Cyber security based on mean field game model of the defender: Attacker strategies

Transcription

1 Research Article Cyber security based on mean field game model of the defender Attacker strategies International Journal of Distributed Sensor Networks 2017, Vol. 13(10) Ó The Author(s) 2017 DOI / journals.sagepub.com/home/ijdsn Li Miao and Shuai Li Abstract The transmission process of information among computers of network is considered as the procedure of interactive behaviors. In this article, we present a mean field game model for the binary interactive behaviors between the malicious attackers and the defenders. We first discuss the evolution of the states of the malicious attackers and the defenders using the susceptiable-infective-removal epidemic model in which we take into account the stochastic process of the propagation of the infected computers and the attack intensity. Then, we formulate the mean field game consistency stability problem generated by a Hamilton Jacobi Bellman equation of the individual player and the fixed-point problem. Finally, we derive the optimal individual strategy with an appropriate assumption that the response time of the defense system is faster than the infection rate. Keywords Cyber security, mean field games, approximation transformation, stable equilibrium, optimal strategy Date received 10 March 2017; accepted 26 September 2017 Handling Editor Kim-Kwang R Choo Introduction Rapid development of the computer technology has influenced all aspects of people s daily life. Individuals usually store and utilize their daily data using online and offline technologies. This sort of stored information becomes the main target of hackers. It has been discussed online that there are many different kinds of cyber-attacks such as malware, denial-of-service (DoS) attacks, hacking the data, bombing, and targeted attack. 1 Therefore, it is required to develop efficient defense strategies to prevent these attacks arising every now and then. Various approaches have been considered to prevent the cyber-attacks, including the firewall, anti-virus program, and intrusion detection system (IDS). 2 6 For instance, Khouzani et al. 4 proposed an optimal control model to discuss the damage maximization problem inflicted by the malware attack, which minimized the overall cost of the security patches. Huang et al. 5 transformed the targeted attacks into random attacks to study the robustness of the interdependent networks. Then, Zargar et al. 6 classified the current distributed denial-of-service (DDoS) flooding attacks and introduced a comprehensive DDoS defense mechanism. Game theory has been introduced for the defense strategy in cyber security problems. 2,7 This method presents a useful mathematical tool for analyzing decision problems for multiple players. The outcome of each player depends on both his decisions and others decisions. In cyber security problems, an effective security model depends on the defense strategies and the actions School of Computer and Communication Engineering, University of Science & Technology Beijing (USTB), Beijing, P.R. China Corresponding author Li Miao, School of Computer and Communication Engineering, University of Science & Technology Beijing (USTB), Beijing 10003, P.R. China @qq.com Creative Commons CC-BY This article is distributed under the terms of the Creative Commons Attribution 4.0 License (http// which permits any use, reproduction and distribution of the work without further permission provided the original work is attributed as specified on the SAGE and Open Access pages (http// openaccess.htm).

2 2 International Journal of Distributed Sensor Networks of the attackers. Bedi et al. modeled the probability actions between the attackers and the defenders as a static game for defending against the DDoS attack. In the study of Dingankar and Brooks, 9 DDoS attacks were modeled as a non-cooperative game in which the defenders tried to form an optimum network topology to prevent the attack, while the attackers tried to deploy the zombies in the network. Integration of the interactive behaviors among the attackers, defenders and users with game theoretic approach is proposed in Ryutov et al. 10 The advantage is that for the first time, users are considered as the independent players, where their incentives and behaviors affect the game process. An optimal defense strategy based on the stochastic game theoretic scheme is reported in Jiang et al. 11 Farhang et al. 12 modeled a Bayesian game to analyze the interactions between a server and its end user, that is, either a legitimate user or an attacker, where the optimal strategy of the defender only depends on the attackers. Despite the efforts of the current researches and the contribution they have made for the security problems, most of the existing researches modeled a security game scheme with only two players. In such a scenario, all attackers are considered as one attacker, as is the whole of defenders. This assumption is not suitable for the real cyber environment with the security problems represented by multiple attackers and multiple defenders. Therefore, we form a mean field game model to discuss the individual optimal strategy in this article, while taking into account the dynamic evolution of each individual player. Mean field games have been created by Lasry and Lions 13 and Huang et al. 14 as a method to model the games with large players. The systems are coupled through Hamilton Jacobi Bellman (HJB) and Kolmogorov equations, in which the HJB equation describes the behavior of the individual strategy, while the Kolmogorov equation discusses the evolution of the individual optimal strategy. Mean field game is also applied by economics, 15 engineering in different areas, 16 communication networks, 17,1 and other fields. 19,20 A mean field game model for cyber security is proposed in Wang et al. 21 and Kolokoltsov and Malafeyev. 22 The work of Wang et al. 21 considered an attacker and multiple defenders in mobile ad hoc networks. The legitimate nodes of such a model may select actions intelligently to decrease their energy consumption and security loss. Kolokoltsov and Malafeyev 22 proposed a basic mean field game consistency problem to discuss the botnet defense problem, while they did not consider the individual strategy. Inspired by Kolokoltsov and Malafeyev 22 and Gomes et al., 23,24 we introduce a simple mean field game model for the cyber security problems. Different from the current works, the proposed model is a solvable mean field game model for infinite computers. The contributions of this article are as follows we first study the binary interactive behaviors of the states of the attackers and defenders using the susceptible infectious removed (SIR) epidemic model, in which we take into account the stochastic process of the propagation of the infected users and attack intensity. Then, existence of the solutions of this model will be investigated. Next, we formulate the mean field game consistency stability problem generated by a HJB equation of the individual player and the fixed-point problem. Finally, the existence and stability of the solutions of the mean field game model and the optimal individual strategy will be considered. The proposed model evaluates non-uniqueness of the solutions that is investigated in the mean field game theory. Moreover, the proposed model may help understand the link between the dynamic and stationary mean field games models. The article is organized as follows. We present the dynamic evolution of the states of the nodes with SIR epidemic model and elaboration of the mean field game consistency stability problem in section System model. Then, section Analysis of the solutions of HJB equation analyzes existence of the optimal individual defense strategy of the HJB equation. Next, section Stability of the solutions provides the stability of the solutions of the optimal individual defense strategy. Finally, section Conclusion concludes the article. System model We presume that any computer in the network may operate in three states, that is, infective (I), susceptible (S), and recovery (R). The infective node shows the infected computer by the malicious attacks and a susceptible node is prone to be, but not infected. The node R represents the recovery which is immune to any malicious attacks, and we assume that the nodes have the defensive systems. In this framework, we presume both computers and their interactive behaviors among them satisfy the stochastic distribution and depend on the attack intensity a, and the changes in the states between I (S) andr depend on the decisions of computers. We consider n I (t), n S (t), and n R (t) as the numbers of the nodes of different states, at time t, where the total numbers of the nodes in the network are represented by N, and n(t)=½n I (t), n S (t), n R (t)š is a non-negative integer. Then, N = n I (t)+n S (t)+n R (t). We define x(t)=n(t)=n as the standardized state of n(t), where x(t)=½x I (t), x S (t), x R (t)š and x I (t)+x S (t)+x R (t)=1. Considering all participants have the same strategy w =(w I, w S ) and the values are defined as 0 and 1, where each node likes to switch I to S.

3 Miao and Li 3 Figure 1. The transitions between different states. We assume ar S represents the infection rate of the susceptible nodes under the direct attacks in which r S is a constant. Besides, infective nodes will infect the susceptible nodes by transmitting the malware, while susceptible nodes will transmit the defensive systems to infective nodes to cure them. Hence, we consider k I =N and k S =N as the interaction probabilities between the infected and susceptible nodes, where k I and k S denote the number of the interactions of the nodes. The recovery probabilities of the infected and susceptible nodes are denoted by b IR and b SR, respectively, and b exhibits the probability of the immune nodes transformed to the susceptible nodes. The specific transitions between different states are discussed in Figure 1. The set of differential equations of the system, showing the evolution of the state of the infinite players, reads < _x I (t)=x S (t)ear S + x I (t)x S (t)k I + eðx S (t)w S (t) x I (t)w I (t) Þ x I (t) ðb IR + k S x S (t) Þ _x S (t)= x S (t)ear S x I (t)x S (t)k I eðx S (t)w S (t) x I (t)w I (t) Þ x S (t)b SR + x R (t)b _x R (t)=x S (t)b SR + x I (t) ðb IR + k S x S (t) Þ x R (t)b F N fðn(t) Þ = n S (t)aer S ½fðn I (t)+1, n S (t) 1, n R (t) Þ fðn(t) + n S (t)b SR ½fðn I (t), n S (t) 1, n R (t)+1þ fðn(t) + en S (t)w S (t) ½fðn I (t)+1, n S (t) 1, n R (t) Þ fðn(t) + en I (t)w I (t) ½fðn I (t) 1, n S (t)+1, n R (t) Þ fðn(t) + k I n I (t)n S (t) ½fðn I (t)+1, n S (t) 1, n R (t) Þ fðn(t) =N + k S n I (t)n S (t) ½fðn I (t) 1, n S (t)1, n R (t)+1þ fðn(t) =N + n I (t)b IR ½fðn I (t) 1, n S (t), n R (t)+1þ fðn(t) + n R (t)b½fðn I (t), n S (t)+1, n R (t) 1Þ fðn(t) ð1þ ð2þ where f =(f ni, f ns, f nr ). For the standardized state x(t), there exists a set of normal basis fe i 2 R 3 ji = 1, 2, 3g,so that equation (2) may be expressed as a vector function as L N fðx(t) Þ = x S (t)aer S N½fðx(t)+e I (t)=n e S (t)=n + x S (t)b SR N½fðx(t) e S (t)=n + e R (t)=n + x I (t)x S (t)k I N½fðx(t) e S (t)=n + e I (t)=n + x R (t) ½fðx(t)+e S (t)=n e R (t)=n + ex S (t)w S (t)n½fðx(t) e S (t)=n + e I (t)=n + ex I (t)w I (t)n½fðx(t) e I (t)=n + e R (t)=n + x I (t) ðb IR + k S x S (t) ÞN½fðx(t) e I (t)=n + e R (t)=n ð3þ where a is the attack intensity and e represents the reaction rates of the defense systems, so that for limit e!, the system may react immediately. w I and w S are the active strategy and the passive strategy of the nodes, respectively, where their values are defined as 0 and 1. x S (t)ear S denotes the evolution of the susceptible nodes under the directed attacks, x I (t)x S (t)k I means that the susceptible nodes are infected by the infected nodes with the number k I, while x I (t)x S (t)k S shows the infected nodes are recovered by the susceptible nodes with the number k S, x S (t)w S (t) x I (t)w I (t) indicates that the dynamic evolution of the nodes under the reaction rate of the defense systems, and x I (t)b IR denotes that the infected nodes are immune to the malicious attacks. It can be shown that for the states of the susceptible nodes transformed into the infected or immune nodes, it reads n S 1, n I + 1, orn R Equation (1) discussed the evolution of the states with infinite nodes, and the finite state space of the nodes i 2 N can be written as fn(t)=½n I (t), n S (t), n R (t)šjn I (t)+n S (t)+ n R (t) = N, n i.0, i = I, S or Rg, so we get the evolution of the finite state space of the nodes Next, we will introduce the convergence conditions of the differential equation (3) in the limit N!. Proposition 2.1. If f 2 C 1, then lim L N f (x)=lf (x), where Lf (x) = x S (t)aer S ð f (x)= x I f (x)= x S Þ + x S (t)b SR ð f (x)= x R f (x)= x S Þ + x I (t)x S (t)k I ð f (x)= x I f (x)= x S Þ + x I (t) ðb IR + k S x S (t) Þð f (x)= x R f (x)= x I Þ + ex S (t)w S (t) ð f (x)= x I f (x)= x S Þ + ex I (t)w I (t) ð f (x)= x S f (x)= x I Þ ð4þ represents a first-order partial differential equation. The proof is discussed in Appendix 1. Under the finite state framework, we have proved equation (3) converges to equation (4). The solutions of equation (1) discuss the limit of equation (3), and for a general environment, the differential equation (3) weakly converges to the solution of equation (1) if N!. 25

4 4 International Journal of Distributed Sensor Networks Moreover, we can analyze the evolution of each individual behavior of participants using the Markov model. We define w ind =(w ind, I, w ind, S ) 2f0, 1g as the individual strategy; then, the dynamic evolution of the individual participant with three states can be discussed as < L ind h I = ew ind, I (h S h I )+(b IR + k S x S )(h R h I ) L ind h S = ew ind, S (h I h S )+(x I k I + ar S )(h I h S )+b SR (h R h S ) L ind h R = b(h S h R ) ð5þ where h S, h I, and h R denote the individual average cost of the nodes. We presume that the profit function of the attacker, g(x), depends on the states distribution of the nodes and the payment per unit time of the network attacker, In contrast, for determined a and x(t), the players will derive the optimal individual strategy w ind by solving equations (5) and (7). Hence, we form a mean field game consistency equation to analyze the optimal individual strategy of the nodes at game time ½0, TŠ, that is w ind = w ðþ where w ind =(w ind, I, w ind, S, w ind, R ) 2f0, 1g and w =(w I, w S, w R ) 2f0, 1g. In general, this mean field game problem is discussed Ð 1 T by studying the average payment h = lim T! T 0 f(t)dt, in which the form of the solutions to the HJB equation satisfies u(t t)+h. Hence, HJB equation (5) can be written as follows >< max ew I(h S h I )+(b IR + k S x S )(h R h I ) (b IR + k S x S )a I + l I = u w max (ew S + ar S + x I k I )(h I h S )+b SR (h R h S )+l S = u > w b(h S h R )+l R = u ð9þ au. Attackers will maximize their profits during the game time, and therefore, the profit function at time t 2½0, TŠ is G(T)= ð T 0 ðgx(t) ð Þ auþdt ð6þ We define l S as the payoff per unit time of the susceptible nodes, l I as the payoff per unit time of the < where u is the optimal average payment function. If we derive the stable solutions (x(t), w(t)) from equations (1) and (9), the optimal individual strategy will be formed in equation (9), in which w(t)=(w I (t), w S (t)) are the maximization values of equation (9) and x(t)=(x I (t), x S (t), x R (t)) are the stable solutions of equation (1). The individual optimal strategy depends on the stable solutions x(t) which satisfy the following equation x S (t)ar S + x I (t)x S (t)k I + eðx S (t)w S (t) x I (t)w I (t) Þ x I (t) ðb IR + k S x S (t) Þ= 0 x S (t)ear S x I (t)x S (t)k I eðx S (t)w S (t) x I (t)w I (t) Þ x S (t)b SR + x R (t)b = 0 x S (t)b SR + x I (t) ðb IR + k S x S (t) Þ x R (t)b = 0 ð10þ infected nodes, and l R as the payment per unit time of the immune nodes. a I denotes the loss per unit time of the infected nodes. The nodes will minimize their cost functions, and hence, the total payoff functions can be expressed as f i (T)= ð T 0 l i 1 i dt + a I u ½0, TŠ ð7þ where i = I, S, R, 1 S, 1 I, 1 R denote the indicator functions of the states, and u ½0, TŠ is the number of times of the nodes from I to R during the period. We will get the solutions of the dynamic equation (1) and the payment function (5) if we achieve the optimal attack intensity a and the optimal trajectory x(t). Analysis of the solutions of HJB equation In this section, we elaborate the solutions of the mean field consistency problem () with h S h I and h I h S, respectively. If h S h I, the infected node will choose its active defense behavior to reduce its payoff and the susceptible node may not change its state. If h I h S, the passive defense behavior will be optimal. We discuss the existence of the individual optimal solutions of HJB equation in equation (9) with few assumptions, that is, e.0, a.0, r S.0, k I.0, k S.0, b, b IR, and b SR.0. If h S h I, we consider w S = 0 and w I = 1. Then, the optimal individual strategy is the active defense behavior. Equation (9) can be written as

5 Miao and Li 5 < e(h S h I )+(b IR + k S x S )(h R h I ) (b IR + k S x S )a I + l I = u (ar S + x I k I )(h I h S )+b SR (h R h S )+l S = u b(h S h R )+l R = u ð11þ To simplify, we consider h R = 0 because the solution, h, of equation (7) may be expressed as the addictive constant. We achieve u = bh S. Then, equation (11) reduces to e(h S h I ) h I (b IR + k S x S ) (b IR + k S x S )a I + l I bh S = 0 (ar S + x I k I )(h I h S ) b SR h S + l S bh S = 0 yielding h I = h S = ð12þ (e b)l S ½a I (b IR + x S k S ) l I Š(x I k I + ar S + b SR + b) (e + b IR + x S k S )(b + b SR + ar S + x I k I ) (e b)(e + ar S ) ð13þ l S(e + b IR + x S k S ) ½a I (b IR + x S k S ) l S Š(x I k I + ar S ) (e + b IR + x S k S )(b + b SR + ar S + x I k I ) (e b)(e + ar S ) ð14þ For h S h I, combining equations (14) and (15), we achieve x S 1 (b + b SR )(l I a I b IR ) l S (b + b IR ) ð15þ k S l S + a I (b + b SR ) Let x=((b+b SR )(l I a I b IR ) l S (b+b IR ))=k S (l S + a I (b+b SR )) and this assumption is only valid for x.1 because of x S 2 (0,1). Next, we elaborate the existence of the optimal solutions from equation (10). If h S h I, equation (10) yields x S (t)ear S + x I (t)x S (t)k I ex I (t) x I (t) ðb IR + k S x S (t) Þ= 0 x S (t)ear S x I (t)x S (t)k I + ex I (t) x S (t)b SR + x R (t)b = 0 ð16þ where x R = 1 x I x S. The first equation of equation (16) gives x I (t)= x S(t)e(ar S + 1) b IR + x S (t)(k S k I ) ð17þ and then, inserting equation (17) into the second equation of equation (16) results in a quadratic equation in terms of x S (t) as R 1 (x S )=x 2 S ½ (k S k I )(ear S + b SR + b)+k I (ear S + e) Š + x S ½b IR (ear S + b SR + b) (ear S + e)(e b) b(k S k I )Š bb IR ð1þ Since x S (t) 2 (0, 1) yields R 1 (0)\0 and R 1 (0).0 on intervals ½0, 1Š, therefore there exists x S 2 (0, 1) so that R 1 (x S )=0 holds. Thus, x S is the optimal solution that satisfies equation (15) if and only if x.1. Hence, we derive the following proposition. Proposition 3.1. If h S h I and x.1, there exists a unique solution x =(x I, x S, x R ) for the mean field game consistency problem in equations (9) and (10), where x I (t)=(x S (t)(ear S + e))=(b IR + x S (t)(k S k I )) and x S 2 (0, 1) are the unique solutions of equation R 1 (x S )=0. In this framework, we get the optimal individual strategy of the active defense behavior. For h I h S, we consider w I = 0 and w S = 1, so that the optimal individual strategy is the passive defense behavior. Then, equation (9) simplifies to < (b IR + k S x S )(h R h I ) (b IR + k S x S )a I + l I = u (e + ar S + x I k I )(h I h S )+b SR (h R h S )+l S = u b(h S h R )+l R = u ð19þ For h R = 0, we achieve u = bh S. Then, equation (19) reduces to (b IR + k S x S )h I (b IR + k S x S )a I + l I bh S = 0 (e + ar S + x I k I )h I (e + ar S + x I k I )h S b SR h S + l S = 0 yielding ð20þ lim h I = x! bl S ½a I (b IR + x S k S ) l I Š(e + x I k I + ar S + b SR + b) b(e + x I k I + ar S )+(b IR + x S k S )(e + x I k I + ar S + b SR ) h S = ð21þ l S (b IR + x S k S ) (e + x I k I + ar S ) ½a I (b IR + x S k S ) l I Š b(e + x I k I + ar S )+(b IR + x S k S )(e + x I k I + ar S + b SR ) ð22þ Similarly, for h I h S, combining equations (21) and (22), we have x S 1 (b + b SR )(l I a I b IR ) l S (b + b IR ) = x k S l S + a I (b + b SR ) ð23þ If h I h S, equation (10) simplifies to < x S (t)ear S + x I (t)x S (t)k I + ex S (t) x I (t) ðb IR + k S x S (t) Þ= 0 x S (t)ear S x I (t)x S (t)k I ex S (t) x S (t)b SR + x R (t)b = 0 x S (t)b SR + x I (t) ðb IR + k S x S (t) Þ x R (t)b = 0 ð24þ It may be shown that x R = 1 x I x S, and then, the sum of the first two equations in equation (24) yields the third equation. Therefore, equation (24) reduces to

6 6 International Journal of Distributed Sensor Networks x S (t)ear S + x I (t)x S (t)k I + ex S (t) x I (t) ðb IR + k S x S (t) Þ= 0 x S (t)ear S x I (t)x S (t)k I ex S (t) x S (t)b SR + ð1 x I (t) x S (t) Þb = 0 ð25þ The first equation in equation (17) gives x I (t)= x S(t)(ear S + e) b IR + x S (t)(k S k I ) ð26þ and then inserting equation (26) into the second equation of equation (25) leads to the quadratic equation in terms of x S (t) as R 2 (x S )=x 2 S ½ (k S k I )(ear S + e + b SR + b) + k I (ear S + e)š + x S ½b IR (ear S + e + b SR + b) + b(ear S + e k S + k I )Š bb IR ð27þ Stability of the solutions In this section, we analyze the stability of the solutions. The solutions are stable if and only if all eigenvalues of the characteristic equations generated by them present negative real parts. Therefore, we perform a linear approximation for the system of equation (1) with the optimal solutions x and fx S = 1, x I = 0, x R = 0g, respectively. For h S h I and x R = 1 x I x S, equation (1) can be written as _x I (t)=x S (t)ear S + x I (t)x S (t)k I ex I (t) x I (t) ðb IR + k S x S (t) Þ _x S (t)= x S (t)ear S x I (t)x S (t)k I + ex I (t) x S (t)b SR + ð1 x I (t) x S (t) Þb ð2þ In order to analyze the stability of the fixed solution x S, we consider y = x I x I and z = x S x S, and the system of equations in equation (2) reads _y = yx S (k I k S ) b IR e + z ears + x I (k I k S ) +(ki k S )yz _z = y( x S k I + e b)+z x I k ð29þ I (ear S + b + b SR ) ki yz Since x S (t) 2 (0, 1) yields R 2 (0)\0 and R 2 (1).0 on intervals ½0, 1Š, therefore there exists x S 2 (0, 1) so that R 2 (x S )=0 holds. We derive the following proposition. The problem of the eigenvalues presents negative real parts which are equivalent to the negative trace of the characteristic equation and the positive determinant of the characteristic equation. Therefore, we need to discuss the following inequality holds x S (k I k S ) b IR e x I k I ear S b b SR \0 x S (k I k S ) (b IR + e) x I k I (ear S + b + b SR ) ears + x I (k I k S ) ( x S k I + e b).0 ð30þ Proposition 3.2. If h I h S, there exists several solutions for the mean field game consistency stability problem in equations (9) and (10), that is, if x\1, thenx S = 1, x R = 0, and x I = 0 are always the solution. Moreover, if 0\x\1 and R 2 (x) 0, then there exists x S 2 (0, xš so that R 2 (x S )=0 and x I (t) generated by equation (26). In this framework, we obtain the optimal individual strategy of the passive defense behavior. Inserting equation (27) into equation (31) yields >< (x S )2 (k I k S ) 2 + x S ½ (k I k S )(2b IR + ear S + b + b SR + e) k I (v) Š b IR (ear S + b + b SR + b IR + e)\0 (x S )2 (k I k S )(ear ½ S + b + b SR )(k I k S ) k I ear S Š ear S (e b)b IR > + x S ½ (k I k S )e(ear S + b + b SR )+k I ð(ear S + e)(b IR + e)+ear S b IR + b IR (b IR + e)(ear S + b + b SR ).0 ð31þ For k I k S 0, we see that equation (26) always holds for any positive x S 2 (0, 1), and the eigenvalues of the characteristic equations present negative real parts. Hence, the solution x S is stable. For h I h S and x R = 1 x I x S, equation (1) can be written as

7 Miao and Li 7 _x I (t)=x S (t)ear S + x I (t)x S (t)k I + ex S (t) x I (t) ðb IR + k S x S (t) Þ _x S (t)= x S (t)ear S x I (t)x S (t)k I ex S (t) x S (t)b SR + ð1 x I (t) x S (t) Þb ð32þ We first analyze the stability of the solutions x I = 1 and x S = 0; considering x I and z = 1 x S, the system of equations in equation (32) reduces to _x I = x I (k I k S b IR ) z(ear S + e)+x I z(k S k I ) _z = x I (k I + b) z(ear S + e + b + b SR ) x I zk I ð33þ The trace and the determinant of the characteristic equation read (k I k S b IR ) (ear S + e + b + b SR )\0 (k I k S b IR )(ear S + e + b + b SR ) (ear S + e)(k I + b)\0 ð34þ problem. In our model, we took into account both stochastic process of the propagation of the infected players and attack intensity. Existence and stability of solutions of the mean field game model were elaborated in two scenarios, that is, h S h I and h I h S, assuming that players are distributed with the three states, and we derived the optimal individual strategy of the active defense behavior and the passive defense behavior, respectively. Acknowledgements The authors gratefully acknowledge the anonymous reviewers who read drafts and made many helpful suggestions. Hence, the solutions x I = 0 and x S = 1 are stable because inequality (34) is always established. Next, we analyze the stability of the solution x S ; considering y = x I x I and z = x S x S, the system of equations in equation (33) reduces to _y = yx S (k I k S ) b IR + z ears + e + x I (k I k S ) + yz(ki k S ) _z = y( x S k I b)+z x I k I (ear S + e + b + b IR ) yzki ð35þ Similarly, the trace and the determinant of the characteristic equation read Declaration of conflicting interests The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article. Funding The author(s) disclosed receipt of the following financial support for the research, authorship, and/or publication of this article This work was supported by the National Natural Science Foundation of China under grant no x S (k I k S ) b IR x I k I (ear S + e + b + b IR )\0 x S (k I k S ) b IR x I k I (ear S + e + b + b IR ) +(x S k I + b) ear S + e + x I (k I k S ).0 ð36þ >< > Inserting equation (26) into equation (36) yields (x S )2 (k I k S ) 2 + x S ½ (k I k S )(3b IR + ear S + e + b)+k I (ear S + e) Š b IR (ear S + e + b + 2b IR )\0 (x S )2 (k I k S )(ear ½ S + e + b + b IR )(k I k S ) (ear S + e) Š + x S½ b IR(ear S + e) 2b IR (ear S + e + b + b IR )(k I k S )+k I b IR (ear S + e) Š+ bb IR (ear S + e).0 ð37þ For k I k S 0, it is seen that equation (26) always holds for any positive x S 2 (0, 1), where the eigenvalues of the characteristic equations have negative real parts. Hence, the solution x =(x I, x S, x R ) is stable if k I k S. Conclusion In this article, a simple security mean field game model for the binary interactive behaviors between the malicious attackers and the defenders was investigated in cyber security. We formed the optimal individual defense strategy. The evolution of the states of the malicious attackers and the defenders was modeled using the SIR epidemic model, and the mean field game consistency stability problem was generated by an HJB equation of the individual player and the stable point References 1. Chowdhury A. Recent cyber security attacks and their mitigation approaches an overview. In International conference on applications and techniques in information security, Cairns, QLD, Australia, 26 2 October 2016, pp New York Springer. 2. Liang X and Xiao Y. Game theory for network security. IEEE Commun Surv Tut 2013; 15(1) Zhang HG, Han WB, Lai XJ, et al. Survey on cyberspace security. Sci China Inform Sci 2015; 5(11) Khouzani MHR, Sarkar S and Altman E. Maximum damage malware attack in mobile wireless networks. IEEE ACM T Network 2012; 20(5) Huang X, Gao J, Buldyrev SV, et al. Robustness of interdependent networks under targeted attack. Physical Review E 2011; 3(6)

8 International Journal of Distributed Sensor Networks 6. Zargar ST, Joshi J and Tipper D. A survey of defense mechanisms against distributed denial of service (DDoS) flooding attacks. IEEE Commun Surv Tut 2013; 15(4) Alpcan T and Basxar T. Network security a decision and game-theoretic approach. Cambridge Cambridge University Press, Bedi H, Shiva S and Roy S. A game inspired defense mechanism against distributed denial of service attacks. Secur Commun Netw 2014; 7(12) Dingankar C and Brooks RR. Denial of service games. In Third annual cyber security and information infrastructure research workshop, Oak Ridge, TN, May 2007, pp Ryutov T, Orosz M, Blythe J, et al. A game theoretic framework for modeling adversarial cyber security game among attackers, defenders, and users. In International workshop on security and trust management, Vienna, 21 September 2015, pp New York Springer. 11. Jiang W, Tian Z, Zhang H, et al. A stochastic game theoretic approach to attack prediction and optimal active defense strategy decision. In 200 IEEE international conference on networking, sensing and control, Sanya, China, 6 April 200, pp New York IEEE. 12. Farhang S, Manshaei MH, Esfahani MN, et al. A dynamic Bayesian security game framework for strategic defense mechanism design. In International conference on decision and game theory for security, Los Angeles, CA, 6 7 November 2014, pp New York Springer. 13. Jeanmichel Lasry PL and Lions PL. Jeux a` champ moyen. I - Le cas stationnaire[j]. Comptes rendus - Mathe matique 2006; 343(9) Huang M, Malhame RP and Caines PE. Large population stochastic dynamic games closed-loop McKean-Vlasov systems and the Nash certainty equivalence principle. Commun Inf Syst 2006; Guéant O. Mean field games and applications to economics. PhD Thesis, Université Paris-Dauphine, Paris, Djehiche B, Tcheukam A and Tembine H. Mean-fieldtype games in engineering. arxiv , September Mériaux F, Varma V and Lasaulce S. Mean field energy games in wireless networks conference record of the forty sixth asilomar conference on signals, systems and computers, Pacific Grove, CA, 4 7 November 2012, pp New York IEEE. 1. Tembine H, Vilanova P and Debbah M. Noisy mean field stochastic games with network applications. Report, Ecole superieure d electricite, Paris, December Bauso D, Tembine H and Basxar T. Opinion dynamics in social networks through mean-field games. SIAM J Control Optim 2016; 54(6) Guéant O, Lasry JM and Lions PL. Mean field games and applications. In Cousin A, Cre pey S, Guéant O, et al. (eds) Paris-Princeton lectures on mathematical finance Berlin, Heidelberg Springer-Verlag, 2011, pp Wang Y, Yu FR, Tang H, et al. A mean field game theoretic approach for security enhancements in mobile ad hoc networks. IEEE T Wirel Commun 2014; 13(3) Kolokoltsov VN and Malafeyev OA. Corruption and botnet defense a mean field game approach. arxiv , July Gomes DA, Mohr J and Souza RR. Discrete time, finite state space mean field games. J Math Pure Appl 2010; 93(3) Gomes DA, Mohr J and Souza RR. Continuous time finite state mean field games. Appl Math Opt 2013; 6(1) Kolokoltsov VN. Nonlinear Markov games on a finite state space (mean-field and binary interactions). Int J Stat Probab 2012; 1(1) Appendix 1 Proof of Proposition 3.1. Since equation (3) represents a symmetric structure, we only need to elaborate the first term on the right side of equation (3), that is, lim x Saer S N ½fðx+ e I = N e S =NÞ f (x)š = x S aer S ( f (x)= x I f (x)= x S ). It is well known that f is the first-order differentiable function if f 2 C 1 and N½f (x + e I =N e S =N) f (x)š = f (n I + 1, n S 1, n R ) f (n). We may represent the limit in terms of the Taylor expansion, as lim N ½ f(x + e I=N e S =N) f (x) Š = lim N½ f(x + e I =N e S =N) f (x e S =N) + f (x e S =N) f (x)š = f (x)= x I f (x)= x S Then, equation (3) reduces to lim x x + e I Saer S N f N e S f (x) N f (x) f (x) = x S aer S x I x S Similarly, the other terms in equation (3) can be proved. Hence, lim L N f (x)=lf (x) is established.