## 3 Methodology
### Sequential Move Game Model
#### 3.3.1. Solution of the Sequential Move Game Model
In addition, when the probability that a malicious insider using a cyberattack is detected is greater than \(\frac{1}{2}\), _i.e.,_\(p_{2}>\frac{1}{2}\), two cases arise:  
Case (i): \(\delta<x^{*}\) (i.e., the probability that an insider is malicious is less than \(x^{*}\)). If \(C_{c\text{y}b}<2\beta(p_{1}-p_{2})\),  
Figure 4: Flowchart of BNE. To see that \(\left(R_{\text{aut}}^{M}\ R_{\text{aut}}^{L}\,D_{\text{accept}}^{\text{aut}}\ D_{ \text{reject}}^{\text{c}\psi b}\ \right)\) is a PBE of the game \(\Gamma_{2}\), we consider the posterior beliefs \(\mu\equiv\left[\mu(i_{3}\ |\ R_{\text{aut}}\ ),\mu(i_{4}\ |\ R_{\text{aut}}\ ),\mu \left(i_{5}\ |\ R_{\text{c}\psi b}\ \right)\right]\). The strategy \(R_{\text{aut}}^{M}\ R_{\text{aut}}^{L}\) corresponds to \(\phi_{M}=1\) and \(\phi_{L}=1\) so that the posterior beliefs in \(H_{1}\) become \(\mu(i_{3}\ |\ R_{\text{aut}}\ )=1-\delta,\mu(i_{4}\ |\ R_{\text{aut}}\ )=\delta\). Therefore, the information set \(H_{1}\) is reached with positive probability. However, \(H_{2}\) is reached with zero probability for this strategy so that we can assign any posterior belief \(\mu\left(i_{5}\ |\ R_{c\psi b}\right)\in[0,1]\)[32]. Now, let us consider the expected payoffs to the defender due to the action \(D_{\text{accept}}\) in \(H_{1}\), denoted by \(\psi\),  
\[ \begin{array}{l}\psi=V_{2}\big{(}R_{\text{aut}}\,D_{\text{accept}}\ \ |\ L\big{)}\mu(i_{3}\ |\ R_{\text{aut}}\ )+V_{2}\big{(}R_{\text{aut}}\,D_{\text{accept}}\ \ |\ M\big{)}\mu(i_{4}\ |\ R_{\text{aut}}\ )\\ \text{or}\ \psi=V_{2}\big{(}R_{\text{aut}}\,D_{\text{accept}}\ \ |\ L\big{)}(1- \delta)+V_{2}\big{(}R_{\text{aut}}\,D_{\text{accept}}\ \ |\ M\big{)}\delta.\end{array} \]  
Now, the expected payoff to the defender due to the action \(D_{\text{reject}}\) denoted by \(\psi^{{}^{\prime}}\) in \(H_{1}\) is given by  
\[ \begin{array}{l}\psi^{{}^{\prime}}=V_{2}\big{(}R_{\text{aut}}\,D_{\text{reject}}\ \ |\ L \big{)}\mu(i_{3}\ |\ R_{\text{aut}}\ )+V_{2}\big{(}R_{\text{aut}}\,D_{\text{reject}}\ \ |\ M\big{)}\mu(i_{4}\ |\ R_{\text{aut}}\ )\\ \text{or}\ \psi^{{}^{\prime}}=V_{2}\big{(}R_{\text{aut}}\,D_{\text{reject}}\ \ |\ L \big{)}(1-\delta)+V_{2}\big{(}R_{\text{aut}}\,D_{\text{reject}}\ \ |\ M\big{)}\delta.\end{array} \]  
It can be noticed that \(\psi=y_{12}\) and \(\psi^{{}^{\prime}}=y_{14}\). Moreover, if \(\delta\in\Delta_{3}\), we know that \(y_{12}>y_{14}\), i.e., \(\psi>\psi^{{}^{\prime}}\). This implies that \(D_{\text{accept}}\) is the best response to \(R_{\text{aut}}\) in \(H_{1}\). Furthermore, we need to show that \(D_{\text{reject}}\) is also the best response to \(R_{\text{c}\psi b}\) in \(H_{2}\). Let \(\zeta\) and \(\zeta^{{}^{\prime}}\) denote the expected payoffs due to the actions \(D_{\text{accept}}\) and \(D_{\text{reject}}\), respectively, in \(H_{2}\). Therefore, we can write  
\[\begin{array}{l}\zeta=V_{2}\Big{(}R_{\text{c}\psi b}\,D_{\text{accept}}\ \ |\ M \Big{)}\mu\left(i_{5}\ |\ R_{\text{c}\psi b}\ \right)\text{ and }\\ \zeta^{{}^{\prime}}=V_{2}\Big{(}R_{\text{c}\psi b}\,D_{\text{reject}}\ \ |\ M\Big{)}\mu\left(i_{5}\ |\ R_{\text{c}\psi b}\ \right),\text{ where }\mu\left(i_{5}  
(iii) Similar to the above discussion, it can be shown that the BNEs given by Equation (7) are PBEs.