Using Game Theory to Analyze Risk to Privacy: An Initial Insight

Rajbhandari, Lisa; Snekkenes, Einar

doi:10.1007/978-3-642-20769-3_4

Cited by 16 publications

(14 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There have been several investigations in solving privacy problems with a Stackelberg game approach, some of which exhibit a similar concept with our work in modeling a two-party interaction with a Stackelberg game [38, 39, 40, 41, 42, 43]. Liu et al proposed a game model based on the assumption that the players have uncertainty with respect to each other’s payoff function [38].…”

Section: Introductionmentioning

confidence: 72%

See 1 more Smart Citation

Optimizing annotation resources for natural language de-identification via a game theoretic framework

Carrell

Aberdeen

et al. 2016

Journal of Biomedical Informatics

View full text Add to dashboard Cite

Objective Electronic medical records (EMRs) are increasingly repurposed for activities beyond clinical care, such as to support translational research and public policy analysis. To mitigate privacy risks, healthcare organizations (HCOs) aim to remove potentially identifying patient information. A substantial quantity of EMR data is in natural language form and there are concerns that automated tools for detecting identifiers are imperfect and leak information that can be exploited by ill-intentioned data recipients. Thus, HCOs have been encouraged to invest as much effort as possible to find and detect potential identifiers, but such a strategy assumes the recipients are sufficiently incentivized and capable of exploiting leaked identifiers. In practice, such an assumption may not hold true and HCOs may overinvest in de-identification technology. The goal of this study is to design a natural language de-identification framework, rooted in game theory, which enables an HCO to optimize their investments given the expected capabilities of an adversarial recipient. Methods We introduce a Stackelberg game to balance risk and utility in natural language de-identification. This game represents a cost-benefit model that enables an HCO with a fixed budget to minimize their investment in the de-identification process. We evaluate this model by assessing the overall payoff to the HCO and the adversary using 2100 clinical notes from Vanderbilt University Medical Center. We simulate several policy alternatives using a range of parameters, including the cost of training a de-identification model and the loss in data utility due to the removal of terms that are not identifiers. In addition, we compare policy options where, when an attacker is fined for misuse, a monetary penalty is paid to the publishing HCO as opposed to a third party (e.g., a federal regulator). Results Our results show that when an HCO is forced to exhaust a limited budget (set to $2000 in the study), the precision and recall of the de-identification of the HCO are 0.86 and 0.8, respectively. A game-based approach enables a more refined cost-benefit tradeoff, improving both privacy and utility for the HCO. For example, our investigation shows that it is possible for an HCO to release the data without spending all their budget on de-identification and still deter the attacker, with a precision of 0.77 and a recall of 0.61 for the de-identification. There also exist scenarios in which the model indicates an HCO should not release any data because the risk is too great. In addition, we find that the practice of paying fines back to a HCO (an artifact of suing for breach of contract), as opposed to a third party such as a federal regulator, can induce an elevated level of data sharing risk, where the HCO is incentivized to bait the attacker to elicit compensation. Conclusions A game theoretic framework can be applied in leading HCO’s to optimized decision making in natural language de-identification investments before sharing EMR data.

show abstract

Section: Introductionmentioning

confidence: 72%

“…Liu et al proposed a game model based on the assumption that the players have uncertainty with respect to each other’s payoff function [38]. Rajbhandari et al provided a model with a smaller strategy space [41]. Blocki et al studied economic considerations in the design of internal audit mechanisms parameter [42].…”

Section: Introductionmentioning

confidence: 99%

Optimizing annotation resources for natural language de-identification via a game theoretic framework

Carrell

Aberdeen

et al. 2016

Journal of Biomedical Informatics

View full text Add to dashboard Cite

show abstract

“…Some researchers suggested using game theory to measure the risk value of access operations. For example, Rajbhandari and Snekkenes [17] have proposed a risk analysis method that uses values of user benefits to evaluating the risk value related to the access request using game theory. However, using only the user's benefits to make access decisions are not enough to build a scalable and flexible approach for the IoT.…”

Section: Related Workmentioning

confidence: 99%

An efficient security risk estimation technique for Risk-based access control model for IoT

Atlam

Wills

2019

Internet of Things

View full text Add to dashboard Cite

The need to increase information sharing in the Internet of Things (IoT) applications made the risk-based access control model to be the best candidate for both academic and commercial organizations. Risk-based access control model carries out a security risk analysis on the access request by using IoT contextual information to provide access decisions dynamically. Unlike current static access control approaches that are based on predefined policies and give the same result in different situations, this model provides the required flexibility to access system resources and works well in unexpected conditions and situations of the IoT system. One of the main issues to implement this model is to determine the appropriate risk estimation technique that is able to generate accurate and realistic risk values for each access request to determine the access decision. Therefore, this paper proposes a risk estimation technique which integrates the fuzzy inference system with expert judgment to assess security risks of access control operations in the IoT system. Twenty IoT security experts from inside and outside the UK were interviewed to validate the proposed risk estimation technique and build the fuzzy inference rules accurately. The proposed risk estimation approach was implemented and simulated using access control scenarios of the network router. In comparison with the existing fuzzy techniques, the proposed technique has demonstrated it produces precise and realistic values in evaluating security risks of access control operations in the IoT context.

show abstract

“…Some researchers suggested using game theory to measure the risk value of access operations. For example, Rajbhandari and Snekkenes [24] have proposed a risk analysis method that uses values of user benefits to estimate the risk value related to the access request using game theory. However, using only user's benefits to make access decisions are not enough to build a scalable and flexible approach for the IoT.…”

Section: Related Workmentioning

confidence: 99%

“…The payoff is the rewards of the players in the game. For each player, the payoff is affected by both their own actions and those of the other player [24]. In the game theory, the risk analysis is done by using user benefits rather than the probability.…”

Section: Game Theorymentioning

confidence: 99%

Fuzzy Logic with Expert Judgment to Implement an Adaptive Risk-Based Access Control Model for IoT

et al. 2019

View full text Add to dashboard Cite

The Internet of Things (IoT) is becoming the future of the Internet with a large number of connected devices that are predicted to reach about 50 billion by 2020. With proliferation of IoT devices and need to increase information sharing in IoT applications, risk-based access control model has become the best candidate for both academic and commercial organizations to address access control issues. This model carries out a security risk analysis on the access request by using IoT contextual information to provide access decisions dynamically. This model solves challenges related to flexibility and scalability of the IoT system. Therefore, we propose an adaptive risk-based access control model for the IoT. This model uses real-time contextual information associated with the requesting user to calculate the security risk regarding each access request. It uses user attributes while making the access request, action severity, resource sensitivity and user risk history as inputs to analyze and calculate the risk value to determine the access decision. To detect abnormal and malicious actions, smart contracts are used to track and monitor user activities during the access session to detect and prevent potential security violations. In addition, as the risk estimation process is the essential stage to build a risk-based model, this paper provides a discussion of common risk estimation methods and then proposes the fuzzy inference system with expert judgment as to be the optimal approach to handle risk estimation process of the proposed risk-based model in the IoT system.

show abstract

Using Game Theory to Analyze Risk to Privacy: An Initial Insight

Cited by 16 publications

References 5 publications

Optimizing annotation resources for natural language de-identification via a game theoretic framework

Optimizing annotation resources for natural language de-identification via a game theoretic framework

An efficient security risk estimation technique for Risk-based access control model for IoT

Fuzzy Logic with Expert Judgment to Implement an Adaptive Risk-Based Access Control Model for IoT

Contact Info

Product

Resources

About