From physical security to cybersecurity

• Main Authors: SINHA, Arunesh, NGUYEN, Thanh H., KAR, Debarun, BROWN, Matthew, TAMBE, Milind, JIANG, Albert Xin
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2015
• Subjects: game theory; security; limited resources; Data Storage Systems; Information Security
• Online Access: https://ink.library.smu.edu.sg/sis_research/4504; https://ink.library.smu.edu.sg/context/sis_research/article/5507/viewcontent/tyv007_1_.pdf
• Institution: Singapore Management University

Security is a critical concern around the world. In many domains from cybersecurity to sustainability, limited security resources prevent complete security coverage at all times. Instead, these limited resources must be scheduled (or allocated or deployed), while simultaneously taking into account the importance of different targets, the responses of the adversaries to the security posture, and the potential uncertainties in adversary payoffs and observations, etc. Computational game theory can help generate such security schedules. Indeed, casting the problem as a Stackelberg game, we have developed new algorithms that are now deployed over multiple years in multiple applications for scheduling of security resources. These applications are leading to real world use-inspired research in the emerging research area of "security games." The research challenges posed by these applications include scaling up security games to real-world-sized problems, handling multiple types of uncertainty, and dealing with bounded rationality of human adversaries. In cybersecurity domain, the interaction between the defender and adversary is quite complicated with high degree of incomplete information and uncertainty. While solutions have been proposed for parts of the problem space in cybersecurity, the need of the hour is a comprehensive understanding of the whole space including the interaction with the adversary. We highlight the innovations in security games that could be used to tackle the game problem in cybersecurity.