff \(-\omega\) with probability \((1-p_{1})\) and, therefore,  
Figure 2: Extensive form of the simultaneous move game model.  
\(V_{2}\big{(}R_{\text{aut}}\,,D_{\text{accept}}\,\mid M\big{)}=(1-p_{1})(-\omega)\). In addition, if a malicious insider sends a data request and the request is rejected, both the insider and the defender receive payoff 0, i.e., \(V_{1}\big{(}R_{\text{aut}}\,,D_{\text{project}}\,\mid M\big{)}=0\) and \(V_{2}\big{(}R_{\text{aut}}\,,D_{\text{reject}}\,\mid M\big{)}=0\). However, if a malicious insider launches a cyberattack to access the data and the data are released, the insider receives payoff \(\beta\) at the cost of the cyberattack \(C_{cyb}\in(0,1)\), i.e., \(V_{1}\big{(}R_{cyb},D_{\text{accept}}\,\mid M\big{)}=\beta-C_{cyb}\), whereas the defender receives \(-\omega\), i.e., \(V_{2}\big{(}R_{\text{cyb}}\,,D_{\text{accept}}\,\mid M\big{)}=-\omega\). Furthermore, a malicious insider who sends a data access request through a cyberattack receives \(-C_{cyb}\) if the request is rejected and the defender also receives payoff zero, i.e., \(V_{1}\big{(}R_{cyb},D_{\text{reject}}\,\mid M\big{)}=-C_{cyb}\) and \(V_{2}\big{(}R_{cyb},D_{\text{reject}}\,\mid M\big{)}=0\).  
Thus, we can express the expected payoff function of \(i\in\mathcal{N}\), which is given by \(U_{i}:S_{1}\times\ S_{D}\mapsto\mathbb{R}\), where \(U_{1}\big{(}R_{\text{aut}}^{M}\,R_{\text{aut}}^{L}\,,D_{\text{accept}}\,\mid M \big{)}=\delta V_{1}\big{(}R_{\text{aut}}\,,D_{\text{accept}}\,\mid M\big{)} +(1-\delta)V_{1}\big{(}R_{\text{aut}}\,,D_{\text{accept}}\,\mid L\big{)}= \delta\big{[}(1-p_{1})\beta\big{]}+(1-\delta)\). In addition, \(U_{2}\big{(}R_{\text{aut}}^{M}\,R_{\text{aut}}^{L}\,,D_{\text{accept}}\, \mid\,\delta V_{2}\big{(}R_{\text{aut}}\,,D_{\text{accept}}\,\mid M\big{)}+( 1-\delta)V_{2}\big{(}R_{\text{aut}}\,,D_{\text{accept}}\,\mid L\big{)}=\delta \big{[}(1-p_{1})(-\omega)\big{]}+(1-\delta)\).  
Similarly, the other expected payoffs corresponding to different strategy profiles can be expressed as \(U_{1}\big{(}R_{\text{aut}}^{M}\,R_{\text{aut}}^{L}\,,D_{\text{reject}}\,\big{)}= 0,U_{2}\big{(}R_{\text{aut}}^{M}\,R_{\text{aut}}^{L}\,,D_{\text{reject}}\, \big{)}=0,U_{1}\big{(}R_{\text{cyb}}^{M}\,R_{\text{aut}}^{L}\,,D_{\text{accept }}\,\big{)}\)\(=\delta\Big{[}\beta-C_{cyb}\Big{]}+(1-\delta),U_{2}\big{(}R_{cyb}^{M}R_{\text{aut}}^{L}\,,D_{ \text{accept}}\,\big{)}=\delta\big{[}(-\omega)\big{]}+(1-\delta),U_{1}\big{(}R _{cyb}^{M}R_{\text{aut}}^{L}\,,D_{\text{reject}}\,\big{)}\)\(=\delta\Big{(}-C_{cyb}\Big{)}\) and \(U_{2}\big{(}R_{cyb}^{M}R_{\text{aut}}^{L}\,,D_{\text{reject}}\,\big{)}=0\).