Incentive Mechanism Design Based on Repeated Game Theory in Security Information Sharing

Abstract

Abstract-In addition to the security investment, security information sharing among firms has been proved to be an effective measure. In order to enhance the level of information security and improve the social welfare, this paper studies how to promote sharing through a certain reasonable incentive mechanism. We adopt the repeated game theory to establish incentive mechanism and analyze how similarity, isolation period, discount factor, proportion of rational firms and so on effect the efficiency of this incentive mechanism. We finally conclude the conditions required by the effective mechanism.Keywords-Security Information; Repeated Game; Incentive Mechanism; Sharing I.INTRODUCTION In order to enhance the level of common information security, we certainly should invest enough in our own information security management.Besides that, strengthening the security information sharing with partners is equally important. This has led China to set up a national security vulnerabilities information sharing platform; U.S. federal government has encouraged the establishment of industry-based information sharing and analysis center to facilitate the sharing of security information to enhance and protect critical cyber infrastructures. A specific example of security information sharing is the Information Technology Information Sharing and Analysis Center (IT-ISAC) (https://www.it-isac.org) which aims at facilitating the sharing of information on cyber-security threats and vulnerabilities. Platform-building is only the beginning. The key problem is how to make the best use of the platform. The performance of platform depends on the willingness of members to share security information. In this context, our paper will design an incentive mechanism based on repeated game theory in order to enhance the willingness of security information sharing and ultimately maximize the effectiveness of sharing platform.Questions on information sharing have been previously studied in different context of organizations. Information security is interdependent [1], security information is treated as a hybrid between public and private goods [2][3] and security strategies are divided into two components: self-protection (e.g., firewall, IDS) and self-insurance (e.g., having good backups). Self-protection denotes the ability to decrease the probability of successful attack by hackers [4].To improve the efficiency of self-protection, it is an effective way to share security information each other [5]. Designing incentive compatible mechanisms that lead to efficient production of public goods has long been an important topic in the theoretical literature on public economics. Mutuswami and Winter (2004) propose two sequential mechanisms for efficient production of public goods. As far as security information is concerned, Varian [3]points out that during the period of security information sharing the nature of information assets possessed by two firms, either complementary or substitutable, plays a crucial role in influencing decisions of sharing or...

Cyber threat intelligence sharing: Survey and research directions

“…It is surmised that members increase their contribution in expectation to be rewarded for it in form of reciprocity [20]. The work in [44] suggested a punishment model which inclines isolation from the threat sharing community. If an entity decides not to share, and only consume, CTI, then the punishment process will revoke permission rights.…”

Cyber-Threats Information Sharing in Cloud Computing: A Game Theoretic Approach

“…The researches in [12][13] [14][15][2] [16] analyze information sharing in the context of cybersecurity. Those papers show that multiple factors impact cyber threat information sharing including competition [14], free riding [2], interconnection [17], and the possibility to exploit vulnerabilities for cyber war [16].…”