Playing Games with Internal Attackers Repeatedly

Insiders might threaten organizations´ systems any time. By interacting with a system, an insider plays games with the security mechanisms employed to protect it. We apply game theory to model these interactions in an extensive form game, that is being played repeatedly with an Intrusion Detection System (IDS). The outcomes of the game are quantified by specifying players´ preferences and by assigning numbers to reflect these preferences. Examining players´ best responses, the solution of the game follows by locating all the Nash Equilibria (NE). We extend the NE notion to the logit Quantal Response Equilibrium (QRE), to capture players´ bounded rationality. The QRE results are more realistic and show that the solution of the game might be significantly different than the corresponding NE solution. Thus, we determine how an insider will interact in the future, and how an IDS will react to protect the system.