Abstract-We study a network security game where strategic players choose their investments in security. Since a player's investment can reduce the propagation of computer viruses, a key feature of the game is the positive externality exerted by the investment. With selfish players, unfortunately, the overall network security can be far from optimum. The contributions of this paper are as follows. 1) We first characterize the price of anarchy (POA) in the strategic-form game under an "Effective-investment" model and a "Bad-traffic" model, and give insight on how the POA depends on individual players' cost functions and their mutual influence. We also introduce the concept of "weighted POA" to bound the region of payoff vectors. 2) In a repeated game, players have more incentive to cooperate for their long term interests. We consider the socially best outcome that can be supported by the repeated game, as compared to the social optimum. 3) Next, we compare the benefits of improving security technology and improving incentives, and show that improving technology alone may not offset the price of anarchy. 4) Finally, we characterize the performance of correlated equilibrium (CE). Although the paper focuses on network security, many results are generally applicable to games with positive externalities. Index Terms-Correlated equilibrium (CE), game theory, network security, positive externality, price of anarchy (POA), repeated game.
The effective investment model in REF has been considered to determine a bound on the price of anarchy gap, i.e. the gap between the socially optimal and Nash equilibrium investments, in security games.
How Bad Are Selfish Investments in Network Security?
IEEE/ACM Transactions on Networking
IEEE/ACM Transactions on Networking
Computer Science