Colonel Blotto in the Phishing War

Abstract

Abstract. Phishing exhibits characteristics of asymmetric conflict and guerrilla warfare. Phishing sites, upon detection, are subject to removal by takedown specialists. In response, phishers create large numbers of new phishing attacks to evade detection and stretch the resources of the defenders. We propose the Colonel Blotto Phishing (CBP) game, a twostage Colonel Blotto game with endogenous dimensionality and detection probability. We find that the optimal number of new phishes to create, from the attacker's perspective, is influenced by the degree of resource asymmetry, the cost of new phishes, and the probability of detection. Counter-intuitively, we find that it is the less resourceful attacker who would create more phishing attacks in equilibrium. And depending on the detection probability, an attacker will vary his strategies to either create even more phishes, or to focus on raising his resources to increase the chance he will extend the lifetime of his phishes. We discuss the implications to anti-phishing strategies and point out that the game is also applicable to web security problems more generally.

Focality and Asymmetry in Multi-Battle Contests

“…2 Randomization is independent across battlefields and in the event of zero aggregate expenditure to a battlefield, the probability that each player wins is 1 2 . 3 See, for instance, Shubik and Weber (1981), Powell (2007aPowell ( ,b, 2009, Powers and Shen (2009), Kovenock et al (2010), Chia and Chuang (2011), Arce et al (2011), Fuchs and Khargonekar (2012), Nikoofal and Zhuang (2012), Arce et al (2012), Bachrach et al (2013), Gupta et al (2014a,b), Hausken (2014), Goyal and Vigier (2014). Other applications include the optimal allocation of advertising budgets across markets or marketing budgets across channels (Friedman, 1958), the allocation of political campaign funds across different primaries or state races (Snyder, 1989;Laslier, 2002;Klumpp and Polborn, 2006;Kovenock and Roberson, 2009a), redistributive politics (Myerson, 1993;Lizzeri and Persico, 2001;Roberson, 2008;Roberson, 2008, 2009b;Crutzen and Sahuguet, 2009), and the allocation R&D budgets across several potential classes of innovations or projects (Clark and Konrad, 2008).…”