Agent-based simulation of cognitive styles in a security game

Alan NochensonIST 51110/14/2012

What are security games?

Goal: Model human behavior in a variety of security scenarios

Background: Taken from economic and public goods literature (Varian 2004, Hirshleifer 1983)

Examples: weakest link, total effort, colonel blotto, interdependent network security

State of the art

Mathematically model and analyze the scenarios

Create new models that take into account more factors, different factors, different methods, different contexts, etc.

Limits of current approaches

Arbitrary what factors are included Usually not based on any cognitive

research The very few lab studies have

rejected predicted outcomes

New approach

Use agent-based simulation to model complex scenarios

Create cognitive models for agents Have them interact and see what

behavior occurs

Why will it work and why should anyone care?

Based on cognitive science (engineering)

Preliminary results are promising (Nochenson and Heimann, GameSec 2012)

Can analyze scenarios that are too difficult to mathematically formulate

Can test simulated results against existing models, and against lab studies (ongoing)

What difference will it make? Risks

Too hard to make a generic framework for simulation (already exists) and cognitive behaviors (need to adapt from cog sci engineering)

Too many things to try (need to limit scope) Experimenter bias (need to be careful)

Payoffs Test existing models Integrate cognitive science engineering and

security economics

What difference will it make?

Resources Lab computer to run simulations

Time To investigate and codify various

behaviors To write the code (generic framework

and individual agents) To simulate a reasonable number of

rounds

Metrics for success

Observing interesting behavior and finding psychological theory to explain the behavior

Creating an extendable framework Validate of reject conclusions of

existing models (and inform revisions)

Questions?

Supplementary slides

Weakest link game

players are vulnerable to a security threat

Multiple rounds. Each round some probability of an

attack If attack successful, all agents incur

a loss Losses are not the same for each

agent Agents can by self-protection and

self-insurance

Potential outcomes from a round

1. No attack occurs, and no one loses anything

2. An attack occurs and:a) Is blocked because of self-protection of

everyoneb) Is not blocked

Ideally, what happens? (Nash equilibria)

Everyone protections with some effort and does not insure, or…

Everyone fully insures and does not protect

Observed results

Equilibria are not reached, even in a large number of rounds

Hyp: There are a number of cognitive factors that influence convergence