∎

11institutetext: New York University, Brooklyn, NY, 11201; Email:
<EMAIL_ADDRESS>
# Cyber Insurance

Quanyan Zhu

##  1 Introduction

Critical Infrastructures are increasingly dependent on the information and
communication technologies (ICTs) to sense, transmit, and fuse data for real-
time operations and control of the infrastructures. The heavy integration of
the ICTs has also brought many potential threat that can cause data privacy
breaches, availability of the services, and the cascading damages. The
vulnerabilities in the ICT can arise not only from unintentional
misconfiguration and mismanagement of the protocols and devices but also from
the intentional injection of the malware, spread of the worms, and the cyber
attacks. Recent cyber attacks on Iranian nuclear power plants and the Ukraine
power grid have also shown that the attacks are becoming increasingly
sophisticated. For example, advanced persistent threats (APTs) Samuel2010 ;
McMillan2010 , such as Stuxnet, Flame, and Duqu, can exploit zero-day
vulnerabilities, leverage human errors and insider threats, and move
stealthily in the network before launching a successful attack. These attacks
are often difficult to detect and prevent as they have access to a sufficient
amount of resources and are capable of staying in the victim’s system for
years.

Hence, cyber risks for infrastructures are of growing concerns. The cyber risk
will not only create cyber incidents including identity theft, cyber
extortion, and network disruption, but also can lead to the malfunction of the
entire infrastructure and its key services to users and customers. It becomes
a critical issue for operators to safeguard infrastructures from the
intentional and unintentional actions that would inflict damage on the system.
Conventional countermeasures include installing intrusion detections,
blacklisting malicious hosts, filtering/blocking traffic into the network.
However, these methods cannot guarantee perfect security and can be evaded by
sophisticated adversaries despite the advances in technologies. Therefore,
cyber risks are inevitable and it is essential to find other means to mitigate
the risks and impact.

Cyber insurance is an important tool in risk management to transfer risks
zhang2017bi ; zhang2019flipin . Complement to the technological solutions to
cybersecurity, cyber insurance can mitigate the loss of the targeted system
and increase the resiliency of the victim by enabling quick financial and
system recovery from cyber incidents. Such scheme is particularly helpful to
small and medium size infrastructure systems that cannot afford a significant
investment in cyber protection. The market of cyber insurance is still in its
infancy. U.S. penetration level of the insured is less than 15%. Promisingly,
the market is growing fast at a 30% annual growth rate since 2011. The key
challenge with cyber insurance lies in the difficulty to assess different
types of cyber risks and impact of the cyber incidents that are launched by
resourceful adversaries who are stealthy and purposeful. The design of cyber
insurance also needs to take into account moral hazards and adverse selection
problems. The insured tend to lack in incentives to improve their security
measures to safeguard against attacks. As the nodes in the cyber space are
increasingly connected, the unprotected cyber risks can propagate to other
uninsured nodes. With asymmetric information of the insured, the insurer also
has tendency to increase the premium rates for higher risks, making the cyber
insurance less affordable to end users.

In this chapter, we aim to provide a baseline framework to understand the
interactions among the players in the cyber insurance market and leverage it
to design optimal cyber insurance for the infrastructure services. One key
application of the framework is to provide assurance to the infrastructure
managers and users and transfer their risks when the attack on power grid
fails to provide electric power to a food processing plant, when cloud servers
break down and fail to provide airline customer check-in information, and when
the trains collide due to the communication systems fail. In the examples
above, it is clear that the cyber insurance play a key role in mitigating the
cyber risks that interconnect the communications and information systems of an
infrastructure with their physical impact on the infrastructure or linked
infrastructures. The interdependencies among the infrastructures and their
operators and users can propagate the cyber risks and exacerbate the damages
on the critical infrastructures. To this end, the understanding of the cyber
insurance of interconnected players is the key to the holistic understanding
of the risk management of interdependent infrastructures.

This chapter will first present a principal-agent game-theoretic model to
capture the interactions between one insurer and one user. The insurer is
deemed as the principal who does not have incomplete information about user’s
security policies. The user, which refers to the infrastructure operator or
the customer, implements his local protection and pays a premium to the
insurer. The insurer designs an incentive compatible insurance mechanism that
includes the premium and the coverage policy, while the user determines
whether to participate in the insurance and his effort to defend against
attacks. The chapter will also focus on an attack-aware cyber insurance model
by introducing the adversarial behaviors into the framework. The behavior of
an attacker determines the type of cyber threats, e.g. denial of service (DoS)
attacks, data breaches, phishing and spoofing. The distinction of threat types
plays a role in determining the type of losses and the coverage policies. The
data breaches can lead to not only financial losses but also damage of the
reputations. The coverage may only cover certain agreed percentage of the
financial losses.

##  2 Background

The challenges of cyber security are not only technical issues but also
economic and policy issues anderson2006economics . Recently, the use of cyber
insurance to enhance the level of security in cyber-physical systems has been
studied kesan2005cyberinsurance ; lelarge2008local . While these works deal
with externality effects of cyber security in networks, few of them take into
account in the model the cyber attack from a malicious adversary to
distinguish from classical insurance models. In pal2014will , the authors have
considered direct and indirect losses, respectively due to cyber attacks and
indirect infections from other nodes in the network. However, the cyber
attacks are taken as random inputs rather than a strategic adversary. The
moral hazard model in economics literature holmstrom1979moral ;
holmstrom1982moral  deal with hidden actions from an agent, and aims to
address the question: How does a principal design the agent’s wage contract to
maximize his effort? This framework is related to insurance markets and has
been used to model cyber insurance bolot2009cyber  as a solution for
mitigating losses from cyber attacks. In addition, in acemoglu2013network ,
the authors have studied a security investment problem in a network with
externality effect. Each node determines his security investment level and
competes with a strategic attacker. Their model does not focus on the
insurance policies and hidden-action framework. In this work, we enrich the
moral-hazard type of economic frameworks by incorporating attack models, and
provide a holistic viewpoint towards cyber insurance and a systematic approach
to design insurance policies. The network effect on security decision process
has been studied in miura2008security . The authors have considered a
variation of the linear influence networks model in which each node represents
a network company and directed links model the positive or negative influence
between neighbor nodes.

Game-theoretic models are natural frameworks to capture the adversarial and
defensive interactions between players zhu2018multi ; rass2017physical ;
zhuang2010modeling ; miao2018hybrid ; farhang2014dynamic ; manshaei2013game ;
zhu2013deployment ; zhang2017strategic ; horak2017manipulating ;
huang2017large . Game theory can provide a quantitative measure of the quality
of protection with the concept of Nash equilibrium where both defender and an
attacker seek optimal strategies, and no one has an incentive to deviate
unilaterally from their equilibrium strategies despite their conflict for
security objectives. The equilibrium concept also provides a quantitative
prediction of the security outcomes of the scenario the game model captures.
There are various types of game models that can capture different class of
adversaries. For example, games of incomplete information are suitable for
understanding cyber deception pawlick2018modeling ; zhang2017strategic ;
horak2017manipulating ; pawlick2017game ; pawlick2015deception ;
zhuang2010modeling ; dynamic games are useful for modeling cyber-physical
system security xu2017secure ; xu_game-theoretic_2017 ; xu_cross-layer_2016 ;
xu2015cyber ; huang2017large ; chen2017dynamic ; miao2018hybrid ;
yuan2013resilient ; and zerosum and Stackelberg games for security risk
management zhang2018game ; zhang2015secure ; wang2017detection ; zhang2017game
; pawlick_stackelberg_2016 ; pawlick_mean-field_2017 . In this work, we build
a zerosum game between an attacker and a defender to quantify the
cybersecurity risks associated with adversarial behaviors. This game model is
nested in the principle-agent game models to establish an integrated framework
that captures the defender, the attacker, and the insurer.

##  3 Three-Person Game Framework for Cyber Insurance

In this section, we introduce a principal-agent model for cyber insurance that
involve users and insurers. Users here can refer to an infrastructure operator
that manages cyber networks that face threats from an attacker, making users
vulnerable to data breaches, task failures, and severe financial losses. The
objective of the users is to find an efficient way to mitigate the loss due to
the cyber attacks. To this end, there are two main approaches. One is to
deploy local protections, such as firewalls and intrusion detection systems
(IDSs) raiyn2014survey ; axelsson2000intrusion , frequent change of passwords,
timely software patching and proactive moving target defenses
jajodia2011moving . These defense mechanisms can reduce the success rate of
the attacks, but cannot guarantee perfect network security for users. There
are still chances for the users to be hacked by the attackers. The other
approach is to adopt cyber-insurance. The users pay a premium fee so that the
loss due to cyber attacks can be compensated by the insurer. This mechanism
provides an additional layer of mitigation to reduce the loss further that the
technical solutions of the first approach cannot prevent. To capture the two
options in our framework, we allow users to decide their protection levels as
well as their rational choice of participation in the insurance program.

Attackers are the adversaries who launch cyber-attacks, such as node capture
attackstague2008modeling  and denial of services (DoS) attacks
jhaveri2012attacks , to acquire private data from users or cause disruptions
of the network services. Hence, the objective of the attacker is to find an
efficient attack strategy to inflict as much damage to the users as possible.
We use attack levels to represent different attack strategies to capture
various types of attacks of different levels of severity. A higher attack
level is more costly to launch, but it will create more severe damage. Since
the loss of the users not only depends on the attack strategies but also
insurance policies. The optimal strategy of the attacker will also be
influenced by the coverage levels of an insurance policy.

An insurer is a person or company that underwrites an insurance risk by
providing users an incentive compatible cyber-insurance policy that includes a
premium and the level of coverage. The premium is a subscription fee that is
paid by the users to participate in the insurance program while the coverage
level is the proportion of loss that will be compensated by the insurer as a
consequence of successful cyber attacks. The insurers have two objectives. One
is to make a profit from providing the insurance, and the other one is to
reduce the average losses of the users, which is also directly related to the
cost of the insurer. An insurer’s problem is to determine the subscription fee
and the coverage levels of the insurance. Note that the average losses depend
on both users’ local protection levels and attackers’ attack levels. Moreover,
the rational users will only enroll in the insurance when the average
reduction in the cost is higher than or equal to the premium he paid to the
insurer.

The objectives of users, attackers, and insurers, and the effects of their
actions are all intertwined. We use a 3-player game to capture the complex
interactions among the three parties. The conflicting objectives of a user and
an attacker can be captured by a local game at each node in which the user
determines a defense strategy while the adversary chooses an attack strategy.
The outcome of the local interactions at each node determines its cyber risk
and the cyber insurance is used as an additional method to further reduce the
loss due to the cyber risk. The insurers are the leaders or principals in the
framework who design insurance policies for the users while the users can be
viewed as followers or agents who determine their defense strategies under a
given insurance policy.

Figure 1: Three-player game among user, attacker, and the insurer.

###  3.1 Attack-Aware Cyber Insurance

We first formulate the game between the user and the attacker, then we
describe the insurer’s problem under the equilibrium of the user and the
attacker’s game. An illustration of the cyber-insurance model is shown in Fig.
2.

Figure 2: Illustration of the interactions between three players: The action
pair $(p_{u},p_{a})$ chosen by the user and the attacker results in a risk
level not directly observable by the insurer. The insurer designs an insurance
policy that includes a premium subscription fee and the coverage level to
cover part of the loss due to the cyber attack.

Let $p_{u}\in[0,1]$ and $p_{a}\in[0,1]$ denote the local protection level of
the user and the attack level of the attacker. On one hand, a large $p_{u}$
indicates a cautious user while a small $p_{u}$ indicates that the user is
reckless. A reckless user may click on suspicious links of received spam
emails, fail to patch the computer system frequently, and leave cyber
footprints for an adversary to acquire system information. On the other hand,
a large $p_{a}$ indicates a powerful attacker, and a small $p_{a}$ indicates a
powerless attacker. The abstraction of using $p_{u}$ and $p_{a}$ captures the
effectiveness of a wide range of heterogeneous defense and attack strategies
without a fine-grained modeling of individual mechanisms. This will allow us
to focus on the consequence of security issues and the choice of a mechanism
that induces the result.

The action pair of the user and the attacker $(p_{u},p_{a})$ determines the
risk level of the user $R\in\mathbb{R}_{\geq 0}$. A larger $p_{u}$ and a
smaller $p_{a}$ indicate a higher risk level of the user. We use the following
risk function $r$ to denote the connections between the user’s and the
attacker’s actions and the risk level of the user.

###### Definition 1

Function $r(p_{u},p_{a}):[0,1]^{2}\rightarrow\mathbb{R}_{\geq 0}$ gives the
risk level $R$ of the user with respect to the user’s local protection level
$p_{u}$ and the attack’s attack level $p_{a}$. Moreover, it is assumed to be
continuous on $(0,1]^{2}$, convex and monotonically decreasing on
$p_{u}\in[0,1]$, and concave and monotonically increasing in $p_{a}\in[0,1]$.

Note that the monotonicity in $p_{u}\in[0,1]$ indicates that a larger local
protection level of user leads to a smaller risk level of user while the
monotonicity in $p_{a}\in[0,1]$ indicates that a larger attack level of
attacker leads to a larger risk level of user. Since $r$ is convex on $p_{u}$,
the risk decreases smaller when the user adopts larger local protection level.
Since $r$ is concave on $p_{a}$, the risk increases faster when the attacker
conducts a higher attack level. Without loss of generality, we use the
following risk function,

$r(p_{u},p_{a})=\log\left(\frac{p_{a}}{p_{u}}+1\right).$ (1)

Similar types of functions have also been widely used in jamming attacks in
wireless networks manshaei2013game ; altman2007jamming  and rate control
problems kelly1998rate ; zhu2012guidex . Under the risk level of $R$, the
economic loss of the user can be represented as a random variable $X$ measured
in dollars, which can be expressed as $X={G}(R,\theta)$, where $\theta$ is a
random variable with probability density function $g$ that captures the
uncertainties in the measurement or system parameters. For example, a data
breach due to the compromise of a server can be a consequence of low security
level at the user end. The magnitude of the loss depends on the content and
the significance of the data, and the extent of the breach. The variations in
these parameters are captured by the random variable $\theta$. Since the risks
of being attacked cannot be perfectly eliminated, the user can transfer the
remaining risks to the third party, the insurer, by paying a premium or
subscription fee $T$ for a coverage of $S(X)$ when he faces a loss of $X$,
where $S:\mathbb{R}_{\geq 0}\rightarrow\mathbb{R}_{\geq 0}$ is the payment
function that reduces the loss of the user if he is insured. Thus, the
effective loss $\xi$ to the user becomes $\xi=X-S(X)$.

Given the attacker’s action $p_{a}$ and the insurer’s coverage function $S$,
the user aims to minimize the average effective loss by finding the optimal
local protection level $p_{u}^{*}$. Such objective can be captured by the
following optimization problem

$\min\limits_{p_{u}\in[0,1]}\mathbb{E}[H(\xi)]=\mathbb{E}[H(X-S(X))],$ (2)

where $H:\mathbb{R}_{\geq 0}\rightarrow\mathbb{R}_{\geq 0}$ is the loss
function of the user, which is increasing on $\xi$. Note that the expectation
is taken with respect to the statistics of $\theta$. The subscription fee $T$
is not included in this optimization problem, as the fee is a constant decided
by the insurer.

The loss function $H(\xi)$ indicates the user’s risk propensity. A convex
$H(\xi)$ indicates that the user is risk-averse, i.e., the user cares more
about the risk, while a concave $H(\xi)$ indicates that the user is risk-
taking, i.e., he cares more about the cost, rather than the risk. A linear
$H(\xi)$ in $\xi$ indicates that the user is risk-neutral. In this paper, we
consider a risk-averse user, and use a typical risk-averse loss function that
$H(\xi)=e^{\gamma\xi}$ with $\gamma>0$, where $\gamma$ indicates how much the
user cares about the loss.

Note that the cost function in (2) can be expressed explicitly as a function
of $X$. Thus, Problem (2) can be rewritten by taking expectations with respect
to the sufficient statistics of $X$. Let $f$ be the probability density
function of $X$. Clearly, $f$ is a transformation from the density function
$g$ (associated with the random variable $\theta$) under the mapping ${G}$. In
addition, $g$ also depends on the action pair $(p_{u},p_{a})$ through the risk
variable $R$. Therefore, we can write $f(x|p_{u},p_{a})$ to capture the
parameterization of the density function. Without loss of generality, we
assume that $X$ follows an exponential distribution, i.e.,
$X\sim\exp(\frac{1}{R})$, where $R:=r(p_{u},p_{a})$ is the risk level of the
user. The exponential distribution has been widely used in risk and
reliability analysisminkova2010insurance ; finkelstein2008failure ;
balakrishnan1996exponential ; christoffersen2004backtesting . Thus the density
function can be written as

$\displaystyle f(x|p_{u},p_{a})$ $\displaystyle=$
$\displaystyle\frac{1}{R}e^{-\frac{1}{R}x}=\frac{1}{r(p_{u},p_{a})}e^{-\frac{1}{r(p_{u},p_{a})}x}$
$\displaystyle=$
$\displaystyle\frac{1}{\log(\frac{p_{a}}{p_{u}}+1)}e^{-\frac{1}{\log(\frac{p_{a}}{p_{u}}+1)}x},\forall
x\in\mathbb{R}_{\geq 0}.$

The average amount of loss given actions $p_{u}$ and $p_{a}$ is
$\mathbb{E}(X)=R=r(p_{u},p_{a})=\log(\frac{p_{a}}{p_{u}}+1)$. For small
$p_{u}$ and large $p_{a}$, the risk level of the user $R$ tends to be large,
which leads to a large average loss of the user. We further assume that the
insurance policy $S(X)$ is linear in $X$, i.e., $S(X)=sX$, where $s\in[0,1]$
indicates the coverage level of the insurance. Hence, the effective loss is
given by $\xi=(1-s)X$. The average effective loss given the insurance coverage
level $s$ and the action pair $(p_{u},p_{a})$ is
$\mathbb{E}(\xi)=\mathbb{E}((1-s)X)=(1-s)\mathbb{E}(X)=(1-s)\log(\frac{p_{a}}{p_{u}}+1)$.
When $s$ is large, the effective loss is small. As a result, we arrive at

$\begin{array}[]{l}\mathbb{E}[H(\xi)]:=\displaystyle\int_{x_{i}\in\mathbb{R}_{\geq
0}}H(x-S(x))f(x|p_{u},p_{a})dx\\\ \textrm{\ \ \ \ \ \ \ \ \ \
}=\frac{1}{R}\displaystyle\int_{0}^{\infty}e^{[\gamma(1-s)-\frac{1}{R}]x}dx\\\
\textrm{\ \ \ \ \ \ \ \ \ \ }=\frac{1}{1-\gamma(1-s)R}\\\ \textrm{\ \ \ \ \ \
\ \ \ \ }=\frac{1}{1-\gamma(1-s)\log(\frac{p_{a}}{p_{u}}+1)}.\end{array}$ (3)

The loss is finite when

$\gamma(1-s)-\frac{1}{R}<0,\textrm{\ i.e., \
}1-\gamma(1-s)\log(\frac{p_{a}}{p_{u}}+1)>0.$ (4)

Otherwise, the loss will be infinite, i.e.,
$\mathbb{E}[H(\xi)]\rightarrow\infty$. In this regime, no insurance scheme can
be found to mitigate the loss. Condition (4) gives a feasible set of
parameters under which cyber insurance is effective and provides a fundamental
limit on the level of mitigation. Note that minimizing (3) is equivalent as
minimizing $\gamma(1-s)\log(\frac{p_{a}}{p_{u}}+1)$ under the feasible
equality (4). The user’s problem can be rewritten as follows:

$\begin{array}[]{l}\min\limits_{p_{u}\in[0,1]}J_{u}(p_{u},p_{a},s):=\gamma(1-s)R=\gamma(1-s)\log(\frac{p_{a}}{p_{u}}+1)\\\
\begin{array}[]{cc}{\textrm{s.t.}}&{1-\gamma(1-s)\log(\frac{p_{a}}{p_{u}}+1)>0.}\end{array}\end{array}$
(5)

Problem (5) captures the user’s objective to minimize average effective loss
given the attack level $p_{a}$ and the insurance coverage level $s$. On the
other hand, the attacker aims to find the optimal attack level $p_{a}^{*}$
that maximizes the average loss of the user given user’s local protection
level and insurer’s coverage level $s$. Such conflicting interests of the user
and the attacker constitutes a zero-sum game, which takes the following
minimax or max-min form,

$\begin{array}[]{ccc}{\begin{array}[]{l}\min\limits_{p_{u}\in[0,1]}\max\limits_{p_{a}\in[0,1]}K(p_{u},p_{a},s)\\\
\begin{array}[]{cc}{\textrm{s.t.}}&{(p_{u},p_{a})\in\mathcal{S}_{u,a}(s).}\end{array}\end{array}}&{\textrm{\
\ \ or \ \ \
}}&{\begin{array}[]{l}\max\limits_{p_{a}\in[0,1]}\min\limits_{p_{u}\in[0,1]}K(p_{u},p_{a},s)\\\
\begin{array}[]{cc}{\textrm{s.t.}}&{(p_{u},p_{a})\in\mathcal{S}_{u,a}(s).}\end{array}\end{array}}\end{array}$
(6)

where

$K(p_{u},p_{a},s):=\gamma(1-s)R+c_{u}p_{u}-c_{a}p_{a}=\gamma(1-s)\log(\frac{p_{a}}{p_{u}}+1)+c_{u}p_{u}-c_{a}p_{a},$
(7)
$\mathcal{S}_{u,a}(s):=\left\\{(p_{u},p_{a})\Big{|}1-\gamma(1-s)\log(\frac{p_{a}}{p_{u}}+1)>0\right\\}.$
(8)

The first term of the objective function $K$ captures the average effective
loss given insurance coverage level $s$, the local protection level $p_{u}$
and the attack level $p_{a}$. The second and third terms indicate the cost of
the user and the attacker, respectively. $c_{u}\in\mathbb{R}_{>0}$ is the cost
parameter of the user. A larger $c_{u}$ indicates that local protection is
costly. $c_{a}\in\mathbb{R}_{>0}$ denotes the cost parameter of the attacker
to conduct an attack level of $p_{a}$. A larger $c_{u}$ indicates that a
cyber-attack is costly. Note that $c_{u}$ and $c_{a}$ can be interpreted as
the market price of local protections and cyber-attacks, and they are known by
the insurer. The constraint indicates the feasible set of the user. Note that
if $s$, $p_{u}$, and $p_{a}$ are not feasible, $K$ is taken to be an infinite
cost. Minimizing $K(p_{u},p_{a},s)$ captures the user’s objective to minimize
the average effective loss with the most cost-effective local protection
level. Maximizing $K(p_{u},p_{a},s)$ captures the attacker’s objective to
maximize the average effective loss of the user with least attack level. Note
that the minimax form of (6) can be interpreted as a worst-case solution for a
user who uses the best security strategies by anticipating the worst-case
attack scenarios.

Furthermore, Problem (6) yields a saddle-point equilibrium (SPE) to the
insurance coverage level $s$ which can be defined as follows:

###### Definition 2

Let $\mathcal{S}_{u}(s)$, $\mathcal{S}_{a}(s)$ and $\mathcal{S}_{u,a}(s)$ be
the action sets for the user and the attacker given an insurance coverage
level $s$. Then the strategy pair $(p_{u}^{*},p_{a}^{*})$ is a saddle-point
equilibrium (SPE) of the zero-sum game defined by the triple
$G_{z}:=\langle\\{User,Attacker\\},\\{\mathcal{S}_{u}(s),\mathcal{S}_{a}(s),\mathcal{S}_{u,a}(s)\\},K\rangle$,
if for all
$p_{u}\in\mathcal{S}_{u}(s),p_{a}\in\mathcal{S}_{a}(s),(p_{u},p_{a})\in\mathcal{S}_{u,a}(s)$,

$\begin{array}[]{cr}{K(p_{u}^{*},p_{a},s)\leq K(p_{u}^{*},p_{a}^{*},s)\leq
K(p_{u},p_{a}^{*},s),}&{}\hfil\end{array}$ (9)

where $K$ and $\mathcal{S}_{u,a}(s)$ is the objective function and feasible
set defined in (7) and (8).

The definition indicates that if a pair $(p_{u}^{*},p_{a}^{*})$ satisfies (9),
then it is a SPE of the game between the user and the attacker to the
insurer’s insurance policy. Note that under a given insurance coverage level
$s$, $(p_{u}^{*},p_{a}^{*})$ must satisfy the feasible constraint (4). Thus,
we aim to look for a constrained SPE of the zero-sum game with coupled
constraints on the strategies of the players.

###### Proposition 1

Given an insurance coverage level $s$ that satisfies

$1-\gamma(1-s)\log\left(\frac{c_{u}}{c_{a}}+1\right)>0,$ (10)

there exists a unique SPE of the zero-sum game defined in Definition 2, given
by

$\begin{array}[]{cc}{p_{u}^{*}=\frac{\gamma(1-s)}{c_{u}+c_{a}},}&{p_{a}^{*}=\frac{c_{u}\gamma(1-s)}{c_{a}(c_{u}+c_{a})}.}\end{array}$
(11)

Proposition 1 shows that the SPE of the zero-sum game between the user and the
attacker is related to the insurer’s policy $s$. Note that when $s$ is large,
both the $p_{u}^{*}$ and $p_{a}^{*}$ is small, indicating that both the user
and the attacker will take weak actions. Moreover, we have the following
observations regarding the SPE.

######  Remark 1 (Peltzman Effect)

When the insure provides higher coverage level $s$, the SPE of the user
$p_{u}^{*}$ tend to be smaller, i.e., the user takes a weaker local
protection. Such risky behavior of the user in response to insurance is
usually referred as Peltzman effect peltzman1975effects .

######  Corollary 1 (Invariability of The SPE Ratio)

The SPE satisfies $\frac{p_{a}^{*}}{p_{u}^{*}}=\frac{c_{u}}{c_{a}}$, i.e., the
ratio of the actions of the user and the attacker is only related to $c_{u}$
and $c_{a}$, and it is independent of the insurer’s policy $s$. In particular,
when $c_{u}=c_{a}$, $\frac{p_{a}^{*}}{p_{u}^{*}}=1$, i.e., the SPE becomes
symmetric, as
$p_{u}^{*}=p_{a}^{*}=\frac{\gamma(1-s)}{c_{u}+c_{a}}=\frac{\gamma(1-s)}{2c_{u}}=\frac{\gamma(1-s)}{2c_{a}}$.

######  Remark 2 (Constant Cost Determined SPE Risk)

The user has a constant saddle-point risk level
$R^{*}=r(p_{u}^{*},p_{a}^{*})=\log\left(\frac{p_{a}^{*}}{p_{u}^{*}}+1\right)=\log\left(\frac{c_{u}}{c_{a}}+1\right)$
at the equilibrium, which is determined by the costs of adopting protections
and launching attacks. The ratio is independent of coverage level $s$.

###### Corollary 2

At the saddle point, the average direct loss of the user is
$\mathbb{E}(X)=R^{*}=\log\left(\frac{c_{u}}{c_{a}}+1\right)$, the average
effective loss of the user is
$\mathbb{E}(\xi)=\mathbb{E}((1-s)X)=(1-s)\mathbb{E}(X)=(1-s)R^{*}=(1-s)\log\left(\frac{c_{u}}{c_{a}}+1\right)$,
the average payment of the insurer to the user is
$\mathbb{E}(sX)=s\mathbb{E}(X)=sR^{*}=s\log\left(\frac{c_{u}}{c_{a}}+1\right)$.

Corollary 1 indicates the constant saddle-point strategy ratio of the user and
the attacker, which is determined only by the cost parameters $c_{u}$ and
$c_{a}$, i.e., the market prices or costs for applying certain levels of
protections and attacks, respectively. As a result, the saddle-point risk
level of the user is constant, and only determined by the market as shown in
Remark 2. Thus, the average direct loss is constant as shown in Corollary 2.
However, when the insurance coverage level $s$ does not satisfy (10), the
insurability of the user is not guaranteed, which is shown in the following
proposition.

######  Proposition 2 (Fundamental Limits on Insurability)

Given an insurance coverage level $s$ that
$1-\gamma(1-s)\log\left(\frac{c_{u}}{c_{a}}+1\right)\leq 0$,
$(p_{u}^{*},p_{a}^{*})$ does not satisfy the feasible inequality (4), thus,
the average direct of the user $\mathbb{E}(X)\rightarrow\infty$, and the zero-
sum game defined in Definition 2 does not admit a SPE. Thus, the user is not
insurable, as the insurance policy cannot mitigate his loss. The insurer will
not also provide insurance to the user who is not insurable.

###### Proposition 3

Under an insurable scenario, the cost parameter of the user must satisfy
$c_{u}<c_{a}(1-e^{-\gamma(1-s)})$, and the local protection level of the user
must satisfy $p_{u}>\frac{\gamma(1-s)}{c_{a}}e^{\gamma(1-s)}$.

###### Proof

The first inequality can be easily achieved from (10). From Appendix A, given
the action of the user $p_{u}$, the best action of the attacker is
$P_{a}^{*}(p_{u})=\frac{\gamma(1-s)}{c_{a}}-p_{u}$. By plugging
$P_{a}^{*}(p_{u})$ into the feasible inequality (4), we can get
$p_{u}>\frac{\gamma(1-s)}{c_{a}}e^{\gamma(1-s)}$.

It is important to note that the user must pay a subscription fee
$T\in\mathbb{R}_{\geq 0}$ to be insured. The incentive for the user to buy
insurance exists when the average loss at equilibrium under the insurance is
lower than the loss incurred without insurance. If the amount of the payment
from the insurer is low, then the user tends not to be insured. In addition,
if the payment is low, then the risk for the insurer will be high and the user
may behave recklessly in the cyber-space.

###  3.2 Insurer’s Problem

The insurer announces the insurance policy $\\{s,T\\}$, where $s$ indicates
the coverage level, $T$ indicates the subscription, and then the user’s and
the attacker’s conflicting interests formulates a zero-sum game, which yields
a unique solution as shown in Proposition 1, with the corresponding
equilibrium loss as shown in Corollary 2. Note that $T$ is the gross profit of
the insurer as he charges it from the user first, but when the user faces a
loss $X$, the insurer must pay $sX$ to the user. The operating profit of the
insurer can be captured as $T-sX$. The insurer cannot directly observe the
actions of the user and the attacker. However, with the knowledge of the
market, i.e., the cost parameters of the user $c_{u}$ and the attacker
$c_{a}$, the insurer aims to minimize the average effective loss of the user
while maximizing his operating profit.

Recall Corollary 2, the average effective loss of the user at saddle-point is
$\mathbb{E}(\xi)=(1-s)\mathbb{E}(X)=(1-s)R^{*}=(1-s)\log\left(\frac{c_{u}}{c_{a}}+1\right)$,
which is monotonically decreasing on $s$. When the user is under full
coverage, the average loss with the payment $T$ is
$(1-s)R^{*}+T\big{|}_{s=1}=T$. When the user does not subscribe to an
insurance, the average direct loss is $R^{*}$. Thus, the user has no incentive
to insure if the cost under fully coverage is higher than that under no
insurance, i.e., $T>R^{*}$. Moreover, for $T\leq R^{*}$, the user will choose
to insure if the average loss under the given coverage level $s$ is lower than
under no insurance, i.e., $(1-s)R^{*}+T\leq R^{*}$. Therefore, we arrive at
the following conditions.

######  Condition 1 (Individual Rationality (IR-$u$))

The subscription fee must satisfy $T\leq
T_{max}:=R^{*}=\log\left(\frac{c_{u}}{c_{a}}+1\right)$, so that the user
prefer to subscribe the insurance.

######  Condition 2 (Incentive Compatibility (IC-$u$))

For the subscription fee $T\leq T_{\max}$, the user will subscribe the
insurance if the coverage level $s$ satisfies $s\geq
s_{0}=\frac{T}{R^{*}}=\frac{T}{\log\left(\frac{c_{u}}{c_{a}}+1\right)}$.

Inequalities in Condition 1 and Condition 2 are known as individual
rationality (IR-$u$) constraint and incentive compatibility (IC-$u$)
constraint, respectively. The user will enroll only when (IR-$u$) and (IC-$u$)
constraints are satisfied. Note that when $c_{u}$ is large and $c_{a}$ is
small, i.e., the saddle-point risk level $R^{*}$ is high, $T_{\max}$ is large
and $s_{0}(T)$ is small, i.e., when the cost of the user to put local
protections is large, and the cost of the attacker to conduct cyber-attack is
small, the price of the subscription fee is large, but the minimum coverage is
low. Note that $s_{0}$ is monotonically increasing on $T$, moreover, when
$T=0$, $s=0$, i.e., the user will accept any coverage level when there is no
charge for the insurance premium. When $T=T_{\max}$, $s=1$, i.e., the user
only accept a full coverage when the subscription fee is the maximum.

The insurer charges a subscription fee $T$ from the user, i.e., the insurer
has a gross profit of $T$. However, the insurer also pays the user an average
amount of $sR^{*}=s\log\left(\frac{c_{u}}{c_{a}}+1\right)$ from Corollary 2.
Thus, the average operating profit of the insurer is $T-sR^{*}$, which must be
larger than or equal to $0$ so that the insurer will provide the insurance.
Thus, we have the following condition.

######  Condition 3 (Individual Rationality (IR-$i$))

The insurer will provide the insurance if
$T-sR^{*}=T-s\log\left(\frac{c_{u}}{c_{a}}+1\right)\geq 0$.

Recall Proposition 2, the insurer will provide the insurance when the user is
insurable, i.e., inequality (10) must be satisfied. Thus, we reach the
following proposition that indicates the feasible coverage level.

######  Condition 4 (Feasibility (F-$i$))

The coverage level $s$ is feasible, i.e., the user is insurable, when
$s>1-\frac{1}{\gamma\log\left(\frac{c_{u}}{c_{a}}+1\right)}$.

Condition 3 and Condition 4 indicate the individual rationality constraint
(IR-$i$) and the feasibility constraint (F-$i$) of the insurer, respectively.
With the (IR-$u$) and (IC-$u$) constraints for the user and the (IR-$i$) and
(F-$i$) constraints for the insurer, the insurer’s objective to minimize the
average effective loss of the user and maximize the operating profit can be
captured using the following optimization problem:

$\begin{array}[]{l}\min\limits_{\\{0\leq s\leq 1,T\geq
0\\}}J_{i}(s,T):=\gamma(1-s)\log\left(\frac{c_{u}}{c_{a}}+1\right)+c_{s}(s\log(\frac{c_{u}}{c_{a}}+1)-T)\\\
\begin{array}[]{cc}{\textrm{s.t.}}&{\textrm{(IR-$u$)},\textrm{(IC-$u$)},\textrm{(IR-$i$)},\textrm{(F-$i$)}.}\end{array}\end{array}$
(12)

Note that the first term of the objective function is the average effective
loss of the user under the coverage $s$, as the insurer also aims to reduce
the loss of the user from the attacker. Minimizing the second term of the
objective function captures the insurer’s objective of making profit. Note
that parameter $c_{s}$ indicates the trade-off of a safer user and a larger
profit of the insurer.

Furthermore, the solution of Problem (12) and the corresponding SPE defined in
Definition 2 yields an equilibrium for the bi-level game in Case 1 which can
be defined as

###### Definition 3

Let $\mathcal{S}_{i}$ be the action set for the insurer, $\mathcal{S}_{u}(s)$
and $\mathcal{S}_{a}(s)$ be the action sets for the user and the attacker
given the insurance coverage level, the strategy pair
$(p_{u}^{*},p_{a}^{*},\\{s^{*},T^{*}\\})$ is called a bi-level game Nash
equilibrium (BGNE) of the bi-level game in Case 1 defined by the triple
$G_{\textrm{1}}:=\left<\\{User,Attacker,Insurer\\},\\{\mathcal{S}_{u}(s),\mathcal{S}_{a}(s),\mathcal{S}_{i}\\},K,J_{i}\right>$,
if $\\{s^{*},T^{*}\\}$ solves Problem (12) with the BGNE objective function
$J_{i}^{*}$, and the strategy pair $(p_{u}^{*},p_{a}^{*})$ is the SPE of the
zero-sum game defined in Definition 2 with the SPE objective function $K^{*}$
under the insurance policy $\\{s^{*},T^{*}\\}$.

Note that the insurer’s Problem (12) is a linear programming problem as the
objective function and all the constraints are linear in $s$ and $T$. Instead
of solving this problem, we first observe that (IR-$i$) and (IC-$u$) together
indicate that the insurance policy $s$ and $T$ must satisfy

$T=sR^{*}=s\log\left(\frac{c_{u}}{c_{a}}+1\right).$ (13)

###### Corollary 3

Equality (13) indicates the following observations:

  * (i)

Zero Operating Profit Principle: The insurer’s operating profit is always $0$,
as $T-sR^{*}=0$.

  * (ii)

Linear Insurance Policy Principle: The insure can only provide the insurance
policy $s$ and $T$ that satisfies (13), so that the user subscribes to the
insurance and the insurer provides the insurance.

Corollary 3 reveals a zero operating profit principle and a linear insurance
policy principle for the insurer. These principles hold in Case 2 and 3 as
well. With (13), the linear insurance policy indicates that the ratio of the
subscription and the coverage level only depends on the saddle-point risk
$R^{*}$, which is determined by the costs seen in Remark 2. It provides a
fundamental principle for designing the insurance policy.

With (13), the optimal insurance for the insurer can be summarized using the
following proposition.

###### Proposition 4

The optimal insurance policy for the insurer is

$s^{*}=1\textrm{\ \ \ }T^{*}=T_{\max}=\log\left(\frac{c_{u}}{c_{a}}+1\right).$
(14)

Proposition 4 shows that a full coverage level and a maximum subscription fee
are the optimal insurance policy of the insurer. Together with Proposition 1,
we have the following proposition of the BGNE of the bi-level game in Case 1.

###### Proposition 5

The bi-level game of Case 1 admits a unique BGNE solution
$(p_{u}^{*},p_{a}^{*},\\{s^{*},T^{*}\\})=(0,0,\\{1,\log\left(\frac{c_{u}}{c_{a}}+1\right)\\})$.
At the equilibrium, the insurer provides a full coverage for the user and
charges a maximum subscription fee from the user. The user and attacker have
no incentives to take actions at the equilibrium as the cost would be too
high. The equilibrium also demonstrates that cyber insurance will effectively
mitigate the loss.

The analysis of the bi-level structure of the game informs the optimal
insurance policies to transfer risks from one node to the insurer. The
framework can also be extended to a scheme over interdependent infrastructures
as illustrated in Fig. 3. The cyber risks at one node can propagate to other
nodes when there are cyber, physical, human, and social interdependencies. The
insurance of one node can play a important role in well-being of the entire
system. We can anticipate that the insurance problem should take into account
network effects. This research can also be further extended to investigate the
impact of dynamic evolutions of the risks on the mechanism of insurance and
the protection behaviors of the agents.

Figure 3: Cyber insurance over interdependent infrastructures

## References

  * (1) Acemoglu, D., Malekian, A., Ozdaglar, A.: Network security and contagion.  Tech. rep., National Bureau of Economic Research (2013)
  * (2) Altman, E., Avrachenkov, K., Garnaev, A.: A jamming game in wireless networks with transmission cost.  In: Network Control and Optimization, pp. 1–12. Springer (2007)
  * (3) Anderson, R., Moore, T.: The economics of information security.  Science 314(5799), 610–613 (2006)
  * (4) Axelsson, S.: Intrusion detection systems: A survey and taxonomy.  Tech. rep., Technical report Chalmers University of Technology, Goteborg, Sweden (2000)
  * (5) Balakrishnan, K.: Exponential distribution: theory, methods and applications.  CRC press (1996)
  * (6) Bolot, J., Lelarge, M.: Cyber insurance as an incentivefor internet security.  In: Managing information risk and the economics of security, pp. 269–290. Springer (2009)
  * (7) Chen, J., Touati, C., Zhu, Q.: A dynamic game analysis and design of infrastructure network protection and recovery.  ACM SIGMETRICS Performance Evaluation Review 45(2), 128 (2017)
  * (8) Christoffersen, P., Pelletier, D.: Backtesting value-at-risk: A duration-based approach.  Journal of Financial Econometrics 2(1), 84–108 (2004)
  * (9) Farhang, S., Manshaei, M.H., Esfahani, M.N., Zhu, Q.: A dynamic bayesian security game framework for strategic defense mechanism design.  In: International conference on decision and game theory for security, pp. 319–328. Springer (2014)
  * (10) Finkelstein, M.: Failure rate modelling for reliability and risk.  Springer Science & Business Media (2008)
  * (11) Greengard, S.: The new face of war.  Communications of the ACM 53(12), 20–22 (2010)
  * (12) Hölmstrom, B.: Moral hazard and observability.  The Bell journal of economics pp. 74–91 (1979)
  * (13) Holmstrom, B.: Moral hazard in teams.  The Bell Journal of Economics pp. 324–340 (1982)
  * (14) Horák, K., Zhu, Q., Bošanskỳ, B.: Manipulating adversary?s belief: A dynamic game approach to deception by design for proactive network security.  In: International Conference on Decision and Game Theory for Security, pp. 273–294. Springer (2017)
  * (15) Huang, L., Chen, J., Zhu, Q.: A large-scale markov game approach to dynamic protection of interdependent infrastructure networks.  In: International Conference on Decision and Game Theory for Security, pp. 357–376. Springer (2017)
  * (16) Jajodia, S., Ghosh, A.K., Swarup, V., Wang, C., Wang, X.S.: Moving target defense: creating asymmetric uncertainty for cyber threats, vol. 54.  Springer Science & Business Media (2011)
  * (17) Jhaveri, R.H., Patel, S.J., Jinwala, D.C.: Dos attacks in mobile ad hoc networks: A survey.  In: Advanced Computing & Communication Technologies (ACCT), 2012 Second International Conference on, pp. 535–541. IEEE (2012)
  * (18) Kelly, F.P., Maulloo, A.K., Tan, D.K.: Rate control for communication networks: shadow prices, proportional fairness and stability.  Journal of the Operational Research society pp. 237–252 (1998)
  * (19) Kesan, J., Majuca, R., Yurcik, W.: Cyberinsurance as a market-based solution to the problem of cybersecurity: a case study.  In: Proc. WEIS (2005)
  * (20) Lelarge, M., Bolot, J.: A local mean field analysis of security investments in networks.  In: Proceedings of the 3rd international workshop on Economics of networked systems, pp. 25–30. ACM (2008)
  * (21) Manshaei, M.H., Zhu, Q., Alpcan, T., Bacşar, T., Hubaux, J.P.: Game theory meets network security and privacy.  ACM Computing Surveys (CSUR) 45(3), 25 (2013)
  * (22) McMillan, R.: Siemens: Stuxnet worm hit industrial systems.  Computerworld 14 (2010)
  * (23) Miao, F., Zhu, Q., Pajic, M., Pappas, G.J.: A hybrid stochastic game for secure control of cyber-physical systems.  Automatica 93, 55–63 (2018)
  * (24) Minkova, L.D.: Insurance risk theory.  Lecture notes, TEMPUS Project SEE doctoral studies in mathematical sciences (2010)
  * (25) Miura-Ko, R., Yolken, B., Mitchell, J., Bambos, N.: Security decision-making among interdependent organizations.  In: Computer Security Foundations Symposium, 2008. CSF’08. IEEE 21st, pp. 66–80. IEEE (2008)
  * (26) Pal, R., Golubchik, L., Psounis, K., Hui, P.: Will cyber-insurance improve network security? a market analysis.  In: INFOCOM, 2014 Proceedings IEEE, pp. 235–243. IEEE (2014)
  * (27) Pawlick, J., Colbert, E., Zhu, Q.: A game-theoretic taxonomy and survey of defensive deception for cybersecurity and privacy.  arXiv preprint arXiv:1712.05441 (2017)
  * (28) Pawlick, J., Colbert, E., Zhu, Q.: Modeling and analysis of leaky deception using signaling games with evidence.  IEEE Transactions on Information Forensics and Security 14(7), 1871–1886 (2018)
  * (29) Pawlick, J., Zhu, Q.: Deception by design: evidence-based signaling games for network defense.  arXiv preprint arXiv:1503.05458 (2015)
  * (30) Pawlick, J., Zhu, Q.: A Stackelberg game perspective on the conflict between machine learning and data obfuscation.  In: Information Forensics and Security (WIFS), 2016 IEEE International Workshop on, pp. 1–6. IEEE (2016).  URL http://ieeexplore.ieee.org/abstract/document/7823893/
  * (31) Pawlick, J., Zhu, Q.: A Mean-Field Stackelberg Game Approach for Obfuscation Adoption in Empirical Risk Minimization.  arXiv preprint arXiv:1706.02693 (2017).  URL https://arxiv.org/abs/1706.02693
  * (32) Peltzman, S.: The effects of automobile safety regulation.  The Journal of Political Economy pp. 677–725 (1975)
  * (33) Raiyn, J., et al.: A survey of cyber attack detection strategies.  International Journal of Security and Its Applications 8(1), 247–256 (2014)
  * (34) Rass, S., Alshawish, A., Abid, M.A., Schauer, S., Zhu, Q., De Meer, H.: Physical intrusion games–optimizing surveillance by simulation and game theory.  IEEE Access 5, 8394–8407 (2017)
  * (35) Tague, P., Poovendran, R.: Modeling node capture attacks in wireless sensor networks.  In: Communication, Control, and Computing, 2008 46th Annual Allerton Conference on, pp. 1221–1224. IEEE (2008)
  * (36) Wang, W., Zhu, Q.: On the detection of adversarial attacks against deep neural networks.  In: Proceedings of the 2017 Workshop on Automated Decision Making for Active Cyber Defense, pp. 27–30. ACM (2017)
  * (37) Xu, Z., Zhu, Q.: A cyber-physical game framework for secure and resilient multi-agent autonomous systems.  In: Decision and Control (CDC), 2015 IEEE 54th Annual Conference on, pp. 5156–5161. IEEE (2015)
  * (38) Xu, Z., Zhu, Q.: Cross-layer secure cyber-physical control system design for networked 3d printers.  In: American Control Conference (ACC), 2016, pp. 1191–1196. IEEE (2016).  URL http://ieeexplore.ieee.org/abstract/document/7525079/
  * (39) Xu, Z., Zhu, Q.: A Game-Theoretic Approach to Secure Control of Communication-Based Train Control Systems Under Jamming Attacks.  In: Proceedings of the 1st International Workshop on Safe Control of Connected and Autonomous Vehicles, pp. 27–34. ACM (2017).  URL http://dl.acm.org/citation.cfm?id=3055381
  * (40) Xu, Z., Zhu, Q.: Secure and practical output feedback control for cloud-enabled cyber-physical systems.  In: Communications and Network Security (CNS), 2017 IEEE Conference on, pp. 416–420. IEEE (2017)
  * (41) Yuan, Y., Zhu, Q., Sun, F., Wang, Q., Basar, T.: Resilient control of cyber-physical systems against denial-of-service attacks.  In: Resilient Control Systems (ISRCS), 2013 6th International Symposium on, pp. 54–59. IEEE (2013)
  * (42) Zhang, R., Zhu, Q.: Secure and resilient distributed machine learning under adversarial environments.  In: 2015 18th International Conference on Information Fusion (Fusion), pp. 644–651. IEEE (2015)
  * (43) Zhang, R., Zhu, Q.: A game-theoretic defense against data poisoning attacks in distributed support vector machines.  In: Decision and Control (CDC), 2017 IEEE 56th Annual Conference on, pp. 4582–4587. IEEE (2017)
  * (44) Zhang, R., Zhu, Q.: A game-theoretic approach to design secure and resilient distributed support vector machines.  IEEE Transactions on Neural Networks and Learning Systems (2018)
  * (45) Zhang, R., Zhu, Q.: Flipin: A game-theoretic cyber insurance framework for incentive-compatible cyber risk management of internet of things.  IEEE Transactions on Information Forensics and Security (2019)
  * (46) Zhang, R., Zhu, Q., Hayel, Y.: A bi-level game approach to attack-aware cyber insurance of computer networks.  IEEE Journal on Selected Areas in Communications 35(3), 779–794 (2017)
  * (47) Zhang, T., Zhu, Q.: Strategic defense against deceptive civilian gps spoofing of unmanned aerial vehicles.  In: International Conference on Decision and Game Theory for Security, pp. 213–233. Springer (2017)
  * (48) Zhu, Q., Clark, A., Poovendran, R., Basar, T.: Deployment and exploitation of deceptive honeybots in social networks.  In: Decision and Control (CDC), 2013 IEEE 52nd Annual Conference on, pp. 212–219. IEEE (2013)
  * (49) Zhu, Q., Fung, C., Boutaba, R., Başar, T.: Guidex: A game-theoretic incentive-based mechanism for intrusion detection networks.  Selected Areas in Communications, IEEE Journal on 30(11), 2220–2230 (2012)
  * (50) Zhu, Q., Rass, S.: On multi-phase and multi-stage game-theoretic modeling of advanced persistent threats.  IEEE Access 6, 13958–13971 (2018)
  * (51) Zhuang, J., Bier, V.M., Alagoz, O.: Modeling secrecy and deception in a multiple-period attacker–defender signaling game.  European Journal of Operational Research 203(2), 409–418 (2010)