Quasi-purification of mixed game strategies: Sub-optimality of equilibria in security games. Issue 87 (November 2019)

• Record Type: Journal Article
• Authors: Alshawish, Ali; Abid, Mohamed Amine; de Meer, Hermann
• Is Part Of: Computers & security. Issue 87(2019)
• Publication Date: 2019-11
• Subjects: Game theory -- Security resource allocation -- Quasi-purification -- Uncertainty -- Disappointment ratio; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2019.101575
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Security resources, such as security personnel and surveillance devices, are scarce and usually expensive. Suppose that a defender (e.g., a security officer) must choose among several possible resource-allocations, and relies on game-theory for an optimal choice. If the optimum exists only in randomized strategies, then the defender needs to "purify" the resource assignment, hoping to retain the best protection. We experimentally study the validity of this procedure here: we define a set of actions for the defender, against a fixed set of actions for the attacker and compute an optimized defense. Then, we convert this randomized defense strategy into a (consistent) security resource allocation that we add to the defender's action set. If this new defense action is optimal, it should outperform all previous defenses. We find that, unexpectedly, is not always the case! Our contribution is two counterexamples to the following intuition: first, if we optimize a defense using game theory, then adopting the result as (the best) action against the attacker should outperform all other possible defenses. In our (counter-)example setting, this intuition is empirically refuted. The second counterexample exhibits the attribution of this suboptimality to the game-theoretic model as being flawed: the phenomenon is observed in classical games, but not in a distribution-valued game based on the identical setting. This reveals that "optimality" of a defense is not the same as optimizing a security score, since the means by which security is quantified and optimized play a much deeper role than intuitively expected.