# Stackelberg Interdependent Security Game in Distributed and Hierarchical Cyber-Physical Systems

Authors: Jiajun Shen; Dongqin Feng
Journal: Security and Communication Networks
 (2017)

---

## Abstract

With the integration of physical plant and network, cyber-physical systems (CPSs) are increasingly vulnerable due to their distributed and hierarchical framework. Stackelberg interdependent security game (SISG) is proposed for characterizing the interdependent security in CPSs, that is, the interactions between individual CPSs, which are selfish but nonmalicious with the payoff function being formulated from a cross-layer perspective. The pure-strategy equilibria for two-player symmetric SISG are firstly analyzed with the strategy gap between individual and social optimum being characterized, which is known as negative externalities. Then, the results are further extended to the asymmetric andm-player SISG. At last, a numerical case of practical experiment platform is analyzed for determining the comprehensively optimal security configuration for administrator.


---

## Body

## 1. Introduction

Cyber-physical systems (CPSs), where modern computing, communication, and control technologies are deeply integrated, have been widely applied in various infrastructures including smart grid, reliable medical devices, and process control [1]. Although CPS can yield enormous benefits for us, its distributed and hierarchical framework (as shown in Figure 1) leads to the exposure of a series of vulnerabilities, which can be directly exploited by external attacker or, in most scenarios, by the compromised neighbors. The corresponding accidents have been reported in various outlets [2–7] and interdependent security of CPS therefore needs urgently to be studied for preventing people’s life and property together with national security from being threatened. In this paper, we approach the interdependent security of CPS from a game-theoretic perspective since game theory has already been a mature tool for characterizing the interactions of strategic players.Figure 1
Distributed and hierarchical framework of CPS.


### 1.1. Former Studies

According to the former studies, we conclude two branches of recent research concerning interdependent security, that is, internally and externally interdependent security.In most research, the internally interdependent security is also expressed as cross-layer security, cascading security, or resilient control which is mainly focused on making a tradeoff between cyber cost and physical control performance.In the literatures for cross-layer security of CPS, researchers have proposed several control theoretic approaches [8–12].Liu et al. [8] show how an attacker can manipulate the state estimation while avoiding bad-data alarms in the control center. Two security indices are further defined in [9] for quantifying the degree of difficulty of carrying out a successful stealth attack against particular measurements. In [10], by encrypting a certain number of measurement devices, a state estimator is protected from unobserved attacks. In [11], stealthy false-data attacks against the state estimators in power systems are studied. From the perspective of compromise in filter gain or controller gain, Elbsat and Yaz [12] firstly use finite time state-feedback stabilization for discrete-time nonlinear systems with conic-type nonlinearities, bounded feedback control gain perturbations, and additive disturbances.As for cascading security and resilient control, in [13, 14], the authors consider the cyber-physical system consisted of mutually interdependent physical-resource and computational-resource networks, which is basically in accordance with the concept of cross-layer framework. The issue of cascading failure occurring in such system is then investigated with a threshold of the proportion of faulty nodes being obtained for the collapse of system.Yuan et al. [15] use a unified game approach for resilient control of networked control system (NCS) under Denial-of-Service (DoS) attack. The packet dropout caused by attacker is considered in cyber layer, while, in physical layer, optimal control strategies with multitasking and central tasking structure are developed using game theory. In [16], resilient stabilization of a Multihop Control Network (MCN) is considered as a codesign problem of controller and communication protocol. In physical layer, a MIMO LTI system is considered, and the necessary and sufficient conditions that invalidate controllability and observability are characterized. In cyber layer, how to detect and isolate the compromised nodes is discussed.Nevertheless, as for external interdependence security of CPS, it is worth mentioning that there is surprisingly little work on this topic. To the best of our knowledge, the most related works to ours are [17–19].In [17], the interdependent security of identical networked control systems is studied. The problem of how to make security investment for each individual system operator is formulated as a two-stage noncooperative game, in the first stage of which a security investment should be decided to make or not, while, in the second stage, an LQG problem is then resolved for minimizing the average operational cost.In [18], the authors present an analytical model based on the Kunreuther and Heal game-theoretic model of the interdependent security problem, in order to study the deployment of security features and protocols in the subnets with different network topologies. In [19], the Kunreuther and Heal game-theoretic model of the interdependent security problem is extended by applying empirically based social network, while theft of knowledge is considered as the major threat due to its impact on both economic and national security.


### 1.2. Contributions

Nevertheless, the static game proposed in [17] is against the practical scenario that once security choices are made, they are observable to all the players connected by the common network. In addition, the amount of defense resources implemented on each individual is ignored since all the individuals are assumed to be identical, and the corresponding action space of each individual merely includes two choices, “invest” or “not invest.” Furthermore, in [18, 19], the researchers only discuss the security investment of cyber layer without taking any physical effect into account.It is noted that there exist the papers and projects containing approaches of taking both cyber and physical aspects into consideration based on the methodology other than game theory, such as switch system-based research [20–22] and state estimation-based research [8, 9]. However, in these researches, the nature of rational cyber attackers and physical uncertainties is ignored. It is hard to capture the rational, intelligent, and uncertain dynamics of the distributed and hierarchical CPSs without game-theoretic methodology. Due to space limitations, we choose to go no further on detailed discussion. The researches [17–19] are analyzed since they are all studied from a game-theoretic perspective which is in accordance with the methodology of our paper.The main contributions of this paper include the following.(1)
According to the practical scenario, a Stackelberg interdependent security game (SISG) is proposed for better capturing the interactions between individual CPSs sharing common network. Unlike the simultaneous moves in static game proposed in [17], the players would act in order.(2)
When formulating payoff function, we consider the internally interdependent security by taking factors of both cyber layer and physical layer into consideration. More specifically, in physical layer, anH-∞ optimal control problem is considered and control performance index γ∗ is dependent on time-delay parameters which are determined by the cyber interactions. The security issues in cyber layer and optimal control problems in physical layer are then intertwined.(3)
The pure-strategy equilibria are analyzed for two-player symmetric SISG with the conditions under which these equilibria can take place being determined. Meanwhile, our results show that the individually optimal choices differ from socially optimal ones, which prove the existence of strategy gap and negative externalities. It indicates that the individual players tend to underinvest in security (relative to the social planner) due to the negative externalities introduced by common network.(4)
The result of two-player symmetric SISG is further extended to asymmetric andm-player SISG. Specifically, we discuss the circumstance that the players are nonidentical, which we name as asymmetric SISG for distinguishing from the case that individuals are equipped with same defense resources and action space.(5)
A numerical case study of practical experiment platform is given, which indicates a possible way of solving interdependent security issues in practical engineering projects. It will help administrator make a comprehensively optimal configuration in distributed environment.


### 1.3. Organization

The rest of this paper is organized as follows. In Section2, SISG is introduced with cross-layer payoff function being defined. Moreover, the security interdependence reflected in payoff function is explained as well. In Sections 3 and 4, the pure-strategy equilibria for two-player symmetric SISG are firstly analyzed and the results are extended to asymmetric and m-player SISG. The condition under which these equilibria can take place is given, and meanwhile both individual and social optima are explored with the gap of which is being clearly distinguished. A numerical case of practical experiment platform is analyzed in Section 5. Section 6 concludes this paper and introduces our future interests. The proofs of Theorems 3, 4, and 5 are supplied in Appendices A, B, and C, respectively.


## 1.1. Former Studies

According to the former studies, we conclude two branches of recent research concerning interdependent security, that is, internally and externally interdependent security.In most research, the internally interdependent security is also expressed as cross-layer security, cascading security, or resilient control which is mainly focused on making a tradeoff between cyber cost and physical control performance.In the literatures for cross-layer security of CPS, researchers have proposed several control theoretic approaches [8–12].Liu et al. [8] show how an attacker can manipulate the state estimation while avoiding bad-data alarms in the control center. Two security indices are further defined in [9] for quantifying the degree of difficulty of carrying out a successful stealth attack against particular measurements. In [10], by encrypting a certain number of measurement devices, a state estimator is protected from unobserved attacks. In [11], stealthy false-data attacks against the state estimators in power systems are studied. From the perspective of compromise in filter gain or controller gain, Elbsat and Yaz [12] firstly use finite time state-feedback stabilization for discrete-time nonlinear systems with conic-type nonlinearities, bounded feedback control gain perturbations, and additive disturbances.As for cascading security and resilient control, in [13, 14], the authors consider the cyber-physical system consisted of mutually interdependent physical-resource and computational-resource networks, which is basically in accordance with the concept of cross-layer framework. The issue of cascading failure occurring in such system is then investigated with a threshold of the proportion of faulty nodes being obtained for the collapse of system.Yuan et al. [15] use a unified game approach for resilient control of networked control system (NCS) under Denial-of-Service (DoS) attack. The packet dropout caused by attacker is considered in cyber layer, while, in physical layer, optimal control strategies with multitasking and central tasking structure are developed using game theory. In [16], resilient stabilization of a Multihop Control Network (MCN) is considered as a codesign problem of controller and communication protocol. In physical layer, a MIMO LTI system is considered, and the necessary and sufficient conditions that invalidate controllability and observability are characterized. In cyber layer, how to detect and isolate the compromised nodes is discussed.Nevertheless, as for external interdependence security of CPS, it is worth mentioning that there is surprisingly little work on this topic. To the best of our knowledge, the most related works to ours are [17–19].In [17], the interdependent security of identical networked control systems is studied. The problem of how to make security investment for each individual system operator is formulated as a two-stage noncooperative game, in the first stage of which a security investment should be decided to make or not, while, in the second stage, an LQG problem is then resolved for minimizing the average operational cost.In [18], the authors present an analytical model based on the Kunreuther and Heal game-theoretic model of the interdependent security problem, in order to study the deployment of security features and protocols in the subnets with different network topologies. In [19], the Kunreuther and Heal game-theoretic model of the interdependent security problem is extended by applying empirically based social network, while theft of knowledge is considered as the major threat due to its impact on both economic and national security.


## 1.2. Contributions

Nevertheless, the static game proposed in [17] is against the practical scenario that once security choices are made, they are observable to all the players connected by the common network. In addition, the amount of defense resources implemented on each individual is ignored since all the individuals are assumed to be identical, and the corresponding action space of each individual merely includes two choices, “invest” or “not invest.” Furthermore, in [18, 19], the researchers only discuss the security investment of cyber layer without taking any physical effect into account.It is noted that there exist the papers and projects containing approaches of taking both cyber and physical aspects into consideration based on the methodology other than game theory, such as switch system-based research [20–22] and state estimation-based research [8, 9]. However, in these researches, the nature of rational cyber attackers and physical uncertainties is ignored. It is hard to capture the rational, intelligent, and uncertain dynamics of the distributed and hierarchical CPSs without game-theoretic methodology. Due to space limitations, we choose to go no further on detailed discussion. The researches [17–19] are analyzed since they are all studied from a game-theoretic perspective which is in accordance with the methodology of our paper.The main contributions of this paper include the following.(1)
According to the practical scenario, a Stackelberg interdependent security game (SISG) is proposed for better capturing the interactions between individual CPSs sharing common network. Unlike the simultaneous moves in static game proposed in [17], the players would act in order.(2)
When formulating payoff function, we consider the internally interdependent security by taking factors of both cyber layer and physical layer into consideration. More specifically, in physical layer, anH-∞ optimal control problem is considered and control performance index γ∗ is dependent on time-delay parameters which are determined by the cyber interactions. The security issues in cyber layer and optimal control problems in physical layer are then intertwined.(3)
The pure-strategy equilibria are analyzed for two-player symmetric SISG with the conditions under which these equilibria can take place being determined. Meanwhile, our results show that the individually optimal choices differ from socially optimal ones, which prove the existence of strategy gap and negative externalities. It indicates that the individual players tend to underinvest in security (relative to the social planner) due to the negative externalities introduced by common network.(4)
The result of two-player symmetric SISG is further extended to asymmetric andm-player SISG. Specifically, we discuss the circumstance that the players are nonidentical, which we name as asymmetric SISG for distinguishing from the case that individuals are equipped with same defense resources and action space.(5)
A numerical case study of practical experiment platform is given, which indicates a possible way of solving interdependent security issues in practical engineering projects. It will help administrator make a comprehensively optimal configuration in distributed environment.


## 1.3. Organization

The rest of this paper is organized as follows. In Section2, SISG is introduced with cross-layer payoff function being defined. Moreover, the security interdependence reflected in payoff function is explained as well. In Sections 3 and 4, the pure-strategy equilibria for two-player symmetric SISG are firstly analyzed and the results are extended to asymmetric and m-player SISG. The condition under which these equilibria can take place is given, and meanwhile both individual and social optima are explored with the gap of which is being clearly distinguished. A numerical case of practical experiment platform is analyzed in Section 5. Section 6 concludes this paper and introduces our future interests. The proofs of Theorems 3, 4, and 5 are supplied in Appendices A, B, and C, respectively.


## 2. Problem Setting

### 2.1. Stackelberg Interdependent Security Game

Firstly, the definition of interdependent security game is given as follows.Definition 1 (interdependent security game).
In an interdependent security game, the players are selfish but nonmalicious and are able to choose whether to invest in security or remain unprotected. Each player’s goal is to minimize his own risk, which depends on the investments of some or every other players who also aim to minimize their own costs.We firstly consider the situation that all the players (individual CPSs) are identical and the corresponding Stackelberg interdependent security game (SISG) is therefore called symmetric SISG. The extensive form representation of two-player andm-player symmetric SISG is as shown in Figures 2 and 3, respectively.Figure 2
Extensive form representation of two-player symmetric SISG.Figure 3
Extensive form representation ofm-player symmetric SISG.In two-player symmetric SISG as described in Figure2, leader chooses to invest or not invest in security at first, and then follower makes an optimal response for minimizing his own payoff. In m-player SISG as described in Figure 3, the players other than Pi, who are assumed to act simultaneously, are regarded as leader. ψLξ denotes the strategy of leader with ξ representing the number of insecure individuals, that is, the players who do not make a security investment. Furthermore, m is the total number of players. After the strategy of P-i, ψLξ, being determined, the follower, Pi, chooses an optimal strategy for minimizing his own payoff. Based on Figures 2 and 3, it would be easy to extend the symmetric SISG to the situation that the amount of defense investment choices of all the players is more than two.It is noted that, in the symmetric SISG given by Figures2 and 3, all of the players (individual CPSs) are supposed to be identical. The action space defined for each CPS is the same and includes “invest” or “not invest” with the different defense resources implemented on each CPS being ignored. In practical security scenarios such as Stuxnet worm [2], Flame virus [4], and Water Plant Breach [5], the rational attackers are always familiar with the fingerprint characteristic of CPS, which indicates that they are capable of accurately parsing the command message and find the target devices even in the complicated hierarchical and distributed framework. Naturally, it is supposed that different attack strategy would be implemented for different target devices and thus each CPS is faced with different types of cyber attacks. Under this circumstance, the players (individual CPSs) of SISG should be considered as nonidentical.The extensive form representations of asymmetric SISG for two-player andm-player are given in Figures 4 and 5, respectively, where different types of defense investment are considered for each player. In Figure 4, I1 and I2 represent different types of defense investment of each player. In Figure 5, I1,Lj (j≠i) indicates that the defense investment implemented by the jth leader is I1.Figure 4
Extensive form representation of two-player asymmetric SISG.Figure 5
Extensive form representation ofm-player asymmetric SISG.Based on Figures4 and 5, it is easy to extend the situations to more complicated ones, such as the situation that amount of defense investment choices of each player is more than two.


### 2.2. Cross-Layer Payoff Function

For better characterizing the SISG, we formulate payoff function from a cross-layer perspective, that is, taking factors of both cyber layer and physical layer into consideration.Each individual CPS is viewed as a playerPi(i∈M), where M is the set of all players. Each player aims to minimize his own overall payoff for maintaining a relatively higher security level and better control performance.In cyber layer,Pi is able to decide whether to invest in security or not and SIi is denoted as the security choice made by Pi,(1)SIi≔1,Piinvests  in  security,0,Pidoes  not  invest  in  security.The security choices made by all players can therefore be denoted asSI≔SI1,…,SIi,…,SIm, and thus the cyber layer cost of Pi is given by(2)JCiSIi≔SIi·l,i∈M.The physical plant of each individual CPS is described by discrete-time model, which is assumed to be in the form as follows:(3)xk+1=Axk+B2uc,k+B1ωk,zk=Dxk,where xk∈Rn is the system state, uc,k∈Rm is the control input, zk∈Rr is the controlled output, ωk∈Rq is the disturbance input belonging to l2[0,∞), A, B1, B2, and D are known real matrices with appropriate dimensions.The randomly varying communication delays are described by(4)yk=Cxk,yc,k=1-δyk+δyk-1,uk=Kx^k,uc,k=1-βuk+βuk-1,where yc,k∈Rp is the measured output and yk∈Rp is the actual output. uk∈Rm is the control signal generated by the controller and uc,k is the signal received by the actuator. δ and β are both communication delays.In practical engineering scenario, such as controlling the PWM inverter for an uninterrupted power system (UPS) through network, the output AC voltage data measured by sensor and then collected by PLC corresponds toyc,k, while the actual output AC voltage corresponds to yk. uk is the control command for the PWM inverter, while uc,k is the control signal received by the PWM inverter. δ (resp., β) can be interpreted as the communication delay on sensor-to-controller (resp., controller-to-actuator) channel as shown in Figure 6.Figure 6
Structure of CPS with C-A and S-C delays.The stochastic variable is considered as Bernoulli distributed white sequence with(5)δ¯=Pr⁡δ=1=Eδ,Pr⁡δ=0=1-Eδ=1-δ¯.According to (4), it is noted that when δ=1 (resp., δ=0), yc,k=yk-1 (resp., yc,k=yk) indicates that the last sensor command is not received (or received) by the controller at k, and when β=1 (resp., β=0), uc,k=uk-1 (resp., uc,k=uk) indicates that the last control command is not received (or received) by the actuator at k. The influence that time-delay attacker exerts on system control can therefore be embodied by packet losses happened in the last step.More specifically, taking typical time-delay attack, DoS attacks, into consideration, we can view bothδ¯ and β¯ as intensity-of-attack (IoA) on S-C and C-A communication channel, respectively. According to Xu et al. [23], DoS attacks can degrade the channel quality which leads to the packet losses and thus lowers package delivery rate (PDR). The corresponding H∞-optimal control problem under DoS attacks should be able to address the issue of packet losses which is also common in traditional network control system (NCS) [24, 25].Here we use the dynamic observer-based control scheme [26] for the system described by (3):(6)Observer:x^k+1=Ax^k+B2uc,k+Lyc,k-y¯c,k,y¯c,k=1-δ¯Cx^k+δ¯Cx^k-1,(7)Controller:uk=Kx^k,u¯c,k=1-β¯uk+β¯uk-1,where x^k∈Rn is the estimated state, y¯c,k∈Rp is the observer output, uk∈Rm is the control signal generated by the controller, uc,k is the signal received by the actuator, and L∈Rn×p and K∈Rm×n are the observer gain and controller gain, respectively. The stochastic variable β, mutually independent of δ, is also a Bernoulli distributed white sequence with expected value β¯.The parameters in physical layer,δ¯ and β¯, are defined as δ¯SIi,SI-i and β¯SIi,SI-i for depicting the internally interdependent security, since communication delay in physical layer is influenced by the cyber interactions. Once δ¯ and β¯ are determined, the H∞-optimal controller can then be designed. If the initial condition is zero, the H∞ index γ satisfies inequality (7) and can be obtained through applying Theorem 1 proposed in [26]. (8)E∑k=0∞zk2<γ2∑k=0∞wk2.The physical layer cost in this paper is denoted asJP=γ∗ which is the minimum of H∞ index γ that satisfies inequality (8). It is noted that the aim of designing an H∞-optimal controller is to minimize the closed-loop impact of a perturbation. For the attenuation rate of controlled output zk under the impact of disturbance input wk, H∞ optimal index, γ∗, represents and quantifies the control performance of physical plant. The lower the value of γ∗ is, the better the control performance physical plant is. In addition, for reflecting the influence of cyber security investment, we further refine the expression of JP by(9)JPiSI-i,SIi=γ∗SI-i,SIi=γ∗δ¯SI-i,SIi,β¯SI-i,SIi.The cyber layer cost depends on the security choice made by players. SinceSIi denotes the security choice made by player Pi, the cyber layer cost of Pi can therefore be given as JCi(SIi)=SIi·l, where l represents the cost of cyber countermeasure adopted and therefore quantifies the cyber security investment. For example, if the cyber layer is equipped with SCADA or IDS, l can be further interpreted as the computing resource occupancy ratio of a specific packet filtering policy. When Pi chooses to invest in security, the cyber layer cost would be l; otherwise it would be 0.The overall payoff function of each individual player can therefore be obtained as (10). The security issues in cyber layer and optimal control problems in physical layer are intertwined, and the payoff of each individual is therefore formulated from a more comprehensive and accurate perspective.(10)JOiSI-i,SIi=JCiSIi+JPiSI-i,SIi.We then show how to build payoff matrix for SISG. Take the two-player andm-player symmetric SISG introduced in Figures 2 and 3 as instance, the strategic form representation of which is given as shown in Tables 1 and 2, respectively.Table 1
Strategic form representation of two-player symmetric SISG.
Follower
(
I
2
,
I
2
)
I
2
,
N
I
L
N
I
L
,
I
2
N
I
L
,
N
I
L
Leader
I
1
l
1
+
J
P
∗
I
1
,
I
2,
l
1
+
J
P
∗
I
1
,
I
2,
l
1
+
J
P
∗
I
1
,
N
I
F,
l
1
+
J
P
∗
I
1
,
N
I
F,
l
2
+
J
P
∗
I
1
,
I
2
l
2
+
J
P
∗
I
1
,
I
2
J
P
∗
I
1
,
N
I
F
J
P
∗
I
1
,
N
I
F
N
I
L
J
P
∗
N
I
L
,
I
2,
J
P
∗
N
I
L
,
N
I
F,
J
P
∗
N
I
L
,
I
2,
J
P
∗
N
I
L
,
N
I
F,
l
2
+
J
P
∗
N
I
L
,
I
2
J
P
∗
N
I
L
,
N
I
F
l
2
+
J
P
∗
N
I
L
,
I
2
J
P
∗
N
I
L
,
N
I
FTable 2
Strategic form representation ofm-players symmetric SISG.
Follower
I
F
,
N
I
F
,
…
,
N
I
F
︸
m
-
1
I
F
,
I
F
,
N
I
F
,
…
,
N
I
F
︸
m
-
2
⋯
I
F
,
…
,
I
F
︸
m
-
1
,
N
I
F
Leader
ψ
L
(
ξ
=
0
)
m
-
1
⋅
l
+
J
P
∗
ψ
L
ξ
=
0
,
I
F,
m
-
1
⋅
l
+
J
P
∗
ψ
L
ξ
=
0
,
I
F,
⋯
m
-
1
⋅
l
+
J
P
∗
ψ
L
ξ
=
0
,
I
F,
l
+
J
P
∗
ψ
L
ξ
=
0
,
I
F
l
+
J
P
∗
ψ
L
ξ
=
0
,
I
F
l
+
J
P
∗
ψ
L
ξ
=
0
,
I
F
ψ
L
(
ξ
=
1
)
m
-
2
⋅
l
+
J
P
∗
ψ
L
ξ
=
1
,
N
I
F,
m
-
2
⋅
l
+
J
P
∗
ψ
L
ξ
=
1
,
I
F,
⋯
m
-
2
⋅
l
+
J
P
∗
ψ
L
ξ
=
1
,
I
F,
J
P
∗
ψ
L
ξ
=
1
,
N
I
F
l
+
J
P
∗
ψ
L
ξ
=
1
,
I
F
l
+
J
P
∗
ψ
L
ξ
=
1
,
I
F
ψ
L
(
ξ
=
2
)
m
-
3
⋅
l
+
J
P
∗
ψ
L
ξ
=
2
,
N
I
F,
m
-
3
⋅
l
+
J
P
∗
ψ
L
ξ
=
2
,
N
I
F,
⋯
m
-
3
⋅
l
+
J
P
∗
ψ
L
ξ
=
2
,
I
F,
J
P
∗
ψ
L
ξ
=
2
,
N
I
F
J
P
∗
ψ
L
ξ
=
2
,
N
I
F
l
+
J
P
∗
ψ
L
ξ
=
2
,
I
F
⋮
⋮
⋮
⋯
⋮
ψ
L
(
ξ
=
m
-
1
)
0
⋅
l
+
J
P
∗
ψ
L
ξ
=
m
-
1
,
N
I
F,
0
⋅
l
+
J
P
∗
ψ
L
ξ
=
m
-
1
,
N
I
F,
⋯
0
⋅
l
+
J
P
∗
ψ
L
ξ
=
m
-
1
,
I
F,
J
P
∗
ψ
L
ξ
=
m
-
1
,
N
I
F
J
P
∗
ψ
L
ξ
=
m
-
1
,
N
I
F
l
+
J
P
∗
ψ
L
ξ
=
m
-
1
,
I
FIn Table1, subscripts L and F indicate the leader and follower; for example, IF denotes that follower chooses to invest in security. In addition, since follower has two information sets and two available actions, four pure strategies for follower including IF,IF, IF,NIF, NIF,IF, and NIF,NIF can be implemented. IF,IF indicates the response strategy that no matter what action leader takes, he will always choose to invest in security. In addition, the upper (resp., lower) one is the payoff function of leader (resp., follower), that is, JL∗ (resp., JF∗).In Table2, m pure strategies for follower are listed. In addition, it is noted that although there actually exists 2m pure strategies, implementing pure strategy (IF,IF,NIF,…,NIF︸m-2) has the same result with that of applying (IF,NIF,IF,NIF,…,NIF︸m-3). For the convenience of denotation and analysis, only m situations are listed. It is easy for us to extend the result to asymmetric situation according to Tables 1 and 2.


### 2.3. Security Interdependence

Let each individual CPS be subjected to time-delay attacks (such as DoS, DDoS). The communication delaysδ¯i and β¯i for Pi are then modeled as follows:(11)δ¯iSIi,SI-i=1-SIi·δ¯+αnP-i∣SI-i=0·δ¯,β¯iSIi,SI-i=1-SIi·β¯︸directdelays+αnP-i∣SI-i=0·β¯︸indirectdelays,where nP-i∣SI-i=0 indicates the number of players (excluding Pi) who do not invest in security. α is the discount parameter and is assumed as a strictly increasing function with maximum and minimum being set as αn=m-1 and αn=0, where m is the total number of players. Thus, α reflects the indirect influence that insecure individual CPS has on Pi via common network.In (11), the first term reflects the direct delays caused by Pi’s decision on security investment, while the second one indicates the indirect delays from common network, which are caused by other insecure individuals.Remark 2.
Two reasonable explanations as follows indicate the soundness of (11) with respect to δ¯i and β¯i.
(1) IfPi makes a security investment against time-delay attack, part of delays can then be eliminated due to the unwillingness of rational attacker. However, it still cannot avoid the delays from common communication network caused by other individuals under attack, which corresponds to our definition in (11) that when SIi=1, both δ¯i and β¯i merely depend on the number of other insecure individuals.
(2) If one individual CPS invests in security, the overall security level of distributed CPS will therefore increase, which indicates that, with a higher number of secure individual CPSs, rational attackers will be less willing to implement time-delay attack, and then the expected value of stochastic delays will be relatively lower with both better security levels in cyber layer and control performance being obtained by each individual CPS. This is also reflected by (11), since for Pi, when SIi=1, both δ¯i and β¯i will decrease, and meanwhile for P-i, α reduces with the decrement of the number of insecure individuals, nP-i∣SI-i=0.


## 2.1. Stackelberg Interdependent Security Game

Firstly, the definition of interdependent security game is given as follows.Definition 1 (interdependent security game).
In an interdependent security game, the players are selfish but nonmalicious and are able to choose whether to invest in security or remain unprotected. Each player’s goal is to minimize his own risk, which depends on the investments of some or every other players who also aim to minimize their own costs.We firstly consider the situation that all the players (individual CPSs) are identical and the corresponding Stackelberg interdependent security game (SISG) is therefore called symmetric SISG. The extensive form representation of two-player andm-player symmetric SISG is as shown in Figures 2 and 3, respectively.Figure 2
Extensive form representation of two-player symmetric SISG.Figure 3
Extensive form representation ofm-player symmetric SISG.In two-player symmetric SISG as described in Figure2, leader chooses to invest or not invest in security at first, and then follower makes an optimal response for minimizing his own payoff. In m-player SISG as described in Figure 3, the players other than Pi, who are assumed to act simultaneously, are regarded as leader. ψLξ denotes the strategy of leader with ξ representing the number of insecure individuals, that is, the players who do not make a security investment. Furthermore, m is the total number of players. After the strategy of P-i, ψLξ, being determined, the follower, Pi, chooses an optimal strategy for minimizing his own payoff. Based on Figures 2 and 3, it would be easy to extend the symmetric SISG to the situation that the amount of defense investment choices of all the players is more than two.It is noted that, in the symmetric SISG given by Figures2 and 3, all of the players (individual CPSs) are supposed to be identical. The action space defined for each CPS is the same and includes “invest” or “not invest” with the different defense resources implemented on each CPS being ignored. In practical security scenarios such as Stuxnet worm [2], Flame virus [4], and Water Plant Breach [5], the rational attackers are always familiar with the fingerprint characteristic of CPS, which indicates that they are capable of accurately parsing the command message and find the target devices even in the complicated hierarchical and distributed framework. Naturally, it is supposed that different attack strategy would be implemented for different target devices and thus each CPS is faced with different types of cyber attacks. Under this circumstance, the players (individual CPSs) of SISG should be considered as nonidentical.The extensive form representations of asymmetric SISG for two-player andm-player are given in Figures 4 and 5, respectively, where different types of defense investment are considered for each player. In Figure 4, I1 and I2 represent different types of defense investment of each player. In Figure 5, I1,Lj (j≠i) indicates that the defense investment implemented by the jth leader is I1.Figure 4
Extensive form representation of two-player asymmetric SISG.Figure 5
Extensive form representation ofm-player asymmetric SISG.Based on Figures4 and 5, it is easy to extend the situations to more complicated ones, such as the situation that amount of defense investment choices of each player is more than two.


## 2.2. Cross-Layer Payoff Function

For better characterizing the SISG, we formulate payoff function from a cross-layer perspective, that is, taking factors of both cyber layer and physical layer into consideration.Each individual CPS is viewed as a playerPi(i∈M), where M is the set of all players. Each player aims to minimize his own overall payoff for maintaining a relatively higher security level and better control performance.In cyber layer,Pi is able to decide whether to invest in security or not and SIi is denoted as the security choice made by Pi,(1)SIi≔1,Piinvests  in  security,0,Pidoes  not  invest  in  security.The security choices made by all players can therefore be denoted asSI≔SI1,…,SIi,…,SIm, and thus the cyber layer cost of Pi is given by(2)JCiSIi≔SIi·l,i∈M.The physical plant of each individual CPS is described by discrete-time model, which is assumed to be in the form as follows:(3)xk+1=Axk+B2uc,k+B1ωk,zk=Dxk,where xk∈Rn is the system state, uc,k∈Rm is the control input, zk∈Rr is the controlled output, ωk∈Rq is the disturbance input belonging to l2[0,∞), A, B1, B2, and D are known real matrices with appropriate dimensions.The randomly varying communication delays are described by(4)yk=Cxk,yc,k=1-δyk+δyk-1,uk=Kx^k,uc,k=1-βuk+βuk-1,where yc,k∈Rp is the measured output and yk∈Rp is the actual output. uk∈Rm is the control signal generated by the controller and uc,k is the signal received by the actuator. δ and β are both communication delays.In practical engineering scenario, such as controlling the PWM inverter for an uninterrupted power system (UPS) through network, the output AC voltage data measured by sensor and then collected by PLC corresponds toyc,k, while the actual output AC voltage corresponds to yk. uk is the control command for the PWM inverter, while uc,k is the control signal received by the PWM inverter. δ (resp., β) can be interpreted as the communication delay on sensor-to-controller (resp., controller-to-actuator) channel as shown in Figure 6.Figure 6
Structure of CPS with C-A and S-C delays.The stochastic variable is considered as Bernoulli distributed white sequence with(5)δ¯=Pr⁡δ=1=Eδ,Pr⁡δ=0=1-Eδ=1-δ¯.According to (4), it is noted that when δ=1 (resp., δ=0), yc,k=yk-1 (resp., yc,k=yk) indicates that the last sensor command is not received (or received) by the controller at k, and when β=1 (resp., β=0), uc,k=uk-1 (resp., uc,k=uk) indicates that the last control command is not received (or received) by the actuator at k. The influence that time-delay attacker exerts on system control can therefore be embodied by packet losses happened in the last step.More specifically, taking typical time-delay attack, DoS attacks, into consideration, we can view bothδ¯ and β¯ as intensity-of-attack (IoA) on S-C and C-A communication channel, respectively. According to Xu et al. [23], DoS attacks can degrade the channel quality which leads to the packet losses and thus lowers package delivery rate (PDR). The corresponding H∞-optimal control problem under DoS attacks should be able to address the issue of packet losses which is also common in traditional network control system (NCS) [24, 25].Here we use the dynamic observer-based control scheme [26] for the system described by (3):(6)Observer:x^k+1=Ax^k+B2uc,k+Lyc,k-y¯c,k,y¯c,k=1-δ¯Cx^k+δ¯Cx^k-1,(7)Controller:uk=Kx^k,u¯c,k=1-β¯uk+β¯uk-1,where x^k∈Rn is the estimated state, y¯c,k∈Rp is the observer output, uk∈Rm is the control signal generated by the controller, uc,k is the signal received by the actuator, and L∈Rn×p and K∈Rm×n are the observer gain and controller gain, respectively. The stochastic variable β, mutually independent of δ, is also a Bernoulli distributed white sequence with expected value β¯.The parameters in physical layer,δ¯ and β¯, are defined as δ¯SIi,SI-i and β¯SIi,SI-i for depicting the internally interdependent security, since communication delay in physical layer is influenced by the cyber interactions. Once δ¯ and β¯ are determined, the H∞-optimal controller can then be designed. If the initial condition is zero, the H∞ index γ satisfies inequality (7) and can be obtained through applying Theorem 1 proposed in [26]. (8)E∑k=0∞zk2<γ2∑k=0∞wk2.The physical layer cost in this paper is denoted asJP=γ∗ which is the minimum of H∞ index γ that satisfies inequality (8). It is noted that the aim of designing an H∞-optimal controller is to minimize the closed-loop impact of a perturbation. For the attenuation rate of controlled output zk under the impact of disturbance input wk, H∞ optimal index, γ∗, represents and quantifies the control performance of physical plant. The lower the value of γ∗ is, the better the control performance physical plant is. In addition, for reflecting the influence of cyber security investment, we further refine the expression of JP by(9)JPiSI-i,SIi=γ∗SI-i,SIi=γ∗δ¯SI-i,SIi,β¯SI-i,SIi.The cyber layer cost depends on the security choice made by players. SinceSIi denotes the security choice made by player Pi, the cyber layer cost of Pi can therefore be given as JCi(SIi)=SIi·l, where l represents the cost of cyber countermeasure adopted and therefore quantifies the cyber security investment. For example, if the cyber layer is equipped with SCADA or IDS, l can be further interpreted as the computing resource occupancy ratio of a specific packet filtering policy. When Pi chooses to invest in security, the cyber layer cost would be l; otherwise it would be 0.The overall payoff function of each individual player can therefore be obtained as (10). The security issues in cyber layer and optimal control problems in physical layer are intertwined, and the payoff of each individual is therefore formulated from a more comprehensive and accurate perspective.(10)JOiSI-i,SIi=JCiSIi+JPiSI-i,SIi.We then show how to build payoff matrix for SISG. Take the two-player andm-player symmetric SISG introduced in Figures 2 and 3 as instance, the strategic form representation of which is given as shown in Tables 1 and 2, respectively.Table 1
Strategic form representation of two-player symmetric SISG.
Follower
(
I
2
,
I
2
)
I
2
,
N
I
L
N
I
L
,
I
2
N
I
L
,
N
I
L
Leader
I
1
l
1
+
J
P
∗
I
1
,
I
2,
l
1
+
J
P
∗
I
1
,
I
2,
l
1
+
J
P
∗
I
1
,
N
I
F,
l
1
+
J
P
∗
I
1
,
N
I
F,
l
2
+
J
P
∗
I
1
,
I
2
l
2
+
J
P
∗
I
1
,
I
2
J
P
∗
I
1
,
N
I
F
J
P
∗
I
1
,
N
I
F
N
I
L
J
P
∗
N
I
L
,
I
2,
J
P
∗
N
I
L
,
N
I
F,
J
P
∗
N
I
L
,
I
2,
J
P
∗
N
I
L
,
N
I
F,
l
2
+
J
P
∗
N
I
L
,
I
2
J
P
∗
N
I
L
,
N
I
F
l
2
+
J
P
∗
N
I
L
,
I
2
J
P
∗
N
I
L
,
N
I
FTable 2
Strategic form representation ofm-players symmetric SISG.
Follower
I
F
,
N
I
F
,
…
,
N
I
F
︸
m
-
1
I
F
,
I
F
,
N
I
F
,
…
,
N
I
F
︸
m
-
2
⋯
I
F
,
…
,
I
F
︸
m
-
1
,
N
I
F
Leader
ψ
L
(
ξ
=
0
)
m
-
1
⋅
l
+
J
P
∗
ψ
L
ξ
=
0
,
I
F,
m
-
1
⋅
l
+
J
P
∗
ψ
L
ξ
=
0
,
I
F,
⋯
m
-
1
⋅
l
+
J
P
∗
ψ
L
ξ
=
0
,
I
F,
l
+
J
P
∗
ψ
L
ξ
=
0
,
I
F
l
+
J
P
∗
ψ
L
ξ
=
0
,
I
F
l
+
J
P
∗
ψ
L
ξ
=
0
,
I
F
ψ
L
(
ξ
=
1
)
m
-
2
⋅
l
+
J
P
∗
ψ
L
ξ
=
1
,
N
I
F,
m
-
2
⋅
l
+
J
P
∗
ψ
L
ξ
=
1
,
I
F,
⋯
m
-
2
⋅
l
+
J
P
∗
ψ
L
ξ
=
1
,
I
F,
J
P
∗
ψ
L
ξ
=
1
,
N
I
F
l
+
J
P
∗
ψ
L
ξ
=
1
,
I
F
l
+
J
P
∗
ψ
L
ξ
=
1
,
I
F
ψ
L
(
ξ
=
2
)
m
-
3
⋅
l
+
J
P
∗
ψ
L
ξ
=
2
,
N
I
F,
m
-
3
⋅
l
+
J
P
∗
ψ
L
ξ
=
2
,
N
I
F,
⋯
m
-
3
⋅
l
+
J
P
∗
ψ
L
ξ
=
2
,
I
F,
J
P
∗
ψ
L
ξ
=
2
,
N
I
F
J
P
∗
ψ
L
ξ
=
2
,
N
I
F
l
+
J
P
∗
ψ
L
ξ
=
2
,
I
F
⋮
⋮
⋮
⋯
⋮
ψ
L
(
ξ
=
m
-
1
)
0
⋅
l
+
J
P
∗
ψ
L
ξ
=
m
-
1
,
N
I
F,
0
⋅
l
+
J
P
∗
ψ
L
ξ
=
m
-
1
,
N
I
F,
⋯
0
⋅
l
+
J
P
∗
ψ
L
ξ
=
m
-
1
,
I
F,
J
P
∗
ψ
L
ξ
=
m
-
1
,
N
I
F
J
P
∗
ψ
L
ξ
=
m
-
1
,
N
I
F
l
+
J
P
∗
ψ
L
ξ
=
m
-
1
,
I
FIn Table1, subscripts L and F indicate the leader and follower; for example, IF denotes that follower chooses to invest in security. In addition, since follower has two information sets and two available actions, four pure strategies for follower including IF,IF, IF,NIF, NIF,IF, and NIF,NIF can be implemented. IF,IF indicates the response strategy that no matter what action leader takes, he will always choose to invest in security. In addition, the upper (resp., lower) one is the payoff function of leader (resp., follower), that is, JL∗ (resp., JF∗).In Table2, m pure strategies for follower are listed. In addition, it is noted that although there actually exists 2m pure strategies, implementing pure strategy (IF,IF,NIF,…,NIF︸m-2) has the same result with that of applying (IF,NIF,IF,NIF,…,NIF︸m-3). For the convenience of denotation and analysis, only m situations are listed. It is easy for us to extend the result to asymmetric situation according to Tables 1 and 2.


## 2.3. Security Interdependence

Let each individual CPS be subjected to time-delay attacks (such as DoS, DDoS). The communication delaysδ¯i and β¯i for Pi are then modeled as follows:(11)δ¯iSIi,SI-i=1-SIi·δ¯+αnP-i∣SI-i=0·δ¯,β¯iSIi,SI-i=1-SIi·β¯︸directdelays+αnP-i∣SI-i=0·β¯︸indirectdelays,where nP-i∣SI-i=0 indicates the number of players (excluding Pi) who do not invest in security. α is the discount parameter and is assumed as a strictly increasing function with maximum and minimum being set as αn=m-1 and αn=0, where m is the total number of players. Thus, α reflects the indirect influence that insecure individual CPS has on Pi via common network.In (11), the first term reflects the direct delays caused by Pi’s decision on security investment, while the second one indicates the indirect delays from common network, which are caused by other insecure individuals.Remark 2.
Two reasonable explanations as follows indicate the soundness of (11) with respect to δ¯i and β¯i.
(1) IfPi makes a security investment against time-delay attack, part of delays can then be eliminated due to the unwillingness of rational attacker. However, it still cannot avoid the delays from common communication network caused by other individuals under attack, which corresponds to our definition in (11) that when SIi=1, both δ¯i and β¯i merely depend on the number of other insecure individuals.
(2) If one individual CPS invests in security, the overall security level of distributed CPS will therefore increase, which indicates that, with a higher number of secure individual CPSs, rational attackers will be less willing to implement time-delay attack, and then the expected value of stochastic delays will be relatively lower with both better security levels in cyber layer and control performance being obtained by each individual CPS. This is also reflected by (11), since for Pi, when SIi=1, both δ¯i and β¯i will decrease, and meanwhile for P-i, α reduces with the decrement of the number of insecure individuals, nP-i∣SI-i=0.


## 3. Pure-Strategy Equilibria Analysis for Two-Player SISG

As the SISG we describe is game of complete information, pure-strategy equilibria always exist, and the pure-strategy equilibria for both two-player symmetric and asymmetric SISG are analyzed in this section, while that ofm-player SISG will also be discussed for both symmetric and asymmetric situation in the next section.


### 3.1. Pure-Strategy Equilibria for Two-Player Symmetric SISG

Theorem 3.
In two-player symmetric SISG, pure-strategy subgame perfect Nash equilibria (SPNE) will always exist and are symmetric. Depending on different value ofl∈R+,(1)
whenJP∗NIL,IF-JP∗IL,IF≤JP∗NIL,NIF-JP∗NIL,IF, the SPNE is(12)NIL,NIF,ifl>lmax1NIL,IF,iflmin1<l⩽lmax1IL,IForNIL,IFifl=lmin1IL,IF,ifl<lmin1,(2)
whenJP∗NIL,IF-JP∗IL,IF>JP∗NIL,NIF-JP∗NIL,IF, the SPNE is(13)NIL,NIFifl>lmax2IL,IFifl⩽lmax2,where lmax1=JP∗NIL,NIF-JP∗NIL,IF, lmin1=JP∗NIL,IF-JP∗IL,IF, and lmax2=JP∗NIL,IF-JP∗IL,IF.In addition, we further explore the preference of administrator (social planner) seeking for social optimum, that is, minimizing overall payoff of the distributed CPSs. Since three SPNE are possibly reached, we derive social payoff under each strategy pair, as shown in Table3.Table 3
Social payoff for two-player symmetric SISG.
Strategy pair
Overall payoff
{IL,IF}
J
S
o
c
i
a
l
∗
I
L
,
I
F
=
2
⋅
J
P
∗
I
L
,
I
F
+
l
{NIL,IF}
J
S
o
c
i
a
l
∗
N
I
L
,
I
F
=
2
⋅
J
P
∗
N
I
L
,
I
F
+
l
{IL,NIF}
J
S
o
c
i
a
l
∗
I
L
,
N
I
F
=
2
⋅
J
P
∗
I
L
,
N
I
F
+
l
{NIL,NIF}
J
S
o
c
i
a
l
∗
N
I
L
,
N
I
F
=
2
⋅
J
P
∗
N
I
L
,
N
I
FSinceJSocial∗{NIL,IF} is equal to JSocial∗{IL,NIF}, we firstly derive three critical points, l1=2·JP∗NIL,IF-JP∗IL,IF, l2=2·JP∗NIL,NIF-JP∗NIL,IF, and l3=JP∗NIL,NIF-JP∗IL,IF, at which we have JS∗{IL,IF}=JS∗{NIL,IF}, JS∗{NIL,IF}=JS∗{NIL,NIF}, and JS∗{IL,IF}=JS∗{NIL,NIF}. According to Theorem 3, two situations for social optimum are discussed.(1) WhenJP∗NIL,IF-JP∗IL,IF<JP∗NIL,NIF-JP∗NIL,IF is satisfied, we have l1<l3<l2, and the socially optimum choices are as shown in Table 4. The relationship between socially and individually optimal choices is directly reflected in Figure 7, through which the strategic gap is clearly distinguished. It is noted that, in Figure 7(a), l1′=l1>lmax1, while, in Figure 7(b), l1′′=l1<lmax1.Table 4
Socially optimal choices for different magnitude ofl.
Magnitude ofl
Socially optimum choice
l⩾max⁡l1,l2>l3>min⁡l1,l2
N
I
L
,
N
I
F
max⁡l1,l2>l⩾l3>min⁡l1,l2
N
I
L
,
I
F
max⁡l1,l2>l3>l⩾min⁡l1,l2
N
I
L
,
I
F
max⁡l1,l2>l3>min⁡l1,l2>l
I
L
,
I
FFigure 7
The relationship between socially and individually optimal choices in two-player symmetric SISG.
(a)
(b)
(c)
(d)(2) WhenJP∗NIL,IF-JP∗IL,IF>JP∗NIL,NIF-JP∗NIL,IF is satisfied, we have l2<l3<l1, and socially, individually optimal choices and their relationship are also as shown in Table 4 and Figure 7. It is noted that, in Figure 7(c), l2′=l2>lmax2, while, in Figure 7(d), l2′′=l2<lmax2.


### 3.2. Pure-Strategy Equilibria for Two-Player Asymmetric SISG

We then further analyze the pure-strategy equilibria for two-player asymmetric SISG as given in Figure4. Similar with building game matrix for two-player symmetric SISG, the strategic form representation of two-player asymmetric SISG is given in Table 5 where I1 and I2 are different types of security investment, the cost of which is l1 and l2, respectively.Table 5
Strategic form representation of two-player asymmetric SISG.
Follower
(
I
2
,
I
2
)
I
2
,
N
I
L
N
I
L
,
I
2
N
I
L
,
N
I
L
Leader
I
1
l
1
+
J
P
∗
I
1
,
I
2,
l
1
+
J
P
∗
I
1
,
I
2,
l
1
+
J
P
∗
I
1
,
N
I
F,
l
1
+
J
P
∗
I
1
,
N
I
F,
l
2
+
J
P
∗
I
1
,
I
2
l
2
+
J
P
∗
I
1
,
I
2
J
P
∗
I
1
,
N
I
F
J
P
∗
I
1
,
N
I
F
N
I
L
J
P
∗
N
I
L
,
I
2,
J
P
∗
N
I
L
,
N
I
F,
J
P
∗
N
I
L
,
I
2,
J
P
∗
N
I
L
,
N
I
F,
l
2
+
J
P
∗
N
I
L
,
I
2
J
P
∗
N
I
L
,
N
I
F
l
2
+
J
P
∗
N
I
L
,
I
2
J
P
∗
N
I
L
,
N
I
FThe following theorem concerning equilibria of two-player asymmetric SISG is put forward for obtaining the individually optimal choice, which is given in the form of the solution of SPNE.Theorem 4.
In two-player asymmetric SISG, pure-strategy subgame perfect Nash equilibria (SPNE) will always exist. Depending on different value ofl1,l2∈R+,(1)
whenJP∗I1,NIF-JP∗I1,I2≤JP∗NIL,NIF-JP∗NIL,I2, the SPNE is (14)NIL,NIFifl2>Bl1>EI1,NIFifl2>Bl1≤EorA<l2≤Bl1≤CNIL,I2ifA<l2≤Bl1>Corl2≤Al1>DI1,I2ifl2≤Al1≤Dorl2≤Al1>D,(2)
whenJP∗I1,NIF-JP∗I1,I2>JP∗NIL,NIF-JP∗NIL,I2, the SPNE is(15)NIL,NIFifl2>Al1>EorB<l2≤Al1>FI1,NIFifl2>Al1≤ENIL,I2ifl2≤Bl1>DI1,I2ifB<l2≤Al1<Forl2≤Bl1≤D,where A=JP∗I1,NIF-JP∗I1,I2, B=JP∗NIL,NIF-JP∗NIL,I2, C=JP∗NIL,I2-JP∗I1,NIF, D=JP∗NIL,I2-JP∗I1,I2, E=JP∗NIL,NIF-JP∗I1,NIF, and F=JP∗NIL,NIF-JP∗I1,I2.The conclusions made in Theorem4 can be vividly reflected in the form of two-dimension figures as shown in Figures 8 and 9 where we can clearly distinguish the different SPNE with corresponding conditions.Figure 8
The SPNE of two-player asymmetric SISG whenA≤B.Figure 9
The SPNE of two-player asymmetric SISG whenA>B.The optimal choices for social planner in two-player asymmetric SISG are further explored. We derive social payoff under each strategy pair, as shown in Table6.Table 6
Social payoff for two-player asymmetric SISG.
Magnitude ofl
Socially optimum choice
{I1,I2}
JSocial∗I1,I2=l1+l2+2⋅JP∗I1,I2
{NIL,I2}
JSocial∗NIL,IF=l2+2⋅JP∗NIL,I2
{I1,NIF}
JSocial∗I1,NIF=l1+2⋅JP∗I1,NIF
{NIL,NIF}
JSocial∗NIL,NIF=2⋅JP∗NIL,NIFAccording to Theorem4, two situations are discussed.(1)
WhenJP∗I1,NIF-JP∗I1,I2≤JP∗NIL,NIF-JP∗NIL,I2 is satisfied, the socially optimum choices are as shown in Table 7. The relationship between socially and individually optimal choices is directly reflected in Figure 10 where the coincident strategy area is highlighted by red blocks and the rest area denotes the strategy gap between individual and social players.(2)
WhenJP∗I1,NIF-JP∗I1,I2>JP∗NIL,NIF-JP∗NIL,I2 is satisfied, the socially optimum choices are as shown in Table 8. The relationship between socially and individually optimal choices is directly reflected in Figure 11 where the coincident strategy area is highlighted by red blocks and the rest area denotes the strategy gap between individual and social players.Table 7
Socially optimal choices in two-player asymmetric SISG_1.
Magnitude ofl1
Magnitude ofl2
Socially optimum choice
l
1
>
2
E
l2>2B
N
I
L
,
N
I
F
l1≤2E
I
1
,
N
I
F
l1>l2+2C
2A<l2≤2B
N
I
L
,
I
2
l1≤l2+2C
I
1
,
N
I
F
l1>2D
l2≤2A
N
I
L
,
I
2
l1≤2D
I
1
,
I
2Table 8
Socially optimal choices in two-player asymmetric SISG_2.
Magnitude ofl1
Magnitude ofl2
Socially optimum choice
l
1
>
2
E
l2>2A
N
I
L
,
N
I
F
l1≤2E
I
1
,
N
I
F
l1>2F-l2
2B<l2≤2A
N
I
L
,
N
I
F
l1≤2F-l2
I
1
,
I
2
l1>2D
l2≤2B
N
I
L
,
I
2
l1≤2D
I
1
,
I
2Figure 10
The relationship between socially and individually optimal choices in two-player asymmetric SISG_1.Figure 11
The relationship between socially and individually optimal choices in two-player asymmetric SISG_2.


## 3.1. Pure-Strategy Equilibria for Two-Player Symmetric SISG

Theorem 3.
In two-player symmetric SISG, pure-strategy subgame perfect Nash equilibria (SPNE) will always exist and are symmetric. Depending on different value ofl∈R+,(1)
whenJP∗NIL,IF-JP∗IL,IF≤JP∗NIL,NIF-JP∗NIL,IF, the SPNE is(12)NIL,NIF,ifl>lmax1NIL,IF,iflmin1<l⩽lmax1IL,IForNIL,IFifl=lmin1IL,IF,ifl<lmin1,(2)
whenJP∗NIL,IF-JP∗IL,IF>JP∗NIL,NIF-JP∗NIL,IF, the SPNE is(13)NIL,NIFifl>lmax2IL,IFifl⩽lmax2,where lmax1=JP∗NIL,NIF-JP∗NIL,IF, lmin1=JP∗NIL,IF-JP∗IL,IF, and lmax2=JP∗NIL,IF-JP∗IL,IF.In addition, we further explore the preference of administrator (social planner) seeking for social optimum, that is, minimizing overall payoff of the distributed CPSs. Since three SPNE are possibly reached, we derive social payoff under each strategy pair, as shown in Table3.Table 3
Social payoff for two-player symmetric SISG.
Strategy pair
Overall payoff
{IL,IF}
J
S
o
c
i
a
l
∗
I
L
,
I
F
=
2
⋅
J
P
∗
I
L
,
I
F
+
l
{NIL,IF}
J
S
o
c
i
a
l
∗
N
I
L
,
I
F
=
2
⋅
J
P
∗
N
I
L
,
I
F
+
l
{IL,NIF}
J
S
o
c
i
a
l
∗
I
L
,
N
I
F
=
2
⋅
J
P
∗
I
L
,
N
I
F
+
l
{NIL,NIF}
J
S
o
c
i
a
l
∗
N
I
L
,
N
I
F
=
2
⋅
J
P
∗
N
I
L
,
N
I
FSinceJSocial∗{NIL,IF} is equal to JSocial∗{IL,NIF}, we firstly derive three critical points, l1=2·JP∗NIL,IF-JP∗IL,IF, l2=2·JP∗NIL,NIF-JP∗NIL,IF, and l3=JP∗NIL,NIF-JP∗IL,IF, at which we have JS∗{IL,IF}=JS∗{NIL,IF}, JS∗{NIL,IF}=JS∗{NIL,NIF}, and JS∗{IL,IF}=JS∗{NIL,NIF}. According to Theorem 3, two situations for social optimum are discussed.(1) WhenJP∗NIL,IF-JP∗IL,IF<JP∗NIL,NIF-JP∗NIL,IF is satisfied, we have l1<l3<l2, and the socially optimum choices are as shown in Table 4. The relationship between socially and individually optimal choices is directly reflected in Figure 7, through which the strategic gap is clearly distinguished. It is noted that, in Figure 7(a), l1′=l1>lmax1, while, in Figure 7(b), l1′′=l1<lmax1.Table 4
Socially optimal choices for different magnitude ofl.
Magnitude ofl
Socially optimum choice
l⩾max⁡l1,l2>l3>min⁡l1,l2
N
I
L
,
N
I
F
max⁡l1,l2>l⩾l3>min⁡l1,l2
N
I
L
,
I
F
max⁡l1,l2>l3>l⩾min⁡l1,l2
N
I
L
,
I
F
max⁡l1,l2>l3>min⁡l1,l2>l
I
L
,
I
FFigure 7
The relationship between socially and individually optimal choices in two-player symmetric SISG.
(a)
(b)
(c)
(d)(2) WhenJP∗NIL,IF-JP∗IL,IF>JP∗NIL,NIF-JP∗NIL,IF is satisfied, we have l2<l3<l1, and socially, individually optimal choices and their relationship are also as shown in Table 4 and Figure 7. It is noted that, in Figure 7(c), l2′=l2>lmax2, while, in Figure 7(d), l2′′=l2<lmax2.


## 3.2. Pure-Strategy Equilibria for Two-Player Asymmetric SISG

We then further analyze the pure-strategy equilibria for two-player asymmetric SISG as given in Figure4. Similar with building game matrix for two-player symmetric SISG, the strategic form representation of two-player asymmetric SISG is given in Table 5 where I1 and I2 are different types of security investment, the cost of which is l1 and l2, respectively.Table 5
Strategic form representation of two-player asymmetric SISG.
Follower
(
I
2
,
I
2
)
I
2
,
N
I
L
N
I
L
,
I
2
N
I
L
,
N
I
L
Leader
I
1
l
1
+
J
P
∗
I
1
,
I
2,
l
1
+
J
P
∗
I
1
,
I
2,
l
1
+
J
P
∗
I
1
,
N
I
F,
l
1
+
J
P
∗
I
1
,
N
I
F,
l
2
+
J
P
∗
I
1
,
I
2
l
2
+
J
P
∗
I
1
,
I
2
J
P
∗
I
1
,
N
I
F
J
P
∗
I
1
,
N
I
F
N
I
L
J
P
∗
N
I
L
,
I
2,
J
P
∗
N
I
L
,
N
I
F,
J
P
∗
N
I
L
,
I
2,
J
P
∗
N
I
L
,
N
I
F,
l
2
+
J
P
∗
N
I
L
,
I
2
J
P
∗
N
I
L
,
N
I
F
l
2
+
J
P
∗
N
I
L
,
I
2
J
P
∗
N
I
L
,
N
I
FThe following theorem concerning equilibria of two-player asymmetric SISG is put forward for obtaining the individually optimal choice, which is given in the form of the solution of SPNE.Theorem 4.
In two-player asymmetric SISG, pure-strategy subgame perfect Nash equilibria (SPNE) will always exist. Depending on different value ofl1,l2∈R+,(1)
whenJP∗I1,NIF-JP∗I1,I2≤JP∗NIL,NIF-JP∗NIL,I2, the SPNE is (14)NIL,NIFifl2>Bl1>EI1,NIFifl2>Bl1≤EorA<l2≤Bl1≤CNIL,I2ifA<l2≤Bl1>Corl2≤Al1>DI1,I2ifl2≤Al1≤Dorl2≤Al1>D,(2)
whenJP∗I1,NIF-JP∗I1,I2>JP∗NIL,NIF-JP∗NIL,I2, the SPNE is(15)NIL,NIFifl2>Al1>EorB<l2≤Al1>FI1,NIFifl2>Al1≤ENIL,I2ifl2≤Bl1>DI1,I2ifB<l2≤Al1<Forl2≤Bl1≤D,where A=JP∗I1,NIF-JP∗I1,I2, B=JP∗NIL,NIF-JP∗NIL,I2, C=JP∗NIL,I2-JP∗I1,NIF, D=JP∗NIL,I2-JP∗I1,I2, E=JP∗NIL,NIF-JP∗I1,NIF, and F=JP∗NIL,NIF-JP∗I1,I2.The conclusions made in Theorem4 can be vividly reflected in the form of two-dimension figures as shown in Figures 8 and 9 where we can clearly distinguish the different SPNE with corresponding conditions.Figure 8
The SPNE of two-player asymmetric SISG whenA≤B.Figure 9
The SPNE of two-player asymmetric SISG whenA>B.The optimal choices for social planner in two-player asymmetric SISG are further explored. We derive social payoff under each strategy pair, as shown in Table6.Table 6
Social payoff for two-player asymmetric SISG.
Magnitude ofl
Socially optimum choice
{I1,I2}
JSocial∗I1,I2=l1+l2+2⋅JP∗I1,I2
{NIL,I2}
JSocial∗NIL,IF=l2+2⋅JP∗NIL,I2
{I1,NIF}
JSocial∗I1,NIF=l1+2⋅JP∗I1,NIF
{NIL,NIF}
JSocial∗NIL,NIF=2⋅JP∗NIL,NIFAccording to Theorem4, two situations are discussed.(1)
WhenJP∗I1,NIF-JP∗I1,I2≤JP∗NIL,NIF-JP∗NIL,I2 is satisfied, the socially optimum choices are as shown in Table 7. The relationship between socially and individually optimal choices is directly reflected in Figure 10 where the coincident strategy area is highlighted by red blocks and the rest area denotes the strategy gap between individual and social players.(2)
WhenJP∗I1,NIF-JP∗I1,I2>JP∗NIL,NIF-JP∗NIL,I2 is satisfied, the socially optimum choices are as shown in Table 8. The relationship between socially and individually optimal choices is directly reflected in Figure 11 where the coincident strategy area is highlighted by red blocks and the rest area denotes the strategy gap between individual and social players.Table 7
Socially optimal choices in two-player asymmetric SISG_1.
Magnitude ofl1
Magnitude ofl2
Socially optimum choice
l
1
>
2
E
l2>2B
N
I
L
,
N
I
F
l1≤2E
I
1
,
N
I
F
l1>l2+2C
2A<l2≤2B
N
I
L
,
I
2
l1≤l2+2C
I
1
,
N
I
F
l1>2D
l2≤2A
N
I
L
,
I
2
l1≤2D
I
1
,
I
2Table 8
Socially optimal choices in two-player asymmetric SISG_2.
Magnitude ofl1
Magnitude ofl2
Socially optimum choice
l
1
>
2
E
l2>2A
N
I
L
,
N
I
F
l1≤2E
I
1
,
N
I
F
l1>2F-l2
2B<l2≤2A
N
I
L
,
N
I
F
l1≤2F-l2
I
1
,
I
2
l1>2D
l2≤2B
N
I
L
,
I
2
l1≤2D
I
1
,
I
2Figure 10
The relationship between socially and individually optimal choices in two-player asymmetric SISG_1.Figure 11
The relationship between socially and individually optimal choices in two-player asymmetric SISG_2.


## 4. Pure-Strategy Equilibria Analysis form-Player SISG

In this section, we show how to extend the theorems concerning pure-strategy equilibria to the situation ofm-player SISG. Firstly, in the m-player (m>2) symmetric SISG, the SPNE is proved to exist with the corresponding analytical solutions being obtained. Moreover, the socially optimal choices are discussed, and at last the relationship between socially and individually optimal choices is studied with the strategy gap being characterized. According to Figure 5, the theorem concerning m-player symmetric SISG can be easily extended to the asymmetric.Thus, we considerm-player (m>2) symmetric SISG that all the players excluding Pi act simultaneously, and then according to the strategy chosen by P-i, Pi decides his own optimal strategy.ξ is used for denoting the number of insecure players excluding Pi, while ψL(ξ)={IL1,IL2,…,ILi-1︸m-ξ-1,NILi+1,NILi+2,…,NILm︸ξ} characterizes the strategy of P-i.Theorem 5.
Inm-player m>2 SISG, a pure-strategy subgame perfect Nash equilibrium (SPNE) will always exists. Depending on different value of l∈R+,(1)
whenΔ0>Δ1>Δ2>⋯>Δm-2>Δm-1, the SPNE is(16)ψLξ=m-1,NIFifl⩾Δ0orΔ0>l>ϖ1ψLξ=m-1,NIForψLξ=0,IFifl=ϖ1ψLξ=0,IFifl⩽Δm-1orϖ1>l>Δm-1,(2)
whenΔ0<Δ1<Δ2<⋯<Δm-2<Δm-1, the SPNE is (17)ψLξ=0,IFifl⩽Δ0ψLξ=α-1,NIFifΔα-1<l<ϖ2αψLξ=α-1,NIForψLξ=α,IFifl=ϖ2αψLξ=α,IFifϖ2α<l<ΔαψLξ=m-1,NIFifl⩾Δm-1,where Δξ=JP∗ψL(ξ),NIF-JP∗ψL(ξ),IF, ξ∈0,m-1, ϖ1=JP∗ψL(ξ=m-1),NIF-JP∗ψL(ξ=0),IF/m-1, and ϖ2α=JP∗ψL(ξ=α),IF-JP∗ψL(ξ=α-1),NIF, α∈1,m-1.We then further discuss the socially optimal choices form-player symmetric SISG. The payoff function of administrator is denoted in (18). Analogous to the analysis of individually optimal choice, two situations are considered.(18)JSocialη=η·l+JP∗ψLξ=m-η,IF,η∈1,m0·l+JP∗ψLξ=m-1,NIF,η=0,where η is the total number of players making investment in security.Situation 1.
One hasΔ0>Δ1>⋯>Δi>⋯>Δm-1.
Case  1. One has l⩾Δ0>Δ1>⋯>Δi>⋯>Δm-1, i∈0,m-1.
In accordance with inequality (19), JSocial0 is the minimum of social cost, and thus JP∗ψL(ξ=m-1),NIF is the optimal choice for administrator if l⩾Δ0.(19)JSocialη′-JSocialη′-1=l+JP∗ψLξ=m-η′,IF-JP∗ψLξ=m-η′+1,IF>Δm-η′+JP∗ψLξ=m-η′,IF-JP∗ψLξ=m-η′+1,IF=0,JSocial1-JSocial0=l+JP∗ψLξ=m-1,IF-JP∗ψLξ=m-1,NIF>Δm-1+JP∗ψLξ=m-1,IF-JP∗ψLξ=m-1,NIF=0.
Case  2. One has Δ0>Δ1>⋯>Δα-1>l>Δα>⋯>Δm-1, α∈1,m-1.
In Case  2,JSocialη is an increasing (resp., decreasing) function when 1⩽η⩽m-1-α (resp., m⩾η⩾m-α) with the minimum being determined as JSocial1 (resp., JSocialm). By comparing the value of JSocial0, JSocial1, and JSocialm under different magnitude of l, the socially minimal cost is derived as follows: (20)minJSocial0,JSocial1,JSocialm=JSocial0,l⩾ϖ3JSocialm,ϖ4⩽l<ϖ3JSocialm,l<ϖ4,where ϖ3=JP∗ψL(ξ=m-1),NIF-JP∗ψL(ξ=0),IF/m and ϖ4=JP∗ψL(ξ=m-1),IF-JP∗ψL(ξ=0),IF/m-1.
Case  3.One has Δ0>Δ1>⋯>Δi>⋯>Δm-1⩾l, i∈0,m-1.
According to inequality (21), JSocial0 (resp., JSocialm) is the minimal cost when l>ϖ3 (resp., l<ϖ3). When l=ϖ3, both JSocial0 and JSocialm are socially minimal cost.(21)JSocialη′-JSocialη′-1=l+JP∗ψLξ=m-η′,IF-JP∗ψLξ=m-η′+1,IF<Δm-η′+JP∗ψLξ=m-η′,IF-JP∗ψLξ=m-η′+1,IF=0,JSocialm-JSocial0=l-ϖ3.Situation 2.
One hasΔ0<Δ1<Δ2<⋯<Δm-2<Δm-1.
Case   1. One has l⩽Δ0<Δ1<⋯<Δi<⋯<Δm-2<Δm-1, i∈0,m-1.
Similar to Case  3 of Situation1, JSocial0 (resp., JSocialm) is the minimal cost when Δ0⩾l>ϖ3 (resp., l<ϖ3). When l=ϖ3, both JSocial0 and JSocialm are socially minimal cost.
Case  2. One has Δ0<Δ1<⋯<Δα-1<l<Δα<⋯<Δm-1, α∈1,m-1.
In Case  2,JSocialη is an increasing (resp., decreasing) function when m-α⩽η⩽m (resp., m-α-1⩾η⩾1) with the minimum being determined as JSocialm-α (resp., JSocialm-α-1). According to (22), JSocialm-α (resp., JSocialm-α-1) is the minimum when l>ϖ5α (resp., l<ϖ5α). When l=ϖ5α, both JSocialm-α and JSocialm-α-1 are socially minimal cost.(22)JSocialm-α-JSocialm-α-1>0⟹l+JP∗ψLξ=α,IF-JP∗ψLξ=α+1,IF>0⟹l>JP∗ψLξ=α+1,IF-JP∗ψLξ=α,IF=ϖ5α.
Case  3. One has Δ0<Δ1<⋯<Δi<⋯<Δm-2<Δm-1⩽l, i∈0,m-1.
According to inequality (19), JSocial0 is the socially minimal cost when l>Δm-1. Both JSocial0 and JSocial1 are the minimum of cost when l=Δm-1.
The relationship between socially and individually optimal choices inm-player SISG is characterized in Figure 12, where Figure 12(a) is for Situation 1, while Figure 12(b) is for Situation 2.
In the conflict area as denoted in Figures7, 10, 11, and 12, we can clearly distinguish that the individually optimal choices differ from socially optimal ones, and the tendency of individual player’s underinvestment reflects the existence of negative externalities and is in accordance with the strategy gap between individual and social players proposed in [27].Figure 12
The relationship between socially and individually optimal choices inm-player SISG.
(a)
(b)


## 5. Numerical Case Studies

In this section, we refer to the simulation example given in [28, 29] and then build our experimental platform for numerical case studies. The distributed and hierarchical framework of our experiment platform is as shown in Figure 13, and more details of plant devices are further provided in Figure 14. In both Figures 13 and 14, two individual CPSs consisted of engineer station as cyber component and inverter together with motor as physical component can be clearly distinguished.Figure 13
Distributed and hierarchical framework of our experiment platform.Figure 14
The plant device of experiment platform.The object of administrator in chief engineer station is to choose a coincident and optimal defense strategy (configuration of security countermeasures) for individual player and social planner under external attacks. The man-in-the-middle (MIM) attack is considered, and meanwhile encryption algorithms including AES and DES are regarded as security countermeasures.Due to its high threats and low possibility of being detected, MIM attack against time synchronization is considered. Once the vulnerability of time synchronization protocol is exploited by MIM attacker, the main-clock device will be completely spoofed while the slave-clock devices will be fully manipulated. The attacker is capable of mastering the real-time clock of slave-clock devices by sending bogus command messages without being detected by main-clock device. In our case, when CPS is compromised by MIM attacker, all the devices will then be synchronized by attacker with S-C delay,δ, and C-A delay, β, being manipulated. For more details about man-in-the-middle (MIM) attack against time synchronization, the reader can refer to [30].The experiment is carried out according to the following procedures.Step 1 (determination of security configuration).
The security configuration is determined by chief engineer station acting as a social planner, according to which each individual CPS is equipped with a certain security countermeasure, AES or DES.Step 2 (introduction of MIM attack).
MIM attack launched by external host computers is introduced into CPSs via common network. The victimized devices will be cheated to receive synchronization command messages with false timestamps and then lose the synchronization to other devices in the same network. The delays in physical plant are therefore produced due to the out-of-synchronization.Step 3 (realization ofH∞-optimal control under MIM attack and quantification of cyber cost).
PLC together with individual engineer station equipped with security countermeasure will deal with the control problems under MIM attack by sending control command messages to plant devices, inverter, and motor. In addition, the individual engineer station is realized as an embedded platform (ATM91SAM9XE512QU, MCU 32 bits, 180 Mhz) for proceeding encryption process and quantifying the cost of security countermeasure in cyber layer. It is noted that we refer to [31–33] for realizing H∞-optimal control through PLC and meanwhile the feedback macrocycle time of motors in physical plant is set to be 5 seconds.
We quantify the value ofl for each defense strategy based on the test data for executing time of encrypting/decrypting sensor or control command of plaintext as shown in Table 9, since the longer time that MCU spends on encryption, the more computational resources of defender will be occupied and thus the more cost defender should pay.
The mapping function forTAES/TDES and lAES/lDES is defined as lAES/DES=η·TAES/DES/TAES/DES+TDES/AES, where η is the weighing parameter and given as 0.1 in our case. In addition, we consider the situation that the length of both sensor and control command is configured as 1040 and thus lAES and lDES are obtained as 0.0411 and 0.0589, respectively.Table 9
Executing time of encryption and length of command of plaintext.
Time (ms)∖length (B)
144
272
400
528
656
784
912
1040
AES
7.48
67.21
127.18
187.24
246.88
306.46
366.37
432.94
DES
14.72
85.59
151.22
225.12
299.94
475.34
549.98
620.94
EncryptionStep 4 (quantification of physical cost).
The data of output AC voltage returned from inverter is used for quantifying the performance of controlled plant.Step 5 (repeated experiments with different security configuration).
Different security configuration is implemented by chief engineer station and the corresponding overall cost in physical layer and cyber layer can be obtained similarly through Steps1–4.Since the feedback macrocycle time of physical signal is 5 seconds and meanwhile the maximum of encryption executing time in the closed-loop communication channel is 1.24 seconds, there is enough time left for individuals security decision-making and processingH∞-optimal control algorithm. Additionally, the bandwidth in our case is 1 Gbps and thus the delays on communication channel are microsecond level or even nanosecond level. As a consequence, the feasibility and performance of proposed algorithm are ensured.The discrete-time model at half-load operating point can be found in [28, 29]:(23)A=0.9226-0.633001.00001.00B1=0.500.2B2=100D=0.100C=23.73820.2870.As being manipulated by MIM attacker, S-C delay and C-A delay of CPS equipped with either AES or DES are given by the same matrix and the corresponding cost in physical layerJP∗ under different cyber strategy pairs is obtained as follows: (24)δ¯=β¯=ILNILIFNIF0.010.040.040.06,JP∗=γ∗=ILNILIFNIF0.09940.14070.14070.1691.We will then haveJP∗NIL,IF-JP∗IL,IF=0.0413>JP∗NIL,NIF-JP∗NIL,IF=0.0284. According to Theorem 3, when JP∗NIL,IF-JP∗IL,IF>JP∗NIL,NIF-JP∗NIL,IF and l>lmax2 (resp., l≤lmax2) are satisfied, the SPNE would be {NIL,NIF} (resp., {IL,IF}) as listed in Table 10.Table 10
Individually optimal choices for experiment platform.
Magnitude ofl
Individually optimum choice
l>lmax2=0.0413
NIL,NIF
l≤lmax2=0.0413
IL,IFFurthermore, in accordance with the analysis in Section3.2, the socially optimal choices for different magnitude of l are obtained in Table 11 with l1, l2, and l3 being computed as 0.0826, 0.0568, and 0.0697, respectively. Additionally, the magnitude of l for each encryption algorithm (lA for AES, lD for DES) is quantified based on the test of occupying rate of the hardware resource, with lA and lD being determined as 0.0391 and 0.061, respectively.Table 11
Socially optimal choices in experiment platform.
Magnitude ofl
Socially optimum choice
l≥0.0826
NIL,NIF
0.0697≤l<0.0826
NIL,IF
0.0568≤l<0.0697
NIL,IF
l<0.0568
IL,IFThe relationship between socially and individually optimal choices can then be depicted in Figure15, where we can clearly distinguish the coincident and conflict area and meanwhile recognize the fact that, by setting the security configuration of applying AES on each individual CPS, the social planner can achieve both individual and social optimum. As a consequence, in this case, the security configuration of both individuals being equipped with AES is optimal.Figure 15
The socially and individually optimum choices in experiment platform.It is easy to extend our example tom-player situation following the theorem we propose in Section 4, and there would be 2m-1 boundaries in Figure 15 for distinguishing the gap between individually and socially optimal choices under different value of l.


## 6. Concluding Remarks

In this article, we explore the interdependent security of CPS with distributed and hierarchical framework. SISG is proposed for characterizing the interactions between individual CPSs, which are selfish but nonmalicious, and meanwhile the payoff function is formulated from a cross-layer perspective. The pure-strategy equilibria for two-player symmetric SISG are firstly analyzed with the strategy gap between individual and social optimum being distinguished. The result is further extended to asymmetric andm-player SISG. At last, a numerical case study is analyzed by applying the proposed theorems in order to obtain the comprehensively optimal security decision for administrator.As future work, we are interested in investigating the game with incomplete information due to the fact that the information on common network might not be fully trustable and cannot accurately reflect the actual security choices of other players either. Since we have already discussed the different cyber cost function, another interesting extension of our work would be to consider the CPSs of different physical plants where more types of control model (such as time-delay system, stochastic system) would be taken into account. In addition, when applying the proposed theorems in solving the practical security decision-making problems inm-player scenarios, the state space explosion problem caused by the geometric increase of payoff matrix dimension will complicate the analysis and corresponding results, and it would be further discussed in our following work.



---

*Source: 9017039-2017-08-22.xml*