A game theoretic model of strategic conflict in cyberspace

Abstract

We study cyber conflict as a strictly competitive, two-person game in discrete time, where each player discovers new exploits according to an independent random process. Upon discovery, the player must decide if and when to exercise a munition based on that exploit. The payoff from using the munition is a function of time that is (generally) increasing. These factors create a basic tension: the longer a player waits to exercise a munition, the greater his payoff because the munition is more mature, but also the greater the chance that the opponent will also discover the exploit and nullify the munition. Assuming perfect knowledge and under mild restrictions on the time-dependent payoff function for a munition, we derive optimal exercise strategies and quantify the value of engaging in cyber conflict. Our analysis also leads to high level insights on cyber conflict strategy.