Network Security under Heterogeneous Cyber-Risk Profiles and Contagion

TL;DR

The paper tackles optimal cybersecurity allocation on networks under contagious threats with asymmetric attacker/defender valuations. It integrates a static contagion mechanism on graphs with a Stackelberg security game, yielding tractable, topology-informed strategies and a scalable path-based risk measure. A key contribution is an explicit SSE approximation in the low-budget regime, $\mathbf{q}^* \approx \frac{1}{\alpha}\mathbf{s} + \frac{1}{\alpha^2}\mathbf{M}\mathbf{s}$, where $\mathbf{M}$ and $\mathbf{s}$ depend on one- and two-point protection metrics $\mathbf{p}^1$, $\mathbf{p}^2$ and on risk profiles $\bm{z},\bm{\eta}$; this links network structure directly to defense investments. Numerical analyses across tree and random topologies reveal efficient frontiers and illustrate cyber-deception effects, with strategies robust to alternative contagion dynamics (e.g., SI, SIS, threshold). The work offers actionable guidance for designing resilient digital infrastructures by revealing how topology, risk heterogeneity, and strategic behavior shape systemic cyber risk.

Abstract

Cyber risk has become a critical financial threat in today's interconnected digital economy. This paper introduces a cyber-risk management framework for networked digital systems that combines the strategic behavior of players with contagion dynamics within a security game. We address the problem of optimally allocating cybersecurity resources across a network, focusing on the heterogeneous valuations of nodes by attackers and defenders, some areas may be of high interest to the attacker, while others are prioritized by the defender. We explore how this asymmetry drives attack and defense strategies and shapes the system's overall resilience. We extend a method to determine optimal resource allocation based on simple network metrics weighted by the defender's and attacker's risk profiles. We further propose risk measures based on contagion paths and analyze how propagation dynamics influence optimal defense strategies. Numerical experiments explore risk versus cost efficient frontiers varying network topologies and risk profiles, revealing patterns of resource allocation and cyber deception effects. These findings provide actionable insights for designing resilient digital infrastructures and mitigating systemic cyber risk.

Figures (9)

• Figure 1: Representation of the contagion process. Left panel: a realization of the network showing susceptible nodes (orange) and immune nodes (blue) before the attack; Right panel: after the attack all the susceptible nodes connected to the seed become infected (red). Strategically placed immune nodes can block the spread and protect other susceptible nodes from infection.
• Figure 2: Illustration of $1$- and $2$-point protection in a network. The potential contagion between nodes $3$ and $6$ can be prevented by removing (or immunizing) either node $5$ (left panel), so that $a^5_{36} = 1$, or node $1$, resulting in $a^1_{36} = 1$. In contrast, the removal of either node $2$ or node $4$ alone is not sufficient to block the contagion—i.e., $a^2_{36} = a^4_{36} = 0$—but their simultaneous removal (right panel) successfully disrupts the connection, yielding $b^{(2,4)}_{36} = 1$.
• Figure 3: Efficient frontiers for a tree network with 121 nodes, branching ratio $3$, and $4$ levels, are shown for different defender's value profile and attack distribution $\bm{z}$, $\bm{\phi}$ concentrated on specific levels of the tree. Colors distinguish the different levels targeted by the attacker (see inset of the Left Panel). Each panel corresponds to a different defender’s value profile, aiming to protect respectively the root (Left Panel), the first level (Central Panel), and the second level of the tree (Right Panel).
• Figure 4: Efficient frontiers for Erdos-Renyi random networks with different connectivity. The defender's cost is linear and the risk is $\bm{\mathcal{R}}=\bm{\mathcal{R}}^{L=4}$. The value profiles $\bm{z}=\bm{\eta}=\bm{1}$ are uniform.
• Figure 5: Efficient frontiers for an Erdos-Renyi random network, with linear defender's cost and risk $\bm{\mathcal{R}}=\bm{\mathcal{R}}^{L=4}$. The defender's value profile $\bm{z}=\bm{1}$ is uniform while the attacker's value profile changes: $\bm{\eta}\in\{0,1\}^n$, $|\bm{\eta}|:=\sum_i \eta_i$. Left panel: optimal risk for the defender $\mathcal{R}^*(\bm{z})=\sum_i z_i \mathcal{R}^*_i$. Right Panel: optimal risk for the attacker $\mathcal{R}^*(\bm{\eta})=\sum_i \eta_i \mathcal{R}^*_i$

Theorems & Definitions (8)

• definition 1: Infected nodes
• definition 2: Strong Stackelberg equilibrium SSE
• definition 3: $1$-point protection
• definition 4: $2$-points protection
• theorem 1: Asymptotic SSE
• lemma 1
• proof
• proof : Theorem \ref{['thm:approxSSE']}