Time-Dependent Strategies in Games of Timing

Abstract

Timing, a central aspect of decision-making in security scenarios, is a subject of growing academic interest; frequently in the context of stealthy attacks, or advanced persistent threats (APTs). A key model in this research landscape is FlipIt [1]. However, a limiting simplifying assumption in the FlipIt literature is that costs and gains are not subject to discounting, which contradicts the typical treatment of decision-making over time in most economically relevant contexts. Our recent work [2] introduces an adaptation of the FlipIt model that applies time-based exponential discounting to the value of a protected resource, while allowing players to choose from among the same canonical strategies as in the original game. This paper extends the study of games of timing by introducing two new classes of strategies that are fundamentally motivated by a time-discounted world view. Within our game model, we compute player utilities, best responses and give a partial characterization of the game's Nash equilibria. Our model allows us to re-interpret the APT model using a finite total valuation, and a finite time horizon. By applying time-based discounting to the entire decision-making framework, we increase the level of realism as well as applicability to organizational security management.

Generalized Hyperbolic Discounting in Security Games of Timing

“…The interesting strategic aspects of FlipIt have led to numerous follow-up studies. Most closely related to our work are studies on the impact of exponential discounting in the framework of the FlipIt game [13][14][15]. These have found new predictions of optimal defense investments due largely to the fact that an exponentially discounted investment has a finite cumulative valuation over time.…”

“…The model presented in this paper introduces four parameters governing the preferences of two players discounting along a generalized hyperbolic discounting function (α A , α D , β A , and β D ) and is sufficiently general as to subsume several previously studied classes of such games, including exponential discounting [14,15] and the original FlipIt game [2], which does not involve discounting. The price of this generality is an increase in the complexity of derivations and formulae.…”

“…On the upside, we are able to provide a characterization of equilibrium configurations for the canonical regions of our parameter space, and our machinery brings together several different approaches into one unifying framework. Many of our generalized arguments subsume and even simplify the arguments and calculations from prior related work [2,14,15]. Examples include our notations surrounding anonymous gain and our focused usage of base incentives.…”

“…In [13,14], Merlevede et al introduced exponential discounting of future gains and costs, addressing some of these concerns. In [15], these authors also introduce a novel class of "discounted strategies" to the exponentially discounted game in which players move less frequently as the resource loses value. We are unaware of further studies considering discounting in the context of the FlipIt game.…”

“…While this line of work has explored diverse facets of security decision-making, a limitation in most studies on games of timing in general and on FlipIt-like games in particular is that they do not consider economic discounting in the valuation of the contested resource-so although the environment changes over time, the value of the resource and the costs of attacking or defending it do not. A few more recent efforts have attempted to bridge this deficiency by considering the effect of exponential discounting on the valuation and defense costs over time [13][14][15]. Such studies have found new predictions of optimal defense investments due mainly to the fact that an exponentially discounted investment has a finite cumulative valuation over time.…”