A Quantal Response Analysis of Simultaneous Multi-Target Attacker-Defender Security Games

Modern systems, under the management of human decision-makers, confront rapidly increasing cybersecurity threats. This paper considers security decision-making within these complex modern systems managed by human defender. The defender has responsibility for safeguarding a specific set of assets with heterogeneous loss valuations against an external attacker. These assets are associated with probabilities that represent the likelihood of a successful attack, which can be reduced through security investments by the defender and can be increased via attacker’s investments. Our approach involves modeling these systems using simultaneous game-theoretic framework, accounting for the impact of bounded rationality and imperfect best-response behavior—as frequently observed in human decision-making within the domains of behavioral economics and psychology. We first establish the existence of a quantal response equilibrium in our security games. Subsequently, we analyze the effects of this type of bounded rationality in terms of the expected cost of the defender. To assess our models, we employ a representative system and compare the game-theoretic optimal investment strategies under those derived from a quantal response equilibrium standpoint. We also investigate the influence of various system parameters on the overall security level (expected security cost) of this system.