# Game-Theoretic Neyman-Pearson Detection to Combat Strategic Evasion

Yinan Hu, Student Member and Quanyan Zhu, Senior Member

###### Abstract

The security in networked systems depends greatly on recognizing and
identifying adversarial behaviors. Traditional detection methods target
specific categories of attacks and have become inadequate for increasingly
stealthy and deceptive attacks that are designed to bypass detection
strategically. This work proposes game-theoretical frameworks to recognize and
combat such evasive attacks. We focus on extending a fundamental class of
statistical-based detection methods based on Neyman-Pearson’s (NP) hypothesis
testing formulation. We capture the conflicting relationship between a
strategic evasive attacker and an evasion-aware NP detector. By analyzing both
the equilibrium behaviors of the attacker and the NP detector, we characterize
their performance using Equilibrium Receiver-Operational-Characteristic (EROC)
curves. We show that the evasion-aware NP detectors outperform the non-
strategic ones in the way that the former can take advantage of the attacker’s
messages to adaptively modify their decision rules to enhance their success
rate in detecting malicious attacks. In addition, we extend our framework to a
sequential setting where the user sends out identically distributed messages.
We corroborate the analytical results with a case study of intrusion detection
evasion problem.

##  I Introduction

Cyber-security is the practice of protecting critical systems and their
sensitive information from cyber attacks. There have been an surging
proportion of evasion attacks among all cyber attacks over the years. A recent
WatchGuard lab report [1] reveals that over 78% of the malware attacks with
encryption are evasive in 2021. Defending against evasion attacks have been a
crucial concern for networked systems such as computer networks [2], Internet
of Things (IoT) [3], and autonomous systems [4].

Many studies have contributed to detecting and counteracting the attacks in
the network. However, as attackers are growing to be increasingly intelligent,
deceptive, and stealthy, they are capable of evading detection strategically
and moving laterally in the network to locate the target assets. Those
countermeasures, however, are inadequate as they do not consider evasions as
strategic behaviors from the attacker. It is very likely that attackers can
learn the updated detection mechanisms and adjust their attacking strategies
to further strengthen their penetrations into networked systems. There is a
need to improve the detection methods fundamentally to create an evasion-aware
detection to harden the network security proactively. Such detection methods
need to assume that attackers are rational, omniscient, and they always act
strategically against detection.

To this end, this work aims to create an evasion-aware detection theory for
stealthy attacks. We focus on a fundamental class of Neyman-Pearson (NP)
hypothesis-testing problems [5]. In these applications, a user (It)
communicates with a detector (She) by sending messages to her. The detector
knows that the user can be either benign or malicious. It is assumed that the
users of different types generate messages following distinct distributions
that capture their individual incentives. The detector’s ultimate goal is to
determine the user’s type based on the samples of message from the user. We
use a game-theoretic approach to capture the strategic behaviors of the
detector and an evasive attacker, who is omniscient of the nature of benign
and malicious behaviors as well as the detection mechanism. We model the
detection-evasive attacker as an adversary who stands in between the user and
the detector, knows the user’s true type, intercepts the user’s original
messages as inputs, and strategically designs outputs sent to the detector to
undermine the latter’s performance. We formulate sequential game problems to
capture the capability and the incentive of the attacker and the interactions
with nature and the detector. The nature first selects a user from the
population with a prior distribution on the type. The user then generates
messages based on its type. Based on the user’s type and the messages, the
attacker generates distorted messages and sends them to the detector, who
finally determines the user’s type based on those distorted messages.

The analysis of the equilibrium of the game frameworks provides essential
insights into fundamental limits on the performance of evasion-aware detectors
and their designs. We observe that by varying the intrinsic coefficients
parameterizing the detection strategies, one can compute relationships between
detection rates and false alarm rates and depict them in terms of an
Equilibrium Receiver Operational Characteristics (EROC) curve [6, 7, 8]),
which characterizes the fundamental performance tradeoffs of the detector.
Furthermore, The analysis of game-theoretic equilibrium also provides
numerical algorithms to compute the best-response strategies for both the
attacker and the detector.

We study game models for two kinds of detectors depending on their reasoning
capabilities. One is passive, and the other is proactive. The passive one does
not anticipate the presence of the attacker and treats the inputs as if they
were original, untainted ones from the user. Her decision process based on the
inputs is naive, non-strategic and thus her detection performance is subject
to the adversarial poisoning of the inputs. In contrast, the proactive
detector anticipates that an attacker can manipulate the inputs and checks
whether the inputs are consistent with the history and the known priors of the
hypotheses. Once she suspects that an attacker exists, she adopts a detection
strategy that takes into account the attacker’s manipulation. She also takes
advantage of the distorted inputs to infer the attacker’s private information
to mitigate the detrimental effects of poisonous inputs on her detection
performance. On the other hand, the attacker decides his distortion strategy
via balancing the trade-off between undermining the detector’s performance and
lowering the penalty resulting from manipulation of messages.

The passive NP detector game is modeled by the Stackelberg game [9]. The
attacker is the leader in the game who determines a distortion strategy while
the detector is the follower who naively uses an NP detection without knowing
the distortion. The analysis of the Stackelberg equilibrium shows that the
detection rate of a passive NP detector is reduced exponentially with respect
to the distortion level, compared to the attacker-free detection scenario. The
attacker’s distortion policy depends on the user’s type: when the user is
benign, he does not mutate the original message; when the user is malicious,
he manipulates the message by suppressing the probability that outgoing
message lies in the region where the detector can make a detection. By
depicting the EROC curve, we observe that in general the passive NP detector’s
performance is worse than the one of non-adversarial detector yet also
dependent on the penalization: when the attacker’s penalty goes to infinity,
the attacker conveys the message truthfully, and the detector applies
classical NP hypothesis testing to determine the user’s type; in contrast,
when the penalty vanishes, the detection rate reduces to zero as the attacker
can distort the user’s messages in any desired way.

The proactive NP detector game is modeled using a signaling game framework
[10]. The attacker is the sender who can observe the underlying true
hypothesis and its associated distribution of messages. The detector is the
receiver who does not know the true hypothesis and makes a decision based on
the message sent by the attacker who aims to mislead the decision. The
detector is aware of the possible presence of the attacker and proactively
infers true hypothesis using a Bayesian approach. The analysis of the
equilibrium shows that the attacker’s policies change not only the probability
distributions of messages at different regions but the detector’s regions of
rejection as well. The attacker enlarges the proactive detector’s uncertainty
area significantly by interpolating the two original distributions followed by
a scaling factor to make them less distinguishable. Although the performance
of the proactive NP detector, according to EROC curves, is inferior to the
classical NP detector due to the distortion of messages, it outperforms the
passive NP detector thanks to her utilization of the attacker’s strategies.

The results from the game-theoretic models have strong implications in
building the next-generation evasion-aware detection systems. In particular,
when the user is malicious, the attacker’s strategy at equilibrium against a
proactive detector has a stronger amplitude in the detector’s region of
rejection than the counterpart against a passive detector. So an evasion-aware
detection system outperforms a classical counterpart in the way that the
former can predict the regions of messages leading to a decision of malicious
user and alter its decision rule so as to mitigate the attacker’s distortion
on the region of rejection, improving the chance of catching attacks that are
supposed to be evasive. We investigate a case study of an anomaly detection
system where an attacker distorts a user’s event history to compromise the
detection result. We use this study to corroborate the results and demonstrate
the capability of evasion-aware detection.

Our contributions are two-fold. First, we develop a holistic theory for
evasion-aware detection. In particular, the proposed framework is solidly
built on classical hypothesis testing and game-theoretic theories and
characterizes the fundamental performance tradeoffs for passive and proactive
detectors. Second, evasion-aware detection policies obtained from the analysis
of sequential games provide a design paradigm for next-generation detection
systems. Such techniques provide a novel way for the detector to process the
poisonous inputs while capable of maintaining a high detection performance.

The rest of this work is organized as follows. In Section II, we present the
Stackelberg game formulation of a passive detector, who is naïve about the
distortion of messages by an attacker-in-the-middle. In Section III, we
discuss the signaling game formulation of a proactive detector who anticipates
adversarial behaviors. We model the relationship between the attacker-in-the-
middle and the proactive detector using signaling games. The attacker applies
a decision rule based on her posterior belief on the user’s type after
receiving distorted messages. In section IV we discuss performances of
detectors under repeated observations. In Section V we apply the results to a
case study of an IDS evasion problem. Finally, we conclude in Section VI.

###  I-A Related works

Many studies have contributed to developing stealthy attacks and their
countermeasures in networked systems [11, 12, 13]. One example is false data
injections [14], where an attacker can inject stealthy data into the original
traffic in the networked system. Another example is deception attacks [15],
where the attacker sends falsified data that the detector consider genuine and
untainted. The concept of developing our proposed frameworks can be adapted to
develop detectors combatting strategically stealthy attacks of any categories.

Game-theoretic formulations have been widely used to capture the attacker-
defender interactions in cyber-security [16, 17, 18, 19, 20]. A recent survey
investigates how game-theoretic approaches are applied in intrusion detection
systems. Authors in [18] introduce game-theoretic frameworks in formulating
the tradeoffs among robustness, security, and resilience for cyber-physical
control systems. Works in [21] study the IDS with multiple attackers and
heterogeneous defenders in a network by formulating their relationships into a
game, where the heterogeneity among defenders are captured by their different
payoff functions. This work studies the attacker-defender relationship using a
formulation combining the formulations of game-theories and hypothesis testing
similar to [22], yet we adopt more involved utility functions.

Machine learning techniques have also been widely applied in detection
problems [23]. The main difference between detection by binary hypothesis
testing and detection by machine learning method is that the former is an
inference method, while the latter is a prediction method. The security of
machine learning has also been a research spotlight [24, 25, 26, 27] for the
past several decades. Evasion attacks on machine learning mainly include
modifying the training or testing data, obfuscating the gradient descent steps
in the optimization process, etc. Authors in [28] discuss the optimal evasion
attacks upon the gradients at testing time in classification problems. Authors
in [29] capture the adversarial behaviors in support vector machines (SVM)
using a game-theoretic framework, where the adversary modifies the training
data to mislead the learner to develop prediction models favorable to the
adversary. The proposed framework extends from hypothesis testing formulations
and thus are model-based, while the machine-based detection techniques are
data-driven.

##  II Problem Formulation of Passive Detectors

In this section, we present the problem formulation of a passive detector. As
a comparison, we first consider the non-adversarial scenario that involves a
user (It), a detector (She), and a communicating channel without an attacker
in the middle (He). There are two types of the user: benign and malicious. A
user is sampled from the population with a known prior distribution of the two
types of users. The sampled user knows its own type. Different types of users
generate messages obeying distinct distributions. The detector does not know
the user’s type, but she can infer the type using the user’s messages using
hypothesis testing.

We let $\langle M,\mathcal{M}\rangle$ be a measurable Polish space endowed
with $F_{0},F_{1}\in\Delta(M)$ as two measures of interest, where $\Delta(M)$
refers to the set of all measures supported on $M$. Denote $f_{0},f_{1}\in
L^{1}(M)$ as the probability density functions (strictly speaking, they are
Radon-Nikodym derivatives of $F_{0},F_{1}$ with respect to the Lebesgue
measure) corresponding to the measures $F_{0},F_{1}$. Suppose a benign user
and a malicious user generate messages obeying the distributions of
$f_{0},f_{1}$, respectively. Denote $\tilde{m}^{\prime}$ as the random
variable of the user’s messages whose realizations are supported on $M$.
Denote $\mathcal{H}=\\{H_{0},H_{1}\\}$ as the space of user’s types. Let
$H_{0}$ be the hypothesis that the user is benign and $H_{1}$ be the one that
the user is malicious. Under different hypotheses, the messages are generated
using $f_{0}$ and $f_{1}$, respectively:

$H_{0}:\;\tilde{m}^{\prime}\sim f_{0}(m^{\prime}),\;\longleftrightarrow
H_{1}:\tilde{m}^{\prime}\sim f_{1}(m^{\prime}).$ (1)

Let $\Gamma$ be the set of all decision rules of the detector, and a typical
decision rule is denoted as $\delta\in\Gamma,\;\delta:M\rightarrow\\{0,1\\}$,
where $\delta(m^{\prime})=i,\;i\in\\{0,1\\},$ means that the detector
determines the user is of type $H_{i}$. We suppose that the detector makes
decisions using NP hypothesis testing method [30]; i.e., the detector arrives
at an optimal policy $\delta^{*}$ by solving the following optimization
problem:

$\displaystyle\underset{{\delta}\in\Gamma}{\max}\int_{\delta(m^{\prime})=1}{f_{1}(m^{\prime})dm^{\prime}},\;\text{s.t.}\;\int_{\delta(m^{\prime})=1}{f_{0}(m^{\prime})dm^{\prime}}\leqslant\alpha.$
(2)

In an adversarial scenario, after the original message $m^{\prime}$ is
generated from the user, the attacker-in-the-middle intercepts the message and
also learns the user’s true type $H_{i},\;i\in\\{0,1\\}$, after which he
strategically manipulates the message through a mapping $\mu_{i}:M\rightarrow
M,\;m^{\prime}\longmapsto m$ with $m=\mu_{i}(m^{\prime})$. He then later sends
out the distorted message $m\in M$ to the detector. We assume that the passive
detector is unaware of the existence of an attacker and anticipates that she
receives messages from the user directly , even though in reality the message
comes from an attacker-in-the-middle (see the blue arrows in Figure 1).
Finally, the detector applies NP hypothesis testing [5] to $m$ with
distributions $f_{1},f_{0}$ to determine the true type of the user. We capture
the interaction between the attacker and a passive detector using a
Stackelberg game [9].

Figure 1: The adversarial detection with an attacker in the middle. The nature
first draws a message $m^{\prime}\in M$ based on a randomly chosen hypothesis
from either the null $H_{0}$ or the alternative $H_{1}$ hypothesis. It can be
interpreted as the scenario where a user of known type (e.g., benign or
malicious) is drawn from a prior distribution. An attacker observes the type
or the hypothesis $i\in\\{0,1\\}$ and the associated message $m^{\prime}$. The
attacker chooses a strategy $\mu_{i}$ to distort the message and send
$m=\mu_{i}(m^{\prime})$ to the detector with the goal to mislead the detection
result. The detector relies on her knowledge and designs a passive or
proactive detection strategy to optimize her detection performance.

###  II-A Detector’s Decision Rule

Let $\hat{\delta}\in\Gamma,\;\hat{\delta}:M\rightarrow\\{0,1\\}$ be a generic
strategy of a passive detector, where $\hat{\delta}(m)=j,\;j\in\\{0,1\\}$
means that she thinks the user is of type $H_{j}\in\mathcal{H}$ based on the
message $m$. Similar to the non-adversarial scenario, the detector arrives at
her optimal strategy $\hat{\delta}^{*}$ by solving the following optimization
problem:

$\displaystyle\underset{\hat{\delta}\in\Gamma}{\max}\int_{\hat{\delta}(m)=1}{f_{1}(m)dm},$
(3)
$\displaystyle\text{s.t.}\;\int_{\hat{\delta}(m)=1}{f_{0}(m)dm}\leqslant\alpha,$

where $\int_{\hat{\delta}(m)=1}{f_{1}(m)dm}$ and
$\int_{\hat{\delta}(m)=1}{f_{0}(m)dm}$ refer to the ‘conjectural detection
rate’ and the ‘conjectural false alarm rate’ from the receiver’s viewpoint.
During the gameplay, the attacker-in-the-middle distorts the message via
$\mu_{0}$ or $\mu_{1}$, depending on the observed user’s type. Notice that we
can regard the distortion mappings equivalently as the transformation from the
original measures of interest $F_{0},F_{1}$ to the final measures
$\Sigma_{0},\Sigma_{1}$. We argue via the following lemma from [31] that it is
also equivalent to formulate the distortion using the resulting measures
$\Sigma_{0},\Sigma_{1}$:

######  Lemma 1.

Let $\langle M,\mathcal{M}\rangle$ be a Polish probability space endowed with
atomless measures $F_{0},F_{1}\in\Delta(M)$. Then, for any atomless
probability measures $\hat{\Sigma}_{0},\hat{\Sigma}_{1}\in\Delta(M)$, there
exist measurable isomorphisms $\mu_{0},\mu_{1}:M\rightarrow M$ such that

$\displaystyle\mu_{0}\\#F_{0}=\Sigma_{0},\;\;\mu_{1}\\#F_{1}=\Sigma_{1},\;\mu^{-1}_{0}\\#\Sigma_{0}=F_{0},\;\;\mu^{-1}_{1}\\#\Sigma_{1}=F_{1}.$
(4)

In other words, the measures $\Sigma_{0},\Sigma_{1}$ are push-forward measures
[32] of the measures $F_{0},F_{1}$, respectively.

Lemma 4 states that characterizing the attacker’s strategies by
$\hat{\mu}_{1},\hat{\mu}_{0}$ is equivalent to characterizing them by the
measures of distorted messages $\hat{\Sigma}_{1},\hat{\Sigma}_{0}$, the latter
of which is equivalent to the probability distributions
$\hat{\sigma}_{1},\hat{\sigma}_{0}$ on $M$. Thus, we define the attacker’s
action space $\hat{A}_{S}$ as follows:

$\displaystyle\hat{A}_{S}:=$
$\displaystyle\Big{\\{}\begin{bmatrix}\hat{\sigma}_{0}\\\
\hat{\sigma}_{1}\end{bmatrix}\in{L}^{1}(M)^{\otimes
2}:i\in\\{0,1\\},\;\int_{m\in M}{\hat{\sigma}_{i}(m)dm}=1;$ (5)
$\displaystyle\;\forall m\in M,\hat{\sigma}_{i}(m)\geqslant 0\Big{\\}}.$

The attacker has two objectives. On one hand, he seeks to undermine the
detector’s performance; on the other hand, he aims at lowering the ‘lying
cost’ from the distortion of messages. To evaluate the detector’s performance,
we introduce the following detection rate $\hat{P}_{D}:\Gamma\rightarrow[0,1]$
and the false alarm rate $\hat{P}_{F}:\;\Gamma\rightarrow[0,1]$:

$\displaystyle\hat{P}_{D}(\hat{\delta})$
$\displaystyle=\int_{\hat{\delta}(m)=1}{\hat{\sigma}_{1}(m)dm},\;\;$ (6)
$\displaystyle\hat{P}_{F}(\hat{\delta})$
$\displaystyle=\int_{\hat{\delta}(m)=1}{\hat{\sigma}_{0}(m)dm}.$ (7)

The attacker also incurs a ‘lying cost’ [33] for the discrepancy between the
distorted and the original distribution. Such a lying cost results from
anomaly detection techniques in security [34]. Summarizing the two purposes
and with the help of game potentials [35], we formulate the attacker’s
optimization problem as follows:

$\displaystyle\underset{{(\hat{\sigma}_{1},\hat{\sigma}_{0})\in\hat{A}_{S}}}{\min}\;\int_{\hat{\delta}^{*}(m)=1}{\hat{\sigma}_{1}(m)dm}$
(8)
$\displaystyle+\lambda\int_{m\in{M}}{{\hat{\sigma}_{1}(m)\ln\frac{\hat{\sigma}_{1}(m)}{f_{1}(m)}}dm}+\lambda\int_{m\in{M}}{{\hat{\sigma}_{0}(m)\ln\frac{\hat{\sigma}_{0}(m)}{f_{0}(m)}}dm}.$

##### The optimal strategy of a passive detector

The passive detector faces the optimization problem (8). Using the method of
Lagrange multipliers [36] we can obtain the detector’s optimal decision rule
$\hat{\delta}^{*}$ as follows:

$\forall m\in
M,\;\;\hat{\delta}^{*}(m)=\begin{cases}1&\;f_{1}(m)>F^{-1}_{L}(\alpha)f_{0}(m),\\\
r\in[0,1]&f_{1}(m)=F^{-1}_{L}(\alpha)f_{0}(m),\\\
0&\mbox{otherwise},\end{cases}$ (9)

where $F_{L}(\cdot)$ refers to the cumulative probability density function of
the ratio of the random variable obeying distribution $f_{0}$, and,
correspondingly, $F^{-1}_{L}(\alpha)$ is the quantile function at the
probability $\alpha$. Based on the detector’s decisions (9) upon every $m\in
M$, we can partition the message space $M$ into region of rejection, region of
acceptance, and region of uncertainty as follows:

$\displaystyle\hat{M}_{1}$
$\displaystyle=\\{m:\;f_{1}(m)>F^{-1}_{L}(\alpha)f_{0}(m)\\}=\\{m:\hat{\delta}^{*}(m)=1\\},$
(10) $\displaystyle\hat{M}_{0}$
$\displaystyle=\\{m:\;f_{1}(m)<F^{-1}_{L}(\alpha)f_{0}(m)\\}=\\{m:\hat{\delta}^{*}(m)=0\\},$
(11) $\displaystyle\hat{M}_{*}$
$\displaystyle=\\{m:\;f_{1}(m)=F^{-1}_{L}(\alpha)f_{0}(m)\\}=\\{m:\hat{\delta}^{*}(m)\in[0,1]\\}.$
(12)

##### The attacker’s equilibrium strategies

We now obtain attacker’s equilibrium strategies based on the detector’s
optimal decision $\hat{\delta}^{*}$ by using first-order condition on (8) . We
summarize the results in the following theorem 1.

######  Theorem 1.

Let $f_{0},f_{1}$ be the distributions of the original messages in (1). Let
$M$ be the message space specified in lemma 4 and $\hat{M}_{1},\hat{M}_{0}$ be
two regions of messages specified in (10) and (11), respectively. Then, we can
write the optimal solution $\hat{\sigma}^{*}_{1},\hat{\sigma}^{*}_{0}$ of the
attacker’s optimization problem (8) as follows:

$\displaystyle\hat{\sigma}^{*}_{0}(m)$ $\displaystyle=f_{0}(m),\;\forall m\in
M,$ (13) $\displaystyle\hat{\sigma}^{*}_{1}(m)$
$\displaystyle=\begin{cases}\frac{f_{1}(m)}{\int_{m\in\hat{M}_{1}}{e^{-\frac{1}{\lambda}}f_{1}(m)dm}+\int_{m\in\hat{M}_{0}}{{f_{1}(m)}dm}},\;\;&m\in\hat{M}_{0},\\\
\frac{f_{1}(m)e^{-\frac{1}{\lambda}}}{\int_{m\in\hat{M}_{1}}{{e^{-\frac{1}{\lambda}}f_{1}(m)}dm}+\int_{m\in\hat{M}_{0}}{{f_{1}(m)}dm}},&m\in\hat{M}_{1}.\end{cases}$
(14)

We remark that when $\lambda=0$, the attacker’s equilibrium strategies
(13)(14) reduce to

$\displaystyle\hat{\sigma}^{*}_{1}(m)=\begin{cases}\frac{f_{1}(m)}{\int_{m\in
M_{0}}{{f_{1}(m)}dm}}&m\in\hat{M}_{0},\\\ 0&m\in\hat{M}_{1},\end{cases}$ (15)
$\displaystyle\hat{\sigma}^{*}_{0}(m)=f_{0}(m),\;\forall m\in M,$ (16)

which shows that the attacker ‘moves’ the samples in $M_{1}$ and
‘redistribute’ them over the region $M_{0}$. The probability of detection is
$0$ if detector applies classical NP testing method; on the other hand, when
$\lambda\rightarrow\infty$, the attacker’s equilibrium strategies reduce to
$\hat{\sigma}^{*}_{1}(m)=f_{1}(m),\;\hat{\sigma}^{*}_{0}(m)=f_{0}(m),\;\forall
m\in M$, meaning the attacker cannot ‘lie’ about the message due to infinitely
high penalty for distorting the messages at equilibrium. From the perspective
of the detector, the Stackelberg game model reduces to the classical NP
hypothesis problem.

##  III The Formulation of a Proactive Detector

In this section, we assume that the detector is aware of the attacker-in-the-
middle who intercepts and sends out distorted messages to her (see Figure 1).
Once the detector knows that the messages have been manipulated, she can act
strategically to mitigate the consequence of the reduced accuracy of detection
resulting from the distortion of messages.

###  III-A The signaling game formulation

Figure 2: The game tree of the signaling game $\mathcal{G}_{2}$ capturing the
interactions between the attacker and the proactive detector. The attacker
observes the type (i.e., $H_{0}$ or $H_{1}$), receives a sample from the user,
and sends strategically distorted message $m$ to the detector. Finally, the
detector makes a decision $i\in\\{0,1\\}$ based on the manipulated message and
the posterior belief. The payoffs for each outcome of the game are depicted at
the bottom of the game tree.

We describe the gameplay between a proactive detector and an attacker. Let
$p(H_{0}),p(H_{1})$ be the common prior of the user’s true type (private
information). When the game starts, the attacker observes the user’s type and
receives a message $m^{\prime}\in M$ from it. Based on the user’s type
$H_{i},\;i\in\\{0,1\\}$, the attacker strategically generates a piece of
distorted message $m=\mu_{i}(m^{\prime})$ and sends it to the detector. The
detector determines a detection rule
${\delta}:M\rightarrow\\{0,1\\},\delta\in\Gamma,$ based on $m$ and the
posterior belief, where $\Gamma$ is the set of admissible detection rules. We
let $a=\delta(m),\;a\in\bar{A}_{R}=\\{0,1\\}$ be a generic action of the
detector for an input $m\in M$. Finally, the detector receives a reward
$U_{R}:\mathcal{H}\times M\times\bar{A}_{R}\rightarrow\mathbb{R}$ and the
attacker receives a cost $C_{S}:\mathcal{H}\times
M\times\bar{A}_{R}\rightarrow\mathbb{R}$ based on the user’s true type
$H_{i}$, the message $m$, and the detector’s decision
$\delta(m)=j\in\\{0,1\\}$. The gameplay is summarized using the game tree
depicted in Figure 2. Following the similar arguments used in Section II, we
formulate the attacker’s strategy space $\bar{A}_{S}$ in terms of the
resulting measures of the distorted messages:

$\displaystyle\bar{A}_{S}$
$\displaystyle=\Big{\\{}\begin{bmatrix}\sigma_{0}\\\
\sigma_{1}\end{bmatrix}\in{L}^{1}(M)^{\otimes 2}:\int_{m\in
M}{\sigma_{i}(m)dm}=1;$ (17) $\displaystyle\forall m\in
M,\sigma_{i}(m)\geqslant 0,\;i\in\\{0,1\\}\Big{\\}}$

Based on message $m$, the prior belief $p(H_{0}),p(H_{1})$ of the true
hypothesis is updated to be a posterior belief $p(H_{j}|m),\;j\in\\{0,1\\}$
using Bayes’ rule:

$p(H_{j}|m)=\frac{\sigma_{j}(m)p(H_{j})}{\sigma_{1}(m)p(H_{1})+\sigma_{0}(m)p(H_{0})},$
(18)

##### Detector’s utility function

A proactive detector aims to maximize the estimated detection rate while
restricting the estimated false alarm rate to $\alpha$ (assuming that $\alpha$
is public knowledge) based on the message $m$. Based on the posterior belief
presented in (18), the proactive detector knows that the user is benign with
conditional probability $p(H_{0}|m)$ and malicious with conditional
probability $p(H_{1}|m)$. Furthermore, when she makes a decision
$\delta(m)=1$, she succeeds in detection if the user is malicious. She results
in false alarm if the user is benign. For a given message $m$, the detection
rate for the detection is $\delta(m)p(H_{1}|m)$ and false alarm rate
$\delta(m)p(H_{0}|m)$. Thus we formulate the detector’s optimization problem
as follows:

$\displaystyle\underset{\delta\in\Gamma}{\sup}$
$\displaystyle\;\delta(m){p(H_{1}|m)},\;\;\text{s.t.}$
$\displaystyle\;\delta(m)p(H_{0}|m)\leqslant\alpha.$ (19)

In other words, we can designate the detector’s utility as the objective
function in (67) as follows:

$\bar{U}_{R}(m,\delta(m))=\sum_{i\in\\{0,1\\}}{p(H_{i}|m)U_{R}(H_{i},m,\delta(m))},$
(20)

with
$U_{R}(H_{1},m,1)=1,\;U_{R}(H_{1},m,0)=0,\;U_{R}(H_{0},m,0)=0,\;U_{R}(H_{0},m,1)=0$.
and the detector’s strategy space is chosen as

$\bar{\Gamma}=\\{\delta\in 2^{M}:\;\delta(m)p(H_{0}|m)\leqslant\alpha\\}.$
(21)

##### Attacker’s cost function

Similar to Stackelberg game scenario as introduced in Section II, the attacker
faces the trade-off between undermining the detector’s performance and
lowering the costs due to distortion of messages. In our framework, the
attacker knows the model including the distributions $f_{0},f_{1}$ as well as
the detector’s utility function. The assumption of an omnipotent attacker
aligns with the Kerckhoff’s principle [37] used for adversarial analysis. We
introduce de facto detection rate $\bar{P}_{D}:\bar{\Gamma}\rightarrow[0,1]$
and false alarm rate $\bar{P}_{F}:\bar{\Gamma}\rightarrow[0,1]$:

$\displaystyle\bar{P}_{D}(\delta^{*})$
$\displaystyle=\int_{{\delta}^{*}(m)=1}{\sigma_{1}(m)dm},\;$ (22)
$\displaystyle\bar{P}_{F}(\delta^{*})$
$\displaystyle=\int_{{\delta}^{*}(m)=1}{\sigma_{0}(m)dm}.$ (23)

The detector makes decisions based on the attacker’s message whose
distribution are distorted from $f_{0}$ to $\sigma_{0}$ and from $f_{1}$ to
$\sigma_{1}$. Notice that the attacker does not modify the ‘label’ or the
index of the hypothesis (i.e., $i\in\\{0,1\\}$) of the message. The de facto
detection rate measures the consequence of the detection rate under distorted
messages. From the attacker’s viewpoint, the detector knows his existence and
does her best to distinguish between $H_{0}$ and $H_{1}$ from the received
messages (from the man-in-the-middle). The attacker anticipates it and aims to
minimize the de facto detection rate to reduce the accuracy for the detector
to tell $H_{1}$ or $H_{0}$ from the distorted messages. Thus the quantity (22)
is included in the attacker’s cost function.

Considering the KL divergence as the penalty function, we formulate the
attacker’s optimization problems $j\in\\{0,1\\}$ as follows:

$\displaystyle\underset{\begin{subarray}{c}\sigma_{j}\in\bar{A}_{S}\end{subarray}}{\min}$
$\displaystyle\int_{\delta^{*}(m)=1}{{\sigma_{j}(m)}dm}+\lambda\int_{m\in
M}{{\sigma_{j}(m)\ln\frac{\sigma_{j}(m)}{f_{j}(m)}}dm},$ (24)

######  Definition 1 (The game of a proactive detector).

We model the relationship between the proactive detector and the attacker-in-
the-middle, shown in Figure 1), as a signaling game

$\mathcal{G}_{2}=\langle\mathcal{I},\mathcal{H},p,M,\bar{\Gamma},\bar{A}_{R},\bar{A}_{S},\bar{U}_{R},\bar{C}_{S}\rangle,$

where $\mathcal{I}=\\{\text{Attacker},\text{Detector}\\}$ is the set of
players (i.e., attacker is the sender (see the player in red in Figure 1),
detector is the receiver(see the player in green in Figure 1));
$\mathcal{H}=\\{H_{0},H_{1}\\}$ is the user’s type space (see the left branch
in Figure 1) with $p=[p(H_{0})\;p(H_{1})]$ as the prior of the attacker’s
type; $M$ is the message space in lemma 4; $\bar{\Gamma}$ represents the
detector’s strategy space in (58) and $\bar{A}_{R}=\\{0,1\\}$ refers to the
detector’s action space; $\bar{A}_{S}$ refers to the attacker’s action space
defined in (17); $\bar{U}_{R}:M\times\bar{A}_{R}\rightarrow\mathbb{R}$ is the
utility function of the detector defined in (20);
$\bar{C}_{S}:\mathcal{H}\times M\times\bar{\Gamma}\rightarrow\mathbb{R}$ is
the cost function of the attacker defined in (24).

###  III-B Equilibrium analysis

To solve the signaling game $\mathcal{G}_{2}$, we adopt the concept of Perfect
Bayesian Nash Equilibrium (PBNE)[38] defined in the following.

######  Definition 2 (Perfect Bayesian Nash Equilibrium).

Consider the sequential game of proactive detectors $\mathcal{G}_{2}$. The
Perfect Bayesian Nash Equilibrium (PBNE) strategy of the game is a strategy
profile $(\sigma^{*}_{1},\sigma^{*}_{0},\delta^{*})$ and a posterior belief
$p(H_{1}|m),p(H_{0}|m)$ that satisfy the following conditions:

  1. 1.

(Detector’s sequential rationality) The detector minimizes her cost for the
pure strategy $\delta$ under the attacker’s strategies
$\sigma^{*}_{0},\sigma^{*}_{1}$, the message $m$, and the posterior belief
$p(H_{0}|m),p(H_{1}|m)$:

$\delta^{*}\in\arg\underset{\delta\in\bar{\Gamma}}{\max}\;\bar{U}_{R}(m,\;\delta(m)).$
(25)

  2. 2.

(Attacker’s sequential rationality) For $i\in\\{0,1\\}$, the attacker
minimizes his expected cost given the detector optimal strategy $\delta^{*}$:

$\sigma^{*}_{i}\in\arg\underset{\sigma_{i}\in\bar{A}_{S}}{\min}\;\bar{C}_{S}(H_{i},\sigma_{i},\sigma_{-i},\delta^{*}).$
(26)

  3. 3.

(Belief consistency) The common prior $p(H_{0}),p(H_{1})$ is updated into a
posterior based on attacker’s mixed strategies
$\sigma^{*}_{j},\;j\in\\{0,1\\}$:

$p(H_{j}|m)=\begin{cases}\frac{p(H_{j})\sigma^{*}_{j}(m)}{\sum_{i\in\\{0,1\\}}{p(H_{i})\sigma^{*}_{i}(m)}}&\sum_{i\in\\{0,1\\}}{p(H_{i})\sigma^{*}_{i}(m)}>0,\\\
\textrm{arbitrary}&\mbox{{otherwise}}.\end{cases}$ (27)

##### Detector’s Optimal Decision Rule

For a given message $m$, the proactive detector faces the constrained
optimization problem (28). We obtain the detector’s optimal strategy
explicitly $\delta^{*}$ by solving (28) as follows:

$\delta^{*}(m)=\begin{cases}1&p(H_{0}|m)<\alpha,\\\
r\in(0,1)&p(H_{0}|m)=\alpha,\\\ 0&p(H_{0}|m)>\alpha.\end{cases}$ (28)

or equivalently $\delta^{*}(m)=1$ if
$\sigma^{*}_{1}(m)>\beta\sigma^{*}_{0}(m)$ and $\delta^{*}(m)=0$ otherwise,
where $\beta=\frac{p(H_{0})}{p(H_{1})}\left(\frac{1}{\alpha}-1\right)$ is the
threshold of the likelihood ratio test.

##### Attacker’s Equilibrium Strategies

By sequential rationality and the expression (65), the attacker’s equilibrium
strategies $\sigma^{*}_{1},\sigma^{*}_{0}$ are best-responses of the
detector’s optimal decision rule $\delta^{*}$ in (28). As seen in the
Stackelberg game case in Section II, with the help of exact game potentials
[35], we manage to convert the attacker’s optimization problems (24) into one
with a single decision maker:

$\displaystyle\underset{\begin{subarray}{c}(\sigma_{1},\sigma_{0})\in\bar{A}_{S}\end{subarray}}{\min}\;\int_{\delta^{*}(m)=1}{\sigma_{1}(m)dm}$
(29) $\displaystyle+\lambda\int_{m\in
M}{\left({\sigma_{1}(m)\ln\frac{\sigma_{1}(m)}{f_{1}(m)}}+\sigma_{0}(m)\ln\frac{\sigma_{0}(m)}{f_{0}(m)}\right)dm}.$

######  Assumption 1 (Full-overlapping support).

Let $f_{0},f_{1}\in L^{1}(M)$ be the distributions of the original messages
from the user mentioned in (1). We assume that the two distributions have the
same support, i.e., $\operatorname{supp}f_{1}=\operatorname{supp}f_{0}$.

Assumption 1 guarantees that the non-adversarial detection problem (i.e., the
classical hypothesis testing problem) is non-trivial. If we drop this
assumption, then all messages lying outside their overlapping area will reveal
the true hypothesis immediately.

######  Assumption 2 (Absolute continuity).

Let $\Sigma_{1},\Sigma_{0}$ be the measures of distorted messages and
$F_{0},F_{1}$ be the measures of original messages in Lemma 4. Suppose that
$\sigma_{1},\sigma_{0},f_{1},f_{0}\in L^{1}(M)$ as in (29) are Radon-Nikodym
derivatives of $\Sigma_{1},\Sigma_{0},F_{1},F_{0}$ with respect to the
Lebesgue measure on $M$. Then, we assume $\Sigma_{1}\ll F_{1},\;\Sigma_{0}\ll
F_{0}$ when $\lambda>0$ in the objective function in (29).

Assumption 2 guarantees that the KL divergence terms in the attacker’s
objective functions are well defined. We arrive at the following lemma.

######  Lemma 2.

Let $\sigma_{1},\sigma_{0},f_{1},f_{0}$ be the distributions mentioned in
Assumption 2. Then, we have

$\operatorname{supp}\sigma_{1}=\operatorname{supp}f_{1},\;\;\operatorname{supp}\sigma_{0}=\operatorname{supp}f_{0},$
(30)

and furthermore,

$\operatorname{supp}\sigma_{1}=\operatorname{supp}\sigma_{0}.$ (31)

The conclusion (31) is the result of combining Lemma 31 and Assumption 2. We
categorize the solutions to (29) in terms of three regimes:
$\lambda=0,\;\lambda=\infty$, and $\lambda\in(0,\infty)$.

####  III-B1 Detection Rate Only: When $\lambda=0$

When $\lambda=0$, the attacker does not suffer a penalty from distorting the
messages, and the signaling game $\mathcal{G}_{2}$ can be considered as a
‘cheap-talk’ game [39]. We arrive at the following conclusions on the
attacker’s equilibrium strategies.

######  Proposition 1.

Let the signaling game $\mathcal{G}_{2}$ be the one defined by Definition 1,
and let (29) be the optimization problem for the attacker with $\lambda=0$.
Then, the attacker’s strategies at equilibrium are all such that the following
constraints are met.

  1. 1.

When $0<\beta<1$, the attacker’s equilibrium strategies
$\sigma^{*}_{1},\sigma^{*}_{0}$ satisfy the following constraints:

$\displaystyle\sigma^{*}_{1}(m)$
$\displaystyle=\begin{cases}\beta\sigma^{*}_{0}(m)&m\in\operatorname{supp}\sigma^{*}_{0},\\\
(1-\beta)\varphi(m)&\;m\notin\operatorname{supp}\sigma^{*}_{0},\end{cases}$
(32) with
$\displaystyle\;\int_{m\notin\operatorname{supp}\sigma^{*}_{0}}{\varphi(m)dm}=1.$
(33)

The regions of rejection and of acceptance are:

$M_{0}=\operatorname{supp}\sigma^{*}_{0},\;\;M_{1}=\operatorname{supp}\varphi;$
(34)

  2. 2.

When $\beta\geqslant 1$, distributions that satisfy the constraint

$\forall m\in M,\;\sigma^{*}_{1}(m)\leqslant\beta\sigma^{*}_{0}(m),\;\;$ (35)

are equilibrium strategies for the attacker. The corresponding regions of
rejection and of acceptance are: $M_{1}=\varnothing,\;M_{0}=M$.

For the proof of the proposition, we refer to Section VII-A in the appendix.

####  III-B2 The KL Divergence Only: $\lambda\rightarrow\infty$

When $\lambda\rightarrow\infty$ in (29), the attacker’s cost function is
completely measured by the KL divergence of the measures of distorted messages
to the ones of original messages. We show in the following that the detector’s
best response toward $\delta^{*}$ is to adopt a ‘disclosure strategy’: i.e.,
the attacker delivers messages to the detector without distortion.

######  Proposition 2.

Let $\mathcal{G}_{2}$ be the signaling game defined in Definition 1, and let
(29) be the optimization problem for the attacker with
$\lambda\rightarrow\infty$. Then, the attacker’s strategies are as follows:

$\forall m\in
M,\;\;\sigma^{*}_{1}(m)=f_{1}(m),\;\;\sigma^{*}_{0}(m)=f_{0}(m),$ (36)

and the regions of rejection and of acceptance depend on $f_{0}(m),f_{1}(m)$:
$M_{1}=\left\\{m:f_{1}(m)>{\beta}f_{0}(m)\right\\},\;M_{*}=\left\\{m:f_{1}(m)={\beta}f_{0}(m)\right\\},\;M_{0}=\left\\{m:f_{1}(m)<{\beta}f_{0}(m)\right\\}.$

For the proof of the proposition we refer to Section VII-B in the appendix.

####  III-B3 General Case: $0<\lambda<\infty$

In the general case $\lambda\in(0,\infty)$, the attacker faces the trade-off
between undermining the detector’s performance and minimizing the penalty
resulting from message distortion. We categorize PBNE into three classes:
separating, pooling, and hybrid equilibrium.

##### Separating equilibrium

In a separating PBNE of the signaling game, the attacker adopts strategies
that have non-overlapping support:
$\operatorname{supp}\sigma_{1}\cap\operatorname{supp}\sigma_{0}=\varnothing$.
However, based on (31), we know that this is impossible. Thus when
$\lambda\in(0,\infty)$, the signaling game $\mathcal{G}_{1}$ admits no
separating PBNE.

##### Pooling equilibrium

In a pooling PBNE, the attacker adopts the same strategies under both type
$H_{0}$ and type $H_{1}$: $\sigma^{*}_{1}=\sigma^{*}_{0}$. We show now that in
general $\mathcal{G}_{2}$ does not have a pooling equilibrium either.

######  Theorem 2.

Let (29) be the optimization problem for the attacker in the signaling game
$\mathcal{G}_{2}$ with $0<\lambda<\infty$. Let $f_{1},f_{0}$ as in the
objective function of (29) be the distributions of the original message in
(1). Then, the game $\mathcal{G}_{2}$ admits no pooling equilibrium unless
$f_{0}=f_{1}$.

###### Proof.

We prove the statement by contradiction. Suppose that there exists a pooling
PBNE under $\lambda>0$, then at equilibrium the detector must apply a
‘pooling’ strategy: $\delta^{*}(m)=1$ (when $\beta<1$) or $\delta^{*}(m)=0$
(when $\beta>1$) for all $m$. However, under neither case the attacker’s best
responding strategies are pooling: the first term on the attacker’s objective
function (29) is either $1$ or $0$, independent of the exact choices of
$\sigma_{1},\sigma_{0}$. Thus solving (29), yields
$\sigma^{*}_{0}(m)=f_{0}(m),\;\sigma^{*}_{1}(m)=f_{1}(m).$ for $m\in M$,
contradicting the assumption that ${\sigma^{*}_{1}}={\sigma^{*}_{0}}$ unless
${f_{1}}={f_{0}}$. Therefore, we conclude that there does not exist a pooling
equilibrium for the signaling game $\mathcal{G}_{2}$ when $\lambda>0$. ∎

##### Hybrid equilibrium

A hybrid PBNE is a strategy profile satisfying the definition 2 that is
neither pooling nor separating. To obtain the attacker’s best-response
strategies $\sigma^{*}_{1},\sigma^{*}_{0}$ under the detector’s optimal
decision rule $\delta^{*}$ as in (28), we solve the generalized KKT conditions
[40] of the optimization problem (29) and arrive at the following sufficient
conditions for finding a pair of equilibrium strategies for the attacker:

######  Assumption 3.

Let (29) be the optimization problem for the attacker in the signaling game
$\mathcal{G}_{2}$ with $0<\lambda<\infty$. We assume that there exists
$\zeta\in\left[\underset{m\in
M}{\sup}\frac{f_{0}(m)}{f_{1}(m)},\;e^{\frac{1}{\lambda}}\underset{m\in
M}{\sup}\frac{f_{0}(m)}{f_{1}(m)}\right]$ such that

$J(\zeta)=\int_{\frac{f_{1}(m)}{f_{0}(m)}<\frac{1}{\zeta}}{f_{0}(m)dm}+\int_{\frac{f_{1}(m)}{f_{0}(m)}>\frac{1}{\zeta}e^{\frac{1}{\lambda}}}{f_{0}(m)dm},$
(37)

where $J:\mathbb{R}_{+}\rightarrow\mathbb{R}$ is a function defined as

$\displaystyle
J(\zeta)=\beta\zeta\left(\int_{\frac{f_{1}(m)}{f_{0}(m)}<\frac{1}{\zeta}}{f_{1}(m)dm}+\int_{\frac{f_{1}(m)}{f_{0}(m)}>\frac{1}{\zeta}e^{\frac{1}{\lambda}}}{f_{1}(m)e^{-\frac{1}{\lambda}}dm}\right)$
(38)
$\displaystyle+(\beta-1)\zeta^{\frac{\beta}{1+\beta}}\left(\int_{\frac{1}{\zeta}\leqslant\frac{f_{1}(m)}{f_{0}(m)}\leqslant\frac{1}{\zeta}e^{\frac{1}{\lambda}}}{f_{1}(m)\left(\frac{f_{1}(m)}{f_{0}(m)}\right)^{-\frac{1}{1+\beta}}dm}\right).$

We discuss the proof of the lemma in Section VII-C in the appendix. Now we
argue through the following proposition that both the attacker’s strategies at
equilibrium and the detector’s region of rejection can be parameterized by
$\zeta$:

######  Proposition 3.

Let the signaling game $\mathcal{G}_{2}$ defined by Definition 1. Then, the
attacker’s strategies at equilibrium $\sigma^{*}_{1},\sigma^{*}_{0}$ can be
categorized in terms of $\lambda$: When $0<\lambda<\infty$, the attacker
admits the following strategies at equilibrium:

$\displaystyle\sigma^{*}_{0}(m)$
$\displaystyle=\begin{cases}c_{0}f_{0}(m)&m\in M_{0},\\\
c_{0}f_{1}^{\frac{\beta}{1+\beta}}(m)f_{0}(m)^{\frac{1}{1+\beta}}(m)\zeta^{\frac{\beta}{1+\beta}}&m\in
M_{*},\\\ c_{0}f_{0}(m)&m\in M_{1};\end{cases}$ (39)
$\displaystyle\sigma^{*}_{1}(m)$
$\displaystyle=\begin{cases}c_{1}f_{1}(m)&m\in M_{0},\\\
c_{1}f_{1}^{\frac{\beta}{1+\beta}}(m)f_{0}(m)^{\frac{1}{1+\beta}}(m)\zeta^{-\frac{1}{1+\beta}}&m\in
M_{*},\\\ c_{1}f_{1}(m)e^{-\frac{1}{\lambda}}&m\in M_{1};\end{cases}$ (40)

with the normalization factors $c_{0},c_{1}$ as

$\displaystyle{1}/{c_{0}}$
$\displaystyle=\int_{M_{0}}{f_{0}(m)dm}+\int_{M_{*}}{f_{0}(m)\left(\frac{f_{1}(m)}{f_{0}(m)}\right)^{\frac{\beta}{1+\beta}}\zeta^{\frac{\beta}{1+\beta}}dm}$
(41) $\displaystyle+\int_{M_{1}}{f_{0}(m)dm},$ (42) $\displaystyle{1}/{c_{1}}$
$\displaystyle=\int_{M_{0}}{f_{1}(m)dm}+\int_{M_{*}}{f_{1}(m)\left(\frac{f_{1}(m)}{f_{0}(m)}\right)^{-\frac{1}{1+\beta}}\zeta^{-\frac{1}{1+\beta}}dm}$
(43) $\displaystyle+\int_{M_{1}}{f_{1}(m)e^{-\frac{1}{\lambda}}dm}.$ (44)

The exact regions $M_{0},M_{*},M_{1}$ (strict acceptance region, uncertainty
region, strict rejection region) can be characterized in terms of $\zeta$:

$\displaystyle M_{0}$
$\displaystyle=\left\\{m:\frac{f_{1}(m)}{f_{0}(m)}<\frac{1}{\zeta}\right\\},\;\;$
(45) $\displaystyle M_{*}$
$\displaystyle=\left\\{m:\frac{1}{\zeta}\leqslant\frac{f_{1}(m)}{f_{0}(m)}\leqslant
e^{\frac{1}{\lambda}}\frac{1}{\zeta}\right\\},$ (46) $\displaystyle M_{1}$
$\displaystyle=\left\\{m:\frac{f_{1}(m)}{f_{0}(m)}>e^{\frac{1}{\lambda}}\frac{1}{\zeta}\right\\}.$
(47)

For the detailed derivations of the proposition, we refer to Section VII-C in
the appendix.

##### Remark

It is also possible to use the counterfactual detection rate
$P^{*}_{D}:\Gamma^{*}:\rightarrow[0,1]$

$P^{*}_{D}(\delta^{*})=\int_{\delta^{*}(m)=1}{f_{1}(m)dm},$ (48)

as the first term in the cost function of the attacker. The quantity in (48)
measures the detection performance when detector uses the optimal detection
rule yet under messages directly from the nature. The attacker’s goal is to
directly minimize the counterfactual detection rate. By observing (48), the
attacker can be viewed as someone who minimizes the weighted size of the
detection region. Using (48) in the attacker’s utility captures a non-myopic
attacker who cares not only his direct interaction with the detection but the
holistic sequential interaction (from Nature to Attacker to Detector).
However, one flaw is that detection rate (48) is an imaginary, conjectural, or
counterfactual quantity that is not directly measurable (or observable) by the
detector himself. The following proposition characterizes the relationship
between counterfactual and de facto detection rates:

######  Proposition 4.

Let $f_{0},f_{1},\sigma_{1},\sigma_{0}\in L^{1}(M)$ be as in assumption 2. Let
$P_{D},\bar{P}_{D}:\bar{\Gamma}\rightarrow[0,1]$ be two detection rates given
in (22) and (48). Then $P_{D}(\delta^{*})\geqslant{P}^{*}_{D}(\delta^{*})$
when the attacker and the detector choose equilibrium strategies.

###### Proof.

It follows from (44) that $e^{-\frac{1}{\lambda}}\leqslant c_{1}\leqslant 1$
so the attacker’s equilibrium strategy
$\sigma^{*}_{1}=c_{1}f_{1}(m)e^{-\frac{1}{\lambda}}\leqslant f_{1}(m)$ for all
$m\in M_{1}$, which proves the proposition. ∎

####  III-B4 Off-equilibrium analysis

The early analysis of the attacker’s strategies in signaling game has an
assumption that

$p(H_{0})\sigma^{*}_{0}(m)+p(H_{1})\sigma^{*}_{1}(m)>0,$ (49)

which implies that the message $m$ that the detector obtains must lie in the
support of the attacker’s equilibrium strategies. When this is not met; i.e.,
the detector receives $m$ such that $\sigma^{*}_{1}(m)=\sigma^{*}_{0}(m)=0$
(for example, the attacker could eliminate user’s message: $m=\varnothing$),
then the detector would develop an arbitrary posterior belief of the user’s
true type. We here assume that the attacker and the detector agree that the
posterior remains the same as the prior belief: that is
$p(H_{1}|m)=p(H_{1}),\;p(H_{0}|m)=p(H_{0})$ when
$m\notin\operatorname{supp}(\sigma_{1})$. Under this assumption, the
attacker’s best response to the receiver’s decision is not to distort the
message and send the message $m$ such that
$\sigma^{*}_{1}(m)=f_{1}(m),\;\sigma^{*}_{0}(m)=f_{0}(m)$ to minimize his
penalty resulting from the KL-divergence (since the first term in attacker’s
utility function becomes either $1$ or $0$ independent of the attacker’s
strategies $\sigma_{0},\sigma_{1}$). As a consequence, the ‘off-equilibrium’
path cannot constitute a PBNE for the game $\mathcal{G}_{2}$.

##  IV Neyman-Pearson Detectors under repeated observations

In this section we discuss the performance of detectors with various rational
capacities under repeated observations. We assume that the user’s type stays
the same throughout the game. At the beginning of every stage, the user sends
out identically distributed messages obeying the distribution $f_{0},f_{1}$
based on its true type as mentioned in (1). The attacker manipulates the
message based on his observation of the user’s type and his mixed strategies
in previous stages. At the end of the stage the detectors make a decision
based on the user’s true type. Our goal is to study the asymptotic performance
of both proactive detectors and passive detectors when they are given
sequential distorted messages.

##### Passive detector under repeated observations

We now formulate the game of passive detectors under repeated observations. We
write the detection rates and false alarm rates
$\hat{P}_{D},\;\hat{P}_{F}:\hat{\Gamma}^{(N_{1})}\rightarrow[0,1]$ based on
the decision rule ${\delta}^{(N_{1})}$ after observing $N_{1}$ pieces of
messages:

$\displaystyle\hat{P}_{F}({\delta}^{(N_{1})})$
$\displaystyle=\int_{\delta^{(N_{1})}(m^{(N_{1})})=1}{\prod^{N_{1}}_{1}{\hat{\sigma}_{0}(m_{j})}dm_{j}},$
(50) $\displaystyle\hat{P}_{D}(\delta^{(N_{1})})$
$\displaystyle=\int_{\delta^{(N_{1})}(m^{(N_{1})})=1}{\prod^{N_{1}}_{1}{\hat{\sigma}_{1}(m_{j})}dm_{j}},$
(51)

######  Definition 3 (History of action profiles).

We define the history of action profiles up to stage $N_{1}$, denoted as
$h^{(j)}\in M^{\otimes j}\times\\{0,1\\}^{\otimes j},\;j\in[N_{1}]$, as
follows:

$h^{(j)}=(m^{(j)},a^{(j)}),$ (52)

where $m^{(j)}=(m_{1},\dots,m_{j})\in M^{\otimes j}$ as a generic history of
messages up to stage $j$ and $a^{(j)}\in\\{0,1\\}^{\otimes j}=A^{\otimes
j}_{R}$ refers to history of the detector’s actions up to stage $j$.

We first study the multi-stage game for the proactive detectors when she
receives multiple messages from the attacker. In general, at the beginning of
every stage $j$, the attacker’s mixed strategy and the detector’s optimal
decision rule should depend on the history $h^{(j-1)}$. We now assume that the
detector’s history of actions does not play a role in the decision-making
process of both the attacker and the detector.

######  Assumption 4 (Action-independent assumption).

At every stage $j\in[N_{1}]$, the proactive detector’s optimal decision rule
$\delta^{(j)*}(\cdot|h^{(j)})\in\bar{\Gamma}^{(j)}$, the attacker’s optimal
mixed strategies of generating manipulated messages
$\sigma^{(j)*}_{1}(\cdot|h^{(j)}),\sigma^{(j)*}_{0}(\cdot|h^{(j)})\in\bar{A}^{(j)}_{S}$
and the posterior belief $p(\cdot|h^{(j)})$ depend only on the attacker’s
history of mixed strategies. Specifically, we have for $k\in\\{0,1\\}$,

$\displaystyle{\bar{\delta}}^{(j)*}(m_{j}|h^{(j)})$
$\displaystyle={\bar{\delta}}^{(j)*}(m_{j}|m^{(j)}),$ (53)
$\displaystyle\sigma^{(j)*}_{k}(m_{j}|h^{(j)})$
$\displaystyle=\sigma^{(j)*}_{k}(m_{j}|m^{(j)}),$ (54) $\displaystyle
p(H_{k}|h^{(j)})$ $\displaystyle=p(H_{k}|m^{(j)}).\;$ (55)

The three assumptions (53)(54)(55) imply the only useful information
accumulated throughout stages is the attacker’s mixed strategies. The multi-
stage game $\mathcal{G}^{N_{1}}_{2}$ based on the base game $\mathcal{G}_{2}$
is played as follows: before stage 1, the attacker observe the user’s type
($H_{0}$ or $H_{1}$); at the beginning of stage $j\in[N_{1}]$, the attacker
observes the the sender’s message and sends a distorted message $m_{j}\in M$
according on his mixed strategies $\sigma^{(j)}_{1},\sigma^{(j)}_{0}\in
L^{1}(M)$ to the detector, who makes a decision based on the current message
and the message history $m^{(j)}\in M^{\otimes j}$ regarding the user’s type.
The set of mixed strategies available to the attacker, denoted as
$\bar{A}^{(j)}_{S}$ for $j\in[N_{1}]$, is expressed as follows

$\displaystyle\bar{A}^{(j)}_{S}$
$\displaystyle=\Big{\\{}\begin{bmatrix}\sigma^{(j)}_{0}\\\
\sigma^{(j)}_{1}\end{bmatrix}\in({L}^{1}(M))^{\otimes 2}:$ (56)
$\displaystyle\int_{m^{\prime}\in
M}{\sigma^{(j)}_{i}(m^{\prime})dm^{\prime}}=1;\;\forall m^{\prime}\in
M,\sigma^{(j)}_{i}(m)\geqslant 0,\;i\in\\{0,1\\}\Big{\\}}.$

At the stage $j$, the attacker obtains his mixed strategies under $j$ messages
generates a stage cost
$\bar{C}^{(j)}_{S}:\mathcal{H}\times\bar{A}^{(j)}_{S}\times\bar{\Gamma}^{(j)}\rightarrow\mathbb{R}$
as follows: for $k=0,1$,

$\displaystyle{\bar{C}^{(j)}_{S}(H_{k},\sigma^{(j)}_{1},\sigma^{(j)}_{0},\bar{\delta}^{(j)*})}$
(57)
$\displaystyle=\int_{\bar{\delta}^{*(j)}(m)=1}{\sigma^{(j)}_{1}(m)dm}+\lambda\int_{m\in
M}{{\sigma^{(j)}_{k}(m)\ln\frac{\sigma^{(j)}_{k}(m)}{f_{k}(m)}}dm}.$

Denote a generic decision rule at stage $j$ as $\bar{\delta}^{(j)}:M^{\otimes
j}\rightarrow[0,1]$. Then the space of decision rules at the stage $j$,
denoted as $\bar{\Gamma}^{(j)}$, can be written as follows:

$\bar{\Gamma}^{(j)}=\\{\delta^{(j)}\in 2^{M^{\otimes
j}}:\;\delta^{(j)}(m^{(j)})p(H_{0}|m^{(j)})\leqslant\alpha_{j}\\}.$ (58)

Suppose the proactive detector is a maximizer, we can construct the objective
function at $j$-th stage denoted as $\bar{U}^{(j)}_{R}:M^{\otimes
j}\times\bar{A}_{R}^{(j)}\rightarrow\mathbb{R}$, based on which we can define
the utility function $\bar{\bar{U}}_{R}:M^{\otimes
N_{1}}\times\bar{\bar{A}}_{R}\rightarrow\mathbb{R}$ for the proactive detector
among all $N_{1}$-stages:

$\displaystyle\bar{\bar{U}}_{R}(m^{(N_{1})},\bar{\bar{\delta}}^{(N_{1})}(m^{(N_{1})})|h^{(j)})=\bar{U}^{(j)}_{R}(m^{(j)},\bar{\delta}^{(j)}(m^{(j)}))$
(59) $\displaystyle=\bar{\delta}^{(j)}(m^{(j)}){p(H_{1}|m^{(j)})},$

where the proactive detector obtains a posterior belief $p(H_{1}|m^{(j)})$
based on history of distorted messages $m_{1},\dots m_{j-1}$ and the current
message $j$ as expressed in (55). Applying the equation (55) recursively for
$j=1,2,\dots N_{1}$ we get the following:

$p(H_{1}|m^{(j)})=\frac{\prod_{k=1}^{j}{\sigma^{(k)*}_{1}(m_{k})}p(H_{1})}{\prod_{k=1}^{j}{\sigma^{(k)*}_{1}(m_{k})}p(H_{1})+\prod_{k=1}^{j}{\sigma^{(k)*}_{0}(m_{k})}p(H_{0})}$
(60)

In our multi-stage game, both the attacker and the detector know their actions
in previous stages, or have perfect recalls, so by Kuhn’s theorem [41] it
suffices to only consider the mixed strategies of attackers and behavior
strategies of detectors (or detection rules) throughout the game. We define
the multi-stage game as $\mathcal{G}^{(N_{1})}_{2}$ as follows:

######  Definition 4 (The Multi-stage Game of Proactive Detectors
$\mathcal{G}^{(N_{1})}_{2}$).

We define the $N_{1}$-stage repeated game of proactive detectors
$\mathcal{G}^{(N_{1})}_{2}$ as a tuple

$\mathcal{G}^{(N_{1})}_{2}=\langle\mathcal{I},\mathcal{H},p,M,\bar{\bar{\Gamma}},\bar{\bar{A}}_{R},\bar{\bar{C}}_{S},\bar{\bar{U}}_{R}\rangle,$
(61)

where $\mathcal{I},\mathcal{H},p,M$ refer to the set of players, the set of
hypotheses, the prior belief and the message space covered in
$\mathcal{G}_{2}$ as in definition 1. In particular, the set
$\bar{\bar{\Gamma}}:M^{\otimes N_{1}}\rightarrow[0,1]^{N_{1}}$ with

$\bar{\bar{\Gamma}}=\underset{j=1,2,\dots,N_{1}}{\bigotimes}{\bar{\Gamma}^{(j)}}=\underset{j=1,2,\dots,N_{1}}{\bigotimes}{\bar{\Gamma}^{\otimes
j}},$ (62)

where $\bar{\Gamma}^{(j)}=\bar{\Gamma}^{\otimes j}$ stands for the space of
decision rules at the stage $j$, stands for the profile of strategy space for
the detector as in (62). The set
$\bar{\bar{A}}_{R}=\bigotimes\\{0,1\\}^{\otimes N_{1}}$ stands for the space
of history of the detector’s pure actions. The set

$\bar{\bar{A}}_{S}=\underset{j=1,2,\dots,N_{1}}{\bigotimes}{\bar{A}^{(j)}_{S}},$
(63)

where $\bar{A}^{(j)}_{S}$ is defined in (56), represents the history of mixed
strategy spaces for the attacker. The functions
$\bar{\bar{C}}_{S}:\mathcal{H}\times\bar{\bar{A}}_{S}\times\bar{\bar{\Gamma}}\rightarrow\mathbb{R},\;\bar{\bar{U}}_{R}:\;M^{\otimes
N_{1}}\times\bar{\bar{\Gamma}}\rightarrow\mathbb{R}$ stand for the attacker’s
average of history of cost functions and the proactive detector’s average of
history of utility functions defined in (59) and in
(LABEL:eq:cost_function_repeat), respectively.

In general, a dynamic Bayesian game could yield many equilibrium concepts. In
the following we compute the subgame perfect Bayesian Nash equilibrium
(s-PBNE) and

####  IV-1 Subgame perfect Bayesian equilibrium

We assume that at any stage $j$, both the attacker and the proactive detector
aims at optimizing their strategies as if the game starts at stage $j$.
Therefore the attacker and the proactive detector aims at solving the
following sub-game perfect Bayesian Nash equilibrium (S-PBNE) as follows:

######  Definition 5 (subgame perfect Bayesian Nash equilibrium (s-PBNE)).

An s-PBNE for the dynamic Bayesian game $\mathcal{G}^{(N_{1})}_{2}$ mentioned
in Definition 4 refers to a mixed strategy vector
$\bar{\bar{\sigma}}^{(N_{1})*}_{1},\bar{\bar{\sigma}}^{(N_{1})*}_{0}\in\bar{\bar{A}}_{S}$,
a vector of decision rules
$\bar{\bar{\delta}}^{(N_{1})*}\in\bar{\bar{\Gamma}}$ and a vector of posterior
beliefs $\\{p(H_{1}|m^{(j)}),p(H_{0}|m^{(j)})\\}^{N_{1}}_{1}$ satisfying the
following conditions:

  1. 1.

(Detector’s subgame sequential rationality) At every stage
$j=1,2,\dots,N_{1}$, the detector maximizes her stage utility function for the
pure strategy $\delta^{(j)}\in\bar{\Gamma}^{(j)},\;\;\delta^{(j)}:M^{\otimes
j}\rightarrow\\{0,1\\}$ under the attacker’s stage strategies
$\sigma^{(j)*}_{0},\sigma^{(j)*}_{1}$, the message history $m^{(j)}$, and the
posterior belief $p(H_{0}|m^{(j)}),p(H_{1}|m^{(j)})$:

$\delta^{(j)*}\in\arg\underset{\delta^{(j)}\in\bar{\Gamma}^{(j)}}{\max}\;\bar{U}^{(j)}_{R}(m^{(j)},\;\delta^{(j)}(m^{(j)})).$
(64)

  2. 2.

(Attacker’s subgame sequential rationality) At every stage
$j=1,2,\dots,N_{1}$, for $i\in\\{0,1\\}$ the attacker minimizes his expected
cost given the detector optimal strategy $\delta^{(j)*}$:

$\sigma^{(j)*}_{i}\in\arg\underset{\sigma^{(j)}_{i}\in\bar{A}^{(j)}_{S}}{\min}\;\bar{C}^{(j)}_{S}(H_{i},\sigma^{(j)}_{i},\sigma^{(j)}_{-i},\delta^{(j)*}).$
(65)

  3. 3.

(Subgame Belief consistency) At every stage $j\in[N_{1}]$, the belief
$p(H_{0}|m^{(j-1)}),p(H_{1}|m^{(j-1)})$ prior to $j$-th stage is updated into
a posterior based on attacker’s mixed strategies
$\sigma^{(j)*}_{k},\;k\in\\{0,1\\}$ at stage $j$:

$p(H_{k}|m^{(j)})=\frac{p(H_{k}|m^{(j-1)})\sigma^{(j)*}_{k}(m_{j})}{\sum_{i\in\\{0,1\\}}{p(H_{i}|m^{(j-1)})\sigma^{(j)*}_{i}(m_{j})}}$
(66)

if $\sum_{i\in\\{0,1\\}}{p(H_{i}|m^{(j-1)})\sigma^{(j)*}_{i}(m_{j})}>0$;
otherwise $p(H_{k}|m^{(j)})$ could be arbitrary.

Notice in general the detector’s decision rule at stage $j$, denoted as
$\delta^{(j)}$, as well as the attacker’s mixed strategies
$\sigma^{(j)}_{1},\sigma^{(j)}_{0}$, should both also depend on the detector’s
previous action history $a^{(j-1)}$ as well as the attacker’s mixed action
history $\bar{\bar{\sigma}}^{(j-1)}_{1},\bar{\bar{\sigma}}^{(j-1)}_{0}$, but
here we assume the previous action history does not influence the detector’s
decision rule nor the attacker’s distortion map at later stages.

We could obtain the s-PBE using the method of forward induction. At the stage
$j$, the proactive detector faces the following optimization problem:

$\displaystyle\underset{\bar{\delta}^{(j)}\in\bar{\Gamma}^{(j)}}{\sup}$
$\displaystyle\;\bar{\delta}^{(j)}(m^{(j)}){p(H_{1}|m^{(j)})},\;\text{s.t.}$
$\displaystyle\bar{\delta}^{(j)}(m^{(j)})p(H_{0}|m^{(j)})\leqslant\alpha_{j}.$
(67)

Thus we write the optimal decision rule explicitly as follows:

$\bar{\delta}^{*(j)}(m_{j}|m^{(j-1)})=\begin{cases}1&{\frac{\sigma^{(j)*}_{1}(m_{j})}{\sigma^{(j)*}_{0}(m_{j})}}>\beta_{j},\\\
r\in(0,1)&{\frac{\sigma^{(j)*}_{1}(m_{j})}{\sigma^{(j)*}_{0}(m_{j})}}=\beta_{j},\\\
0&{\frac{\sigma^{(j)*}_{1}(m_{j})}{\sigma^{(j)*}_{0}(m_{j})}}<\beta_{j},\end{cases}$
(68)

with

$\beta_{j}=\prod_{k=1}^{j-1}{\frac{\sigma^{(k)*}_{0}(m_{k})}{\sigma^{(k)*}_{1}(m_{k})}}\beta^{j},\;\;\text{and}\;\beta^{j}=\frac{p(H_{0})}{p(H_{1})}\left(\frac{1}{\alpha_{j}}-1\right),$
(69)

where $\beta$ is the same threshold as in (28). We now study the attacker’s
behaviors. At the $j$-the stage, we can denote
$\sigma^{*(j)}_{1},\sigma^{*(j)}_{0}\in\bar{A}^{(j)}_{S}$ as his generic mixed
strategies under user’s type $H_{1},H_{0}$ respectively. The attacker can aim
at minimizing the sum (or average) of the cost function as in (59). That is
equivalent to the following $N_{1}$ optimization problems: based on the
proactive detector’s optimal decision rule (68) and the theory of game
potentials [35], at every stage $j$ the attacker faces the following
optimization problem:

$\displaystyle\underset{\begin{subarray}{c}(\sigma^{(j)}_{1},\sigma^{(j)}_{0})\in\bar{A}^{(j)}_{S}\end{subarray}}{\min}\;\int_{\delta^{(j)*}(m_{j})=1}{\sigma^{(j)}_{1}(m_{j})dm_{j}}$
(70)
$\displaystyle+\lambda\int_{M}{\left({\sigma^{(j)}_{1}(m_{j})\ln\frac{\sigma^{(j)}_{1}(m_{j})}{f_{1}(m_{j})}}+\sigma^{(j)}_{0}(m_{j})\ln\frac{\sigma^{(j)}_{0}(m_{j})}{f_{0}(m_{j})}\right)dm_{j}},$

Similar to solving (29), we can thus obtain the attacker’s equilibrium
strategies at stage $j$ as

$\displaystyle\sigma^{(j)*}_{0}(m)$
$\displaystyle=\begin{cases}c^{j}_{0}f_{0}(m)&m\in M^{j}_{0},\\\
c^{j}_{0}f_{1}^{\frac{\beta_{j}}{1+\beta_{j}}}(m)f_{0}^{\frac{1}{1+\beta_{j}}}(m)\zeta_{j}^{\frac{\beta_{j}}{1+\beta_{j}}}&m\in
M^{j}_{*},\\\ c^{j}_{0}f_{0}(m)&m\in M^{j}_{1};\end{cases}$ (71)
$\displaystyle\sigma^{(j)*}_{1}(m)$
$\displaystyle=\begin{cases}c^{j}_{1}f_{1}(m)&m\in M^{j}_{0},\\\
c^{j}_{1}f_{1}^{\frac{\beta_{j}}{1+\beta_{j}}}(m)f_{0}^{\frac{1}{1+\beta_{j}}}(m)\zeta_{j}^{-\frac{1}{1+\beta_{j}}}&m\in
M^{j}_{*},\\\ c^{j}_{1}f_{1}(m)e^{-\frac{1}{\lambda}}&m\in
M^{j}_{1};\end{cases}$ (72)

with the normalization factors guaranteeing that
$\int_{M}{\sigma^{(j)}_{0}(m)dm}=1$ and $\int_{M}{\sigma^{(j)}_{1}(m)dm}=1$.
The exact regions $M^{j}_{0},M^{j}_{*},M^{j}_{1}$ (strict acceptance region,
uncertainty region, strict rejection region) can be characterized in terms of
$\zeta_{j}$:
$M^{j}_{0}=\left\\{m:\frac{f_{1}(m)}{f_{0}(m)}<\frac{1}{\zeta_{j}}\right\\},\;\;M^{j}_{*}=\left\\{m:\frac{1}{\zeta_{j}}\leqslant\frac{f_{1}(m)}{f_{0}(m)}\leqslant
e^{\frac{1}{\lambda}}\frac{1}{\zeta_{j}}\right\\},\;M^{j}_{1}=\left\\{m:\frac{f_{1}(m)}{f_{0}(m)}>e^{\frac{1}{\lambda}}\frac{1}{\zeta_{j}}\right\\}$.
We finally summarize the derivations of the s-PBNE of the game
$\mathcal{G}^{(N_{1})}_{2}$ into the following proposition:

######  Proposition 5.

A subgame perfect Bayesian equilibrium of the game $\mathcal{G}^{(N_{1})}_{2}$
refers to a mixed strategy vector
$\bar{\bar{\sigma}}^{(N_{1})*}_{1}=(\sigma^{(1)*}_{1},\sigma^{(2)*}_{1},\dots,\sigma^{(N_{1})*}_{1}),\;\bar{\bar{\sigma}}^{(N_{1})*}_{0}=(\sigma^{(1)*}_{0},\sigma^{(2)*}_{0},\dots,\sigma^{(N_{1})*}_{0})$,
where generic optimal stage strategies $\sigma^{(j)*}_{0},\sigma^{(j)*}_{1}$
are given in (71) and (72); a vector of decision rules
$\bar{\bar{\delta}}^{(N_{1})*}=({\bar{\delta}}^{(1)*},{\bar{\delta}}^{(2)*},\dots,{\bar{\delta}}^{(N_{1})*})$
with ${\bar{\delta}}^{(j)*}$ given in (68); a vector of posterior beliefs
$\\{p(H_{1}|m^{(j)}),p(H_{0}|m^{(j)})\\}^{N_{1}}_{1}$ (for simplicity, denoted
as $p$) given in (60).

We could write the detection rates
$\bar{P}_{D}:\bar{\Gamma}^{(j)}\rightarrow[0,1]$ and false alarm rates
$\bar{P}_{F}:\bar{\Gamma}^{(j)}\rightarrow[0,1]$ of a proactive detector as
follows:

$\displaystyle\bar{P}_{F}(\bar{\delta}^{(N_{1})*})$
$\displaystyle=\int_{\bar{\delta}^{(N_{1})*}=1}{\prod^{N_{1}}_{1}{\sigma^{(j)*}_{0}(m_{j})}dm_{j}},$
(73) $\displaystyle\bar{P}_{D}(\bar{\delta}^{(N_{1})*})$
$\displaystyle=\int_{\bar{\delta}^{(N_{1})*}=1}{\prod^{N_{1}}_{1}{\sigma^{(j)*}_{1}(m_{j})}dm_{j}}.$
(74)

##### Remark

There are two other equilibrium concepts for the game
$\mathcal{G}^{N_{1}}_{2}$: sequential equilbrium and extensive-form perfect
Bayesian equilbrium. Since neither the attacker nor the detector have more
than two types, by [42] the sequential equilibrium of the game
$\mathcal{G}^{N_{1}}_{2}$ coincides with the one in definition 5. Also the
s-PBNE of $\mathcal{G}^{N_{1}}_{2}$ is robust against perturbations. Thus it
suffices to discuss s-PBNE for the dynamic Bayesian game
$\mathcal{G}^{N_{1}}_{2}$.

##  V Case Studies: Intrusion Detection Evasion

In this section, we conduct numerical experiments to evaluate the performances
of passive and of proactive detectors. We apply the theories of passive and of
proactive detectors developed in section II and section III to an intrusion
detection evasion scenario. We depict the performance of proactive detectors
under repeated messages based on theories in section IV.

An intrusion detection system (IDS) monitors the real-time traffic in the
network and identifies an intrusion attack in two ways: via signature
detection method and anomaly detection method. To bypass detection, attackers
often disguise their actions by evasion techniques [43] such as polymorphic
blending, packet splitting, payload mutation, etc. The existing evasion
techniques focus on operating on the traffic in the network by modify the
packets traveling to the IDS. Attackers may adopt a combination of the various
evasion techniques to deceive the IDS to the most. There is a lack of holistic
theories characterizing high-level viewpoint of evasion techniques that
attackers adopt for network intrusion. The attacker’s actions like mutations,
splittings, insertions can be characterized as ‘distortion maps’ in our model.

We study a concrete example of an evasion technique based on packet payload
mutation, during which the attacker turns packets that signal an intrusion
into semantic equivalent ones. The manipulated packet payloads will present
features that do not trigger the alarm of the IDS and therefore are more
likely to evade detection. To fit our holistic theories developed in section
II and section III, we assume that a host (it) plays the role of the user
whose type could be either benign $H_{0}$ or malicious $H_{1}$. An adversary
(he) plays the role of an attacker and the IDS (she) plays the role of a
detector. The outcome of every event is either successful or unsuccessful. For
a benign host, the chance for a failed event in a single attempt is
$\theta_{0}$, while for a malicious host the corresponding probability of
failure is $\theta_{1}$ (and $\theta_{1}>\theta_{0}$). We assume the genuine
distributions of the message underlying the hypotheses $H_{0},H_{1}$ are thus
Bernoulli distributions with parameter $\theta_{0},\theta_{1}$ respectively:

$\displaystyle f_{1}(1)=P[m=1|H_{1}]$
$\displaystyle=\theta_{1},\;f_{1}(0)=P[m=0|H_{1}]=1-\theta_{1},\;$ (75)
$\displaystyle f_{0}(1)=P[m=1|H_{0}]$
$\displaystyle=\theta_{0},\;f_{0}(0)=P[m=1|H_{0}]=1-\theta_{0}.$

The binary message space contains the smallest amount of information that a
user can convey. We can compute the attacker’s strategies at equilibrium,
parameterized by $\bar{\theta}_{0},\;\bar{\theta}_{1}$, through (39) and (40)
and depict the relationship between $\bar{\theta}_{1},\bar{\theta}_{0}$ in
terms of $\theta_{1},\theta_{0}$ in Fig. 4. Notice that there is an abrupt
change of the slope of the value of $\bar{\theta}_{1}$ at the surface
$\theta_{1}=\beta\theta_{0}$ in Fig. 4, suggesting non-smoothness of the
attacker’s strategies in region of uncertainty. The resulting equilibrium
strategies of the adversary can help compute the detection rates (6)(22) and
false alarm rates (7) (23)

We corroborate our theoretical results by studying the IDS’ equilibrium
receiver-operational-characteristic (EROC) curves [36], which characterize the
fundamental relationship of the detection rates and the false alarm rates of
the IDS. The EROC curves of passive, proactive and non-adversarial IDS are
depicted in Fig. 3(a) under the same choice of $\lambda$. We observe that the
proactive IDS outperforms the passive IDS in the sense that the the former’s
EROC curve always lies above the latter’s one. This is because the proactive
IDS can take advantage of the attacker’s message to update the inference upon
the user’s true type to counteract the attack. The detection rates and false
alarm rates for the detectors under repeated observations are depicted in Fig.
3(b). We could observe that just like the non-adversarial IDS, both the
passive and the proactive IDS can also reach a perfect prediction (detection
rate converges to 1, while false alarm rate converges to 0) given more and
more distorted messages, yet the convergence speeds of these detectors vary:
compared to the non-adversarial IDS, the passive IDS converges more slowly on
its detection rates, while the proactive IDS converges more slowly on its
false alarm rates.

Figure 3: a) EROC curves for passive, proactive and non-adversarial IDS. b)
The detection rates and false alarm rates for passive, proactive and non-
adversarial IDS under $N_{1}=15$ observations with the initial threshold
$\beta=0.9$. In both (a) and (b), the nominal distributions under
$H_{1},H_{0}$ are Bernoulli distributions with parameter
$\theta_{1}=0.7,\theta_{0}=0.3$. The parameter $\lambda=0.75$.

Figure 4: In (a) and (b) we depict the dependency of
$\bar{\theta}_{1},\bar{\theta}_{0}$, which parameterize the attacker’s
equilibrium strategies against the detector when the genuine Bernoulli
distributions are parameterized by $\theta_{1},\theta_{0}$. In (c) and (d) we
fix $\theta_{1}$ and $\theta_{0}$ respectively and depict the dependency of
$\bar{\theta}_{1},\bar{\theta}_{0}$ regarding the other parameter. We pick
$\lambda=0.6,\;\beta=0.9$.

##  VI Conclusion

We have consolidated the classical Neyman-Pearson detection method into the
framework of sequential games to develop holistic theories of passive
detectors and of proactive detectors to help develop evasion-aware detectors
that cope with ever-developing stealthy attackers. Depending on different
rational capacities for the detectors, we employ the frameworks of Stackelberg
games and of signaling games to capture the behaviors of passive and of
proactive detectors and depict the detectors’ performances evaluated by EROC
curves. Our results reveal the proactive detectors outperform the passive ones
as the former ones can take advantage of the distorted message to infer the
user’s type so as to countermeasure the attacker’s manipulation of messages.

Future extensions may include designing a decentralized detection scheme for
M-ary hypothesis testing similar to [44]. The signaling game framework can
also be combined with statistical estimations techniques, which also has
implementations in security such as analyzing spoofing attacks [45].

## References

  * [1] “New watchguard threat lab report shows network attacks at highest point over last three years,” 2022.
  * [2] R. Jain, “Security in computer networks,” 2009.
  * [3] N. Tuptuk and S. Hailes, “Security of smart manufacturing systems,” Journal of manufacturing systems, vol. 47, pp. 93–106, 2018.
  * [4] K. Kim, J. S. Kim, S. Jeong, J.-H. Park, and H. K. Kim, “Cybersecurity for autonomous vehicles: Review of attacks and defense,” Computers & Security, vol. 103, p. 102150, 2021.
  * [5] J. Neyman and E. S. Pearson, “Ix. on the problem of the most efficient tests of statistical hypotheses,” Philosophical Transactions of the Royal Society of London. Series A, Containing Papers of a Mathematical or Physical Character, vol. 231, no. 694-706, pp. 289–337, 1933.
  * [6] C. Kruegel, D. Mutz, W. Robertson, and F. Valeur, “Bayesian event classification for intrusion detection,” in 19th Annual Computer Security Applications Conference, 2003. Proceedings., pp. 14–23, IEEE, 2003\.
  * [7] W. Lee and S. Stolfo, “Data mining approaches for intrusion detection,” 1998.
  * [8] W. Lee, S. J. Stolfo, and K. W. Mok, “A data mining framework for building intrusion detection models,” in Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No. 99CB36344), pp. 120–132, IEEE, 1999.
  * [9] T. Başar and G. J. Olsder, Dynamic noncooperative game theory.  SIAM, 1998.
  * [10] I.-K. Cho and D. M. Kreps, “Signaling games and stable equilibria,” The Quarterly Journal of Economics, vol. 102, no. 2, pp. 179–221, 1987.
  * [11] S. R. Etesami and T. Başar, “Dynamic games in cyber-physical security: An overview,” Dynamic Games and Applications, vol. 9, no. 4, pp. 884–913, 2019.
  * [12] Y. Mao, H. Jafarnejadsani, P. Zhao, E. Akyol, and N. Hovakimyan, “Novel stealthy attack and defense strategies for networked control systems,” IEEE Transactions on Automatic Control, vol. 65, no. 9, pp. 3847–3862, 2020\.
  * [13] F. Pasqualetti, F. Dörfler, and F. Bullo, “Attack detection and identification in cyber-physical systems,” IEEE transactions on automatic control, vol. 58, no. 11, pp. 2715–2729, 2013.
  * [14] A. B. Ashfaq, M. Q. Ali, E. Al-Shaer, and S. A. Khayam, “Poster: revisiting anomaly detection system design philosophy,” in Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, pp. 1473–1476, 2013.
  * [15] R. M. Góes, E. Kang, R. Kwong, and S. Lafortune, “Stealthy deception attacks for cyber-physical systems,” in 2017 IEEE 56th Annual Conference on Decision and Control (CDC), pp. 4224–4230, 2017.
  * [16] M. Van Dijk, A. Juels, A. Oprea, and R. L. Rivest, “Flipit: The game of “stealthy takeover”,” Journal of Cryptology, vol. 26, no. 4, pp. 655–713, 2013.
  * [17] M. H. Manshaei, Q. Zhu, T. Alpcan, T. Bacşar, and J.-P. Hubaux, “Game theory meets network security and privacy,” ACM Computing Surveys (CSUR), vol. 45, no. 3, pp. 1–39, 2013.
  * [18] Q. Zhu and T. Basar, “Game-theoretic methods for robustness, security, and resilience of cyberphysical control systems: games-in-games principle for optimal cross-layer resilient control systems,” IEEE Control Systems Magazine, vol. 35, no. 1, pp. 46–65, 2015.
  * [19] C. Kiennert, Z. Ismail, H. Debar, and J. Leneutre, “A survey on game-theoretic approaches for intrusion detection and response optimization,” ACM Computing Surveys (CSUR), vol. 51, no. 5, pp. 1–31, 2018.
  * [20] A. Gupta, C. Langbort, and T. Başar, “Dynamic games with asymmetric information and resource constrained players with applications to security of cyberphysical systems,” IEEE Transactions on Control of Network Systems, vol. 4, no. 1, pp. 71–81, 2016.
  * [21] L. Chen and J. Leneutre, “A game theoretical framework on intrusion detection in heterogeneous networks,” IEEE Transactions on Information Forensics and Security, vol. 4, no. 2, pp. 165–178, 2009.
  * [22] S. Sarıtaş, S. Gezici, and S. Yüksel, “Hypothesis testing under subjective priors and costs as a signaling game,” IEEE Transactions on Signal Processing, vol. 67, no. 19, pp. 5169–5183, 2019.
  * [23] T. Alpcan and T. Başar, Network security: A decision and game-theoretic approach.  Cambridge University Press, 2010.
  * [24] N. Dalvi, P. Domingos, S. Sanghai, and D. Verma, “Adversarial classification,” in Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, pp. 99–108, 2004.
  * [25] L. Huang, A. D. Joseph, B. Nelson, B. I. Rubinstein, and J. D. Tygar, “Adversarial machine learning,” in Proceedings of the 4th ACM workshop on Security and artificial intelligence, pp. 43–58, 2011.
  * [26] M. Barreno, B. Nelson, R. Sears, A. D. Joseph, and J. D. Tygar, “Can machine learning be secure?,” in Proceedings of the 2006 ACM Symposium on Information, computer and communications security, pp. 16–25, 2006.
  * [27] B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Šrndić, P. Laskov, G. Giacinto, and F. Roli, “Evasion attacks against machine learning at test time,” in Joint European conference on machine learning and knowledge discovery in databases, pp. 387–402, Springer, 2013.
  * [28] A. A. Cárdenas and J. S. Baras, “Evaluation of classifiers: Practical considerations for security applications,” in AAAI Workshop on Evaluation Methods for Machine Learning, pp. 409–415, 2006.
  * [29] R. Zhang and Q. Zhu, “A game-theoretic approach to design secure and resilient distributed support vector machines,” IEEE Transactions on Neural Networks and Learning Systems, vol. 29, no. 11, pp. 5512–5527, 2018.
  * [30] E. L. Lehmann and J. P. Romano, Testing statistical hypotheses.  Springer Science & Business Media, 2006.
  * [31] C. Villani, Optimal transport: old and new, vol. 338.  Springer, 2009.
  * [32] G. B. Folland, Real analysis: modern techniques and their applications, vol. 40.  John Wiley & Sons, 1999.
  * [33] N. Kartik, “Strategic communication with lying costs,” The Review of Economic Studies, vol. 76, no. 4, pp. 1359–1395, 2009.
  * [34] M. Q. Ali, A. B. Ashfaq, E. Al-Shaer, and Q. Duan, “Towards a science of anomaly detection system evasion,” in 2015 IEEE Conference on Communications and Network Security (CNS), pp. 460–468, IEEE, 2015.
  * [35] D. Monderer and L. S. Shapley, “Potential games,” Games and economic behavior, vol. 14, no. 1, pp. 124–143, 1996.
  * [36] B. C. Levy, Principles of signal detection and parameter estimation.  Springer Science & Business Media, 2008.
  * [37] C. E. Shannon, “Communication theory of secrecy systems,” The Bell system technical journal, vol. 28, no. 4, pp. 656–715, 1949.
  * [38] D. Fudenberg, F. Drew, D. K. Levine, and D. K. Levine, The theory of learning in games, vol. 2.  MIT press, 1998.
  * [39] V. P. Crawford and J. Sobel, “Strategic information transmission,” Econometrica: Journal of the Econometric Society, pp. 1431–1451, 1982.
  * [40] D. G. Luenberger, Optimization by vector space methods.  John Wiley & Sons, 1997.
  * [41] R. J. Aumann, “Mixed and behavior strategies in infinite extensive games,” tech. rep., PRINCETON UNIV NJ, 1961.
  * [42] D. Fudenberg and J. Tirole, “Perfect bayesian equilibrium and sequential equilibrium,” journal of Economic Theory, vol. 53, no. 2, pp. 236–260, 1991.
  * [43] T.-H. Cheng, Y.-D. Lin, Y.-C. Lai, and P.-C. Lin, “Evasion techniques: Sneaking through your intrusion detection/prevention systems,” IEEE Communications Surveys & Tutorials, vol. 14, no. 4, pp. 1011–1020, 2011.
  * [44] J. N. Tsitsiklis et al., “Decentralized detection,” 1989.
  * [45] E. d’Afflisio, P. Braca, and P. Willett, “Malicious ais spoofing and abnormal stealth deviations: A comprehensive statistical framework for maritime anomaly detection,” IEEE Transactions on Aerospace and Electronic Systems, vol. 57, no. 4, pp. 2093–2108, 2021.
  * [46] S. Boyd, S. P. Boyd, and L. Vandenberghe, Convex optimization.  Cambridge university press, 2004.

##  VII Appendix

###  VII-A Proof of proposition in 1

###### Proof.

When $\lambda=0$ our assumption (1) does not need to hold since there is no KL
divergence term in the objective function. Thus we can assume the space of
attacker’s strategies $\sigma_{1},\sigma_{0}$ are all probability
distributions on the message space $M$ so the optimization problem (29)
reduces to the following:

$\underset{\begin{subarray}{c}(\sigma_{1},\sigma_{0})\in\bar{A}_{S}\end{subarray}}{\min}\;\int_{m\in
M_{1}}{\sigma_{1}(m)dm},$ (76)

where $\sigma_{1},\sigma_{0}$ are subjective to the constraints the same as
(29). When $\beta\geqslant 1$, we verify that all strategies
$\sigma_{1}\leqslant\beta\sigma_{0}$ lead to the region of rejection $M_{1}$
to be an empty set, which means the value of the objective function is $0$.
Because the objective function value cannot be negative (it means receiver’s
detection rate), all of such pairs of strategies are equilibrium strategies.

When $0<\beta<1$, we can find the attacker’s equilibrium strategies by
consider best response dynamics. Denote
$\text{BR}_{0},\text{BR}_{1}:L^{1}(M)\rightarrow L^{1}(M)$ as the best
responding strategies $\sigma_{0},\sigma_{1}$ when the other is given. We can
construct the following best responses:

$\displaystyle\text{BR}_{0}[\sigma_{1}]$
$\displaystyle=\begin{cases}\frac{1}{\beta}\sigma^{*}_{1}(m)&\text{if}\;\sigma_{1}(m)>\tau,\;\int_{\sigma_{1}(m)>\tau}{\sigma_{1}(m)dm}=\beta,\\\
0&\mbox{otherwise}.\end{cases}$ (77)
$\displaystyle\text{BR}_{1}[\sigma_{0}]\;$
$\displaystyle=\begin{cases}\beta\sigma_{0}(m)&\text{if}\;\sigma_{0}(m)\geqslant
0,\\\ (1-\beta)\varphi(m)&\mbox{otherwise}.\end{cases}$ (78)

Now we can verify that the equilibrium (32) and (34) meet the requirement
$\sigma_{1}^{*}=\text{BR}_{0}[\sigma^{*}_{0}],\;\sigma_{0}^{*}=\text{BR}_{1}[\sigma^{*}_{1}]$,
which concludes the proof. ∎

###  VII-B Proof of proposition 2

###### Proof.

We prove the statement by construction. When $\lambda\rightarrow\infty$, the
objective function in (29) reduces to the sum of KL divergence between
$\sigma_{1}$ and $f_{1}$ and the KL divergence between $\sigma_{0}$ and
$f_{0}$. By the non-negativity of KL divergences, we know both terms are non-
negative and only reach zero when (36) holds, which can be realized by setting
$\sigma^{*}_{1}(m)=f_{1}(m),\;\sigma^{*}_{0}(m)=f_{0}(m)$. As a result, the
optimal solutions for the problem (29) when $\lambda\rightarrow\infty$ is
(36). ∎

###  VII-C Proof of theorem 3

###### Proof.

To solve (29), we first introduce
$\sigma^{\prime}_{1},\sigma^{\prime\prime}_{1},\sigma^{\prime}_{0},\sigma^{\prime\prime}_{0}:M\rightarrow\mathbb{R}_{+},$
as the restrictions of $\sigma_{1},\sigma_{0}$ on $\bar{M}_{0},\bar{M}_{1}$,
respectively, where
$\bar{M}_{0}=\left\\{m:\sigma_{1}(m)\leqslant\beta\sigma_{0}(m)\right\\},\;\bar{M}_{1}=\left\\{m:\sigma_{1}(m)>\beta\sigma_{0}(m)\right\\}$.
Based on the decomposition we can convert (29) into the following:

$\displaystyle\underset{\begin{subarray}{c}\sigma^{\prime}_{0},\sigma^{\prime}_{1},\sigma^{\prime\prime}_{0},\sigma^{\prime\prime}_{1}\end{subarray}}{\min}\int_{M}{\sigma^{\prime\prime}_{1}(m)dm}$
(79)
$\displaystyle+\lambda\int_{M}{\sigma^{\prime}_{1}(m)\ln\frac{\sigma^{\prime}_{1}(m)}{f_{1}(m)}+\sigma^{\prime\prime}_{1}(m)\ln\frac{\sigma^{\prime\prime}_{1}(m)}{f_{1}(m)}dm}$
$\displaystyle+\lambda\int_{M}{\left(\sigma^{\prime}_{0}(m)\ln\frac{\sigma^{\prime}_{0}(m)}{f_{0}(m)}+\sigma^{\prime\prime}_{0}(m)\ln\frac{\sigma^{\prime\prime}_{0}(m)}{f_{0}(m)}\right)dm},$
$\displaystyle\text{s.t.}\;\int_{M}{(\sigma^{\prime}_{0}(m)+\sigma^{\prime\prime}_{0}(m))dm}=1,$
$\displaystyle\qquad\int_{M}{(\sigma^{\prime}_{1}(m)+\sigma^{\prime\prime}_{1}(m))dm}=1,$
$\displaystyle\qquad{\sigma^{\prime\prime}_{1}(m)}-\beta{\sigma^{\prime\prime}_{0}(m)}>0,\;\forall
m\in\bar{M}_{1},$
$\displaystyle\qquad{\sigma^{\prime}_{1}(m)}-\beta{\sigma^{\prime}_{0}(m)}\leqslant
0,\;\forall m\in\bar{M}_{0},$
$\displaystyle\qquad\sigma^{\prime}_{1}(m),\sigma_{1}^{\prime\prime}(m),\sigma^{\prime}_{0}(m),\sigma^{\prime\prime}_{0}(m)\geqslant
0,\;\forall m\in M.$

where the support for
$\sigma^{\prime}_{0},\sigma^{\prime}_{1},\sigma_{0}^{\prime\prime},\sigma^{\prime\prime}_{1}\in
L^{1}(M)$ satisfy
$\operatorname{supp}\sigma^{\prime}_{1}=\operatorname{supp}\sigma^{\prime}_{0},\;\;\operatorname{supp}\sigma^{\prime\prime}_{1}=\operatorname{supp}\sigma^{\prime\prime}_{0},\;\operatorname{supp}\sigma^{\prime}_{1}\cap\operatorname{supp}\sigma^{\prime\prime}_{1}=\varnothing,\;\operatorname{supp}\sigma^{\prime}_{1}\cup\operatorname{supp}\sigma^{\prime\prime}_{1}=M$.
By theories of equivalent optimization problems [46], we could see the optimal
solutions $\sigma^{*}_{0},\sigma^{*}_{1}$ of the problem (29) and the one of
(79) can be connected using decomposition.

Solving the KKT conditions of the problem (79) we write
$\sigma^{\prime}_{1},\sigma^{\prime}_{0},\sigma^{\prime\prime}_{1},\sigma^{\prime\prime}_{0}$
in terms of $\rho_{0},\rho_{1}$: $\forall m\in\bar{M}_{0}$,

$\displaystyle{\sigma^{\prime*}_{0}}(m)=c_{0}f_{0}(m)e^{\frac{\beta\rho_{0}(m)}{\lambda}},\;{\sigma^{\prime*}_{1}}(m)=c_{1}f_{1}(m)e^{-\frac{\rho_{0}(m)}{\lambda}};$
(80) $\displaystyle\forall
m\in\bar{M}_{1},\;\sigma^{\prime\prime*}_{0}(m)=c_{0}f_{0}(m),\;\sigma^{\prime\prime*}_{1}(m)=c_{1}f_{1}(m)e^{-\frac{1}{\lambda}},$
(81)

where we introduce
$c_{0}=e^{-\gamma_{0}/\lambda},\;c_{1}=e^{-\gamma_{1}/\lambda}$. We can then
construct the optimal solution for (29) via
$\sigma^{*}_{1}=\sigma^{\prime*}_{1}+\sigma^{\prime\prime*}_{1},\;\sigma^{*}_{0}=\sigma^{\prime*}_{0}+\sigma^{\prime\prime*}_{0}$.

We know $\rho_{0}(m)\geqslant 0$ for every $m\in\bar{M}_{0}$. Denote
$M_{*}=\\{m:\;\rho_{0}(m)>0\\}$ and $M_{0}=\\{m:\;\rho_{0}(m)=0\\}$ as a
partition of $M_{0}$. For every $m\in{M}_{*}$, we have

$\sigma^{*}_{1}(m)-\beta\sigma^{*}_{0}(m)=0$ (82)

by complementary slackness. Similarly we know for every $m\in M_{0}$,
$\sigma^{*}_{1}(m)-\beta\sigma^{*}_{0}(m)>0$. We have

$\displaystyle\sigma^{*}_{0}(m)$
$\displaystyle=\begin{cases}c_{0}f_{0}(m),&m\in M_{0},\\\
c_{0}f_{0}(m)e^{\frac{\beta\rho_{0}(m)}{\lambda}},&m\in M_{*},\\\
c_{0}f_{0}(m),&m\in M_{1}.\end{cases}$ (83) $\displaystyle\sigma^{*}_{1}(m)$
$\displaystyle=\begin{cases}c_{1}f_{1}(m),&m\in M_{0},\\\
c_{1}f_{1}(m)e^{-\frac{\rho_{0}(m)}{\lambda}},&m\in M_{*},\\\
c_{1}f_{1}(m)e^{-\frac{1}{\lambda}}&m\in M_{1},\end{cases}$ (84)

so we get on $M_{*}$,

$\displaystyle{c_{1}}{f_{1}(m)}e^{-\frac{\rho_{0}(m)(1+\beta)}{\lambda}}$
$\displaystyle={c_{0}}{\beta f_{0}(m)}.$ (85)

Since the LHS of (85) depends on $m$ explicitly and the RHS of (85) does not,
the derivative of the LHS of (85) with respect to $m$ must vanish and we can
express $\rho_{0}$ in terms of a constant $\zeta$ as follows:

$\displaystyle\rho_{0}(m)$
$\displaystyle=\frac{\lambda}{1+\beta}\left(\ln\left(\frac{f_{1}(m)}{f_{0}(m)}\right)+\ln\zeta\right),\;m\in
M_{*}$ (86)

Substituting (86) into (85) gives us

$\displaystyle{c_{1}}={\beta}\zeta{c_{0}}.$ (87)

Combining (87), (83) and (84) and (82), we can find the implicit dependence of
$\zeta$ on $\beta$ as indicated in (37), (38). By assumption 38 we know such
$\zeta$ exists. The final result follows from substituting (85) in (83) and
(84). ∎