Abstract. Motivated attackers cannot always be blocked or deterred. In the physical-world security context, examples include suicide bombers and sexual predators. In computer networks, zero-day exploits unpredictably threaten the information economy and end users. In this paper, we study the conflicting incentives of individuals to act in the light of such threats. More specifically, in the weakest target game an attacker will always be able to compromise the agent (or agents) with the lowest protection level, but will leave all others unscathed. We find the game to exhibit a number of complex phenomena. It does not admit pure Nash equilibria, and when players are heterogeneous in some cases the game does not even admit mixed-strategy equilibria. Most outcomes from the weakest-target game are far from ideal. In fact, payoffs for most players in any Nash equilibrium are far worse than in the game's social optimum. However, under the rule of a social planner, average security investments are extremely low. The game thus leads to a conflict between pure economic interests, and common social norms that imply that higher levels of security are always desirable.
The work published in REF examines the weakest target game which refers to the case where an attacker is always able to compromise the system target with the lowest level of defence, and not to cause any damage to the rest of the targets.
Nash Equilibria for Weakest Target Security Games with Heterogeneous Agents ⋆
GAMENETS
Computer Science