Author: Yifei Yin

With recent advancement in cryptocurrency, the profit of selling cyber tools and initiating attacks becomes much desirable. And thus led to new pathways for cyber hacking and cybercrime. According to the Center for Strategic and International Studies the estimated annual cost to the world-wide economy from cybercrime is more than $400 billion with a conservative estimate being $375 billion in losses, exceeding the national income of most countries.

In this paper, the authors develop a game theory model consisting of sellers and buyers with sellers competing non-cooperatively in order to maximize their expected profits by determining their optimal product transactions as well as cybersecurity investments.

This paper is on economics of cybersecurity in terms of information asymmetry: not assuming that the sellers are identical nor are they faced with the same cybersecurity investment cost functions. This paper particularly:

1. Develop a rigorous framework that captures competition among sellers in an oligopolistic market of non-identical sellers, who identify optimal product quantities as well as optimal cybersecurity investments;
2. For the first time, model information asymmetry associated with cybersecurity investments between buyers and sellers of a product;
3. This model is not limited to specific functional forms for the seller transaction cost functions and the buyer demand price functions.
4. This framework is computationally tractable and supported by both theoretical qualitative results and an algorithm, which enables the exploration of numerous sensitivity analysis experiments.

Here is the generic seller-buyer model used in this paper.

They construct probabilities from the security levels of the sellers, identify the expected financial damages, in the case of a cyber attack, and reveal the expected profit functions of the sellers. The sellers compete non-cooperatively, each one maximizing his expected profit until a Nash equilibrium is achieved. 

The paper enumerated typical network topologies on this seller-buyer model and calculated the expected profit (calculating equilibrium points) and how number of sellers can affect the profit.

The second figure, for example, could reflect a scenario where Seller 2 has expanded his cyber infrastructure and needs to invest more in appropriate software to protect the network. Seller 2 now has an equilibrium security level that is one quarter of that in Variant 2.3. Interestingly, not only do his expected profits decline but also those of Seller 1 do.

In summary, the computational scheme proposed by this paper has nice features for implementation and results in closed form expressions (both for the product transactions and security levels). This result can be used in security investment analysis to help company make critical decisions.

Reference: A game theory model of cybersecurity investments with information asymmetry https://link.springer.com/article/10.1007/s11066-015-9094-7

Design pattern is one of the important things we learn in computer science. In real-world software architecture – particularly large and complex systems – detecting and understanding design patterns can be a challenge. And it can be crucial to know such information during large scale refactoring or system redesign.

This paper classified existing design pattern detection methods into 8 categories by approaches and 4 categories by properties. They then showed their approach, which consists of 5 steps: preprocess, constructing graphs, constructing subsystem graphs, final matching and analyzing behaviours.

The part that particularly relates to this course is step 2 which is graph operations intensive. After the program gets a UML diagram from step 1. Along with a pre-defined table specifying common design patterns, the algorithm generates nodes and edges and assigns a distinct weight to each edge representing its type. (Algorithm 1, Table 1) The algorithm later also employs a graph enriching process to expose more design patterns.

Finally, to test their model, they applied their technique on three open-source projects: JHotDraw, JRefactory and JUnit. For most design patterns, it achieved precision and recall rates of 100%, outperformed some of the other methods they mentioned for comparison (nrp, Sempatrec, DeMIMA, SSA).

Reference: Design pattern detection based on the graph theory, Bahareh B. Mayvan el., 2017 https://doi.org/10.1016/j.knosys.2017.01.007