Entities of physical presence have always been susceptible to attacks. Entities of online presence are more prone to cyberattacks, as the lack of local boundaries permits anyone from anywhere in the world to launch a potentially successful attack. People aim to protect their physical and virtual assets daily: Locking doors and cars, setting up alarms and protecting passwords and credit card numbers are just a few examples. History has proven, though, that any defense system can be compromised. Defenders and attackers have delved into continuous action and counteraction: The more intelligent the defense strategy gets, the more sophisticated the attacker becomes, and the defense needs to adapt again. Game Theory provides us with the mathematical tools and concepts to capture these strategic interactions between players and their different and often antagonistic interests. Such a concept is a Nash equilibrium: a set of strategies that dictates what the players should do, such that the players have no incentive to deviate.

We model the strategic interactions between a strategic adversary and a classifier using Game Theory. Our analysis leads to Nash equilibria in randomized strategies, increasing the difficulty for the attacker to reconstruct the classification rule. We give a polynomial time algorithm to compute the Nash equilibrium strategies of the players. Our setting, albeit simple, gives interesting insights that could be beneficial in practical settings: We quantify the impact of the various parameters like cost from detection, false alarms and statistics about the normal traffic on the equilibrium strategies and payoffs. We show that if the classification is based on several features, the defender should apply a threshold on the attacker's reward. This is in contrast with known algorithms such as logistic regression which have a predefined shape of the boundary independently of the attacker's goal.

In view of the recent security breaches, like Anthem, Target and Home Depot, we are motivated to study a class of games in which there are multiple defenders (companies) that compete to acquire legitimate users in the presence of malicious traffic.

To this purpose we analyze the economic incentives for ad networks to fight click fraud in advertising markets. By click fraud, we define the act of clicking an ad without an interest to see the ad or buy the advertised product. When such clicks are counted as "valid" by the ad network, the advertiser pays for a useless click, and the publisher (webpage at which the ad was displayed) is rewarded for generating it. Thus there is an incentive for fraudulent publishers to inflate click numbers. Ad networks have an incentive to classify fraudulent clicks

in order to deliver a more valuable service to advertisers. On the other hand, ad networks do receive revenue for fraudulent clicks, which creates an incentive in the opposite direction to fight fraud less.

We develop a model to capture the incentives of two competing ad networks to fight click fraud, under different assumptions about the bidding process of advertisers. Our equilibrium results show that ad networks are highly incentivized in combating click fraud. We explore the investment strategies of ad networks to improve their classification algorithms and investigate when ad networks over or under invest compared to social optimum.

In this dissertation we propose two novel non-zero-sum, adversarial detection games motivated by problems in network security. First we consider a local mean field, interdependent detection game between a network of defenders and a strategic attacker. Each defender chooses a detection threshold to test for the presence of a botnet infection, which can propagate between defenders if undetected. In order to avoid detection, the attacker balances stealth and aggression in his strategic utilization of the compromised network. We compare selfish, decentralized defenders to centrally planned defenders in order to examine the effects of network externalities on detection strategies. It is found that for fixed attack strategies, decentralized defenders choose thresholds that are either too low or too high than is socially optimal. When the attacker is strategic and the defenders are homogeneous, we prove the existence of a pure Nash equilibrium in both decentralized and centralized games. Through numerical approximations of the equilibria, we find that decentralized defenders can outperform a central planner in such games. It is observed that pure Nash equilibria often fail to exist when defenders are heterogeneous in their cost functions. In this case sufficient conditions are given to guarantee a Stackelberg equilibria.

Next a two-player, non-zero-sum, sequential detection game based on Wald's SPRT is presented. A defender seeks to sequentially detect the presence of an attacker via the drift of a stochastic process. The detection process is complicated by the attacker's ability to strategically choose the drift of the observed stochastic process. We prove the existence of pure Nash equilibria and give sufficient conditions for the existence of Stackelberg equilibria with the defender as leader. It is shown that both low false positive costs and high prior probabilities of intrusion lead to an infinite number of Nash equilibria in which the defender makes no observations. Conversely both high false positive costs and low prior probabilities of intrusion lead to a finite number of non-trivial Nash equilibria. Through numerical examples we see that it is possible for the defender to do better using a Stackelberg equilibrium strategy than a Nash equilibrium strategy.

We investigate how ideas from the International Environmental Agreement (IEA) literature can be applied to the problem of space debris mitigation. Space debris pollution is similar to other international environmental problems in that there is a potential for a "tragedy of the commons" effect: individual nations bear all the cost of their mitigation measures but share only a fraction of the benefit. As a consequence, nations have a tendency to underinvest in mitigation. Coalitions of nations, brought together by IEAs, have the potential to lessen the tragedy of the commons effect by pooling the costs and benefits of mitigation. This work brings together two recent modeling advances: (i) a game theoretic model for studying the potential gains from IEA cooperation between nations with asymmetric costs and benefits, (ii) an orbital debris model that gives the societal cost that specific actions, such as failing to deorbit an inactive spacecraft, have on the environment. We combine these two models with empirical launch-share data for a "proof of concept" of an IEA for a single mitigation measure--deorbiting spacecraft at the end of operational lifetime. Simulations of empirically-derived and theoretical launch distributions among nations suggest the possibility that voluntary coalitions can provide significant deorbiting gains relative to nations acting in the absence of an IEA agreement.

Background

Results

Conclusion