A Game Theoretic Model of Strategic Conflict in Cyberspace

Abstract

Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing this collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden SPONSOR/MONITOR'S ACRONYM(S) SPONSOR/MONITOR'S REPORT NUMBER(S)12. DISTRIBUTION / AVAILABILITY STATEMENT Approved for public release; distribution is unlimited 13. SUPPLEMENTARY NOTES ABSTRACTWe study cyber conflict as a two-person, zero-sum game in discrete time, where each player discovers new exploits according to an independent random process. Upon discovery, the player must decide if and when to exercise a munition based on that exploit. The payoff from using the munition is a function of time that is (generally) increasing. These factors create a basic tension: the longer a player waits to exercise a munition, the greater his payoff because the munition is more mature, but also the greater the chance that the opponent will also discover the exploit and nullify the munition. Assuming perfect knowledge, and under mild restrictions on the time-dependent payoff function for a munition, we derive optimal exercise strategies and quantify the value of engaging in cyber conflict. Our analysis also leads to high-level insights on cyber conflict strategy. SUBJECT TERMS ABSTRACTWe study cyber conflict as a two-person, zero-sum game in discrete time, where each player discovers new exploits according to an independent random process. Upon discovery, the player must decide if and when to exercise a munition based on that exploit. The payoff from using the munition is a function of time that is (generally) increasing. These factors create a basic tension: the longer a player waits to exercise a munition, the greater his payoff because the munition is more mature, but also the greater the chance that the opponent will also discover the exploit and nullify the munition. Assuming perfect knowledge, and under mild restrictions on the time-dependent payoff function for a munition, we derive optimal exercise strategies and quantify the value of engaging in cyber conflict. Our analysis also leads to high-level insights on cyber conflict strategy. vi THIS PAGE INTENTIONALLY LEFT BLANK vii

Growth directions for the JDMS community

“…Unlike the (rightly!) best studied case of nuclear deterrence resting on options for assured retaliation by preventing the possibility of a so-called ''splendid first strike,'' cyber effects are by their nature a ''use or lose'' option, and for that reason they are-in my informed opinion-destabilizing in deterrence as a potential belligerent is encouraged to exercise their cyber option before it spoils on the shelf as it were, for discussion see Schramm et al 2 As daunting as this challenge is analytically, it's the easier one. Ultimately, the effects of cyber are not nearly as important on their effect on measurable systems as they are on the decision making, and potential introduction of mistrust, into the victim's decision calculus.…”

“…Unlike the (rightly!) best studied case of nuclear deterrence resting on options for assured retaliation by preventing the possibility of a so-called “splendid first strike,” cyber effects are by their nature a “use or lose” option, and for that reason they are—in my informed opinion—destabilizing in deterrence as a potential belligerent is encouraged to exercise their cyber option before it spoils on the shelf as it were, for discussion see Schramm et al 2…”

Resource allocation in two‐layered cyber‐defense

“…Cyber warfare has drawn the attention of the research community (Musman et al, 2011; Rid, 2012), and in particular, its potential impact on kinetic warfare (Hartmann & Steup, 2013; Yildiz, 2014). Moreover, the operations‐research community has addressed cyber‐related modeling challenges by combining combat and epidemic models (Draeger & Ottl, 2018; Schramm & Gaver, 2013; Yildiz, 2014), analyzing the development and employment of munitions against exploits (Schramm et al, 2014), and applying exploration‐exploitation models (Kronzilber, 2017). A recent survey paper (Enayaty‐Ahangar et al, 2020) reviews studies that apply optimization to the design of cyber infrastructure.…”