Can less be more? A game-theoretic analysis of filtering vs. investment

Abstract

In this paper we consider a single resource-constrained strategic adversary, who can arbitrarily distribute his resources over a set of nodes controlled by a single defender. The defender can (1) instruct nodes to filter incoming traffic from another node to reduce the chances of being compromised due to malicious traffic originating from that node, or (2) choose an amount of investment in security for each node in order to directly reduce loss, regardless of the origin of malicious traffic; leading to a filtering and an investment game, respectively. We shall derive and compare the Nash equilibria of both games for different resource constraints on the attacker. Our analysis and simulation results show that from either the attacker or the defender’s point of view, none of the games perform uniformly better than the other, as utilities drawn at the equilibria are dependent on the costs associated with each action and the amount of resources available to the attacker. More interestingly, in games with highly resourceful attackers, not only the defender sustains higher loss, but the adversary is also at a disadvantage compared to less resourceful attackers.