A reputation game on cyber-security and cyber-risk calibration

Abstract

To analyze strategic interactions arising in the cyber-security context, we develop a new reputation game model in which an attacker can pretend to be a normal user and a defender may have to announce attack detection at a certain point of time without knowing whether he has been attacked. We show the existence and uniqueness of sequential equilibrium in Markov strategies, and explicitly characterize the players’ equilibrium strategies. Using our model, we suggest empirical and theoretical ways of calibrating the attack probability, which is an important element of cyber-risks.