Information Security Decisions with Consideration of Hacker Intrusion Propagation

Zhao, Liurong; Zhou, Xinyu; Li, Jiao

doi:https://doi.org/10.1155/2022/3183121

Mathematical Problems in Engineering

On this page

Abstract Introduction Conclusion Data Availability Conflicts of Interest Acknowledgments References Copyright Related Articles

Research Article | Open Access

Volume 2022 | Article ID 3183121 | https://doi.org/10.1155/2022/3183121

Information Security Decisions with Consideration of Hacker Intrusion Propagation

Liurong Zhao,^1,2Xinyu Zhou,²and Jiao Li²

Academic Editor: Junhai Ma

Received07 Jan 2022

Revised03 Jun 2022

Accepted24 Jun 2022

Published31 Aug 2022

Abstract

The spread of network attacks is extremely harmful, which poses a great threat to the assets and reputation of firms. Therefore, making a scientific information security strategy is an important task for the continued and stable development of the firms. This paper develops the SIR model of hacker intrusion propagation and then analyzes the evolution trend of hacker intrusion propagation and the conditions of strategy transfer. The research shows that when immune failure and strategy transfer are not considered, the threshold of hacker intrusion propagation is negatively correlated with the probability of invasion, whereas it is positively correlated with the probability of defense success and the externality during outsourcing. In the case of immune failure, there will always be infected firms in the network, where the threshold of hacker intrusion propagation is affected by the proportion of the infected state and the probability of immune failure. When immune failure and strategy transfer occur simultaneously if the externality is positive and high, information security outsourcing can improve firms’ security benefits; if the externality is negative, the firms should stop cooperating with the managed security service provider (MSSP).

1. Introduction

With the rapid development of economic globalization, collaboration between firms has become usual. However, cooperation improves the efficiency, it also brings potential risks to firms’ information security. The interdependence among different information systems is exploited by hackers to attack affiliated firms. For example, software of the firms’ information systems increasingly relies on the development tools or software modules of the third-party development platform. Once there are security vulnerabilities in these tools or modules (especially open-source software), hackers will successfully invade the third-party development platform and then attack the firms’ information system. Positive Technologies reported that hackers penetrated one firm’s network and used it as a gangplank that pointed to penetrate the other firms’ information systems [1]. To address the complex network security problems, firms usually enhance their security through two measures, i.e., autonomous defense and outsourcing information security services [2]. Compared with autonomous defense, although outsourcing information security services have certain advantages in more professional technology and lower management cost, the firms’ information systems security will rely on MSSP's security protection system. Once the information systems of MSSP or firms are invaded, hackers will attack the affiliated organizations based on this interdependence, which will lead to security externalities [3]. For example, if MSSP prevents hackers from invading one customer firm, it has the successful preventing experience for such attacks so as to better serve other firms that purchase its outsourced services, which is a positive security externality from outsourcing information security strategy. Therefore, some firms are more willing to shift from autonomous defense to outsourcing strategy. However, if hackers successfully invade the firms or MSSP, the interdependence among different information systems will increase the security risk of affiliated organizations, which is a negative security externality from outsourcing information security strategy; thus, some firms may give up the corporations with MSSP.

Nowadays, studies on hacker intrusion behavior and firms’ information security strategies have recently become a research hotspot in complex network environments.

Hackers’ intrusion behavior includes embedding computer viruses [4], disseminating malware distribution [5], and launching DDOS attacks [6]. The influences of hacker intrusion on firms’ information sharing decision from the perspective of economics are studied recently. Gao and Zhong [7] explored the effect of attack level, firms’ information sharing and security technology investment on profits, and customer needs under hackers' targeted attacks. Hausken [8] showed that the attack level is irrelevant with the efficiency of information sharing, but hackers’ information sharing level decreases with the increase of firm’s security investment [9]. On the basis, he also concluded that hackers improve their attack level by sharing vulnerability information of the firms’ information systems. In addition, there are some studies concentrated on the hackers’ intrusion behavior based on cellular automata. For example, Gagliardi and Alves [10] studied the influence of the small world on the effect of hacking behavior by structuring the CA model. The propagation behavior of network malware was studied based on the CA model as well [11, 12]. However, the CA model cannot reflect the average trend of hacker intrusion propagation and cannot make general predictions [13]. To sum up, the current research mainly focuses on analyzing hacker intrusion behavior by game model and CA model but lacks the mechanism of hacker intrusion diffusion. SIR model is a classical model to describe the mechanism of information diffusion. It can not only study the dynamics diffusion process but also position the key nodes and analyze the threshold of virus propagation [14–17]. The diffusion characteristics of computer network viruses are similar to those of biological viruses, which are latent, infectious, and destructive; thus, the evolution of virus infection among network nodes can be considered, and the SIR model is used to analyze the computer virus diffusion [18–22]. SIR model is introduced to study the mechanism of hacker intrusion diffusion, which has certain innovative significance.

Prior research on the information security strategy largely focuses on information security investment behavior, technology configuration, and security service outsourcing. For example, Qian et al. [23] developed an information security investment game model of affiliated firms considering the different probabilities of hacker intrusion. He also examined the optimal information security investment strategy based on security insurance [24]. Research in many domains has addressed information security technology configuration, such as IDS, firewall, and honeypot. For example, in economics, Smirnova and Smirnova [25] proposed the optimal configuration of intrusion detection systems when firms chose the strategy of autonomous defense and showed that the impact of IDS quality, cost structure, and strategic behavior of hackers are the main factors in the defense effect. Since security outsourcing is an emerging strategy in the field of information security management, there are few researches on this topic at present. Wu et al. [26]. discussed the impact of positive and negative externalities on the information security effect and proposed an information security outsourcing contract. Some scholars concentrated on the incentive mechanism of security outsourcing and the risk of information disclosure, and discussed the security game between hackers, MSSP, and firms [27, 28]. The existing research on information security decision-making mainly focuses on the decision-making of information security within the firm and rarely considers the evolution of information security strategy between affiliated organizations due to the externality of information security outsourcing caused by interdependence. In fact, with the dynamic changes of hacker intrusion diffusion and security externality, the evolution of firms’ security status leads to adjust their security strategies. SIR model can effectively analyze the decision interaction of agents in network systems. Therefore, considering the conditions of hacker intrusion diffusion and security externalities, we develop an extended SIR model to analyze the evolution trend of hacker intrusion diffusion and the conditions of choosing strategy transfer, which is another innovation of this paper. Based on our results, it has theoretical supplementary value to the economics of information security.

This study is presented as follows. Section 2 explains the assumptions of the SIR model and introduces hacker intrusion propagation. Section 3 studies three information security strategies: without considering immune failure and strategy transfer, only considering immune failure, and considering both immune failure and strategy transfer. Section 4 presents numerical simulations to extend the conclusions. Managerial implications are discussed in Section 5.

2. The Model

2.1. Description of the Model

Based on the SIR model, network security includes susceptible state , infected state , and recovered state , in which indicates that firms have not been invaded but are at risk of being invaded, indicates that firms have been invaded, and indicates that firms have successfully defended against cyberattacks or recovered from attacks to a safe state. Firms choose one of two information security strategies, autonomous defense or outsourcing, to prevent the attacks. , , and denote the firms’ susceptible state, infected state, and recovered state, respectively, when they implement autonomous defense; , , and denote the firms’ susceptible state, infected state, and recovered state, respectively, when they choose information security outsourcing.

Suppose that there are N nodes in the network, and each node represents a firm. If firms choose the strategy of autonomous defense, the probability of invasion is , where the firms’ security state changes from to after successful invasion. In this case, the probability of resisting invasion is , where the firms’ security state changes from to after successful defense. After firms have been invaded, the probability of information systems recovery is , where the firms’ security state changes from to . After firms successfully defend against intrusion or recover their information systems, hackers can still target them and continue to attack. In this situation, the probability of re-invasion is , where the firms’ security state changes from to . We define “firms’ immune failure” as the security state change from “immune” to “infection.” Likewise, if firms choose the strategy of information security outsourcing, there are similar explanations for parameters such as , , and and changes of security states. Furthermore, the security externality is a phenomenon coming from the interdependence between information systems. To be specific, positive externality or negative externality , respectively, has a positive or negative effect on information security levels. When the strategy of information security outsourcing is implemented, the probability of invasion under the condition of externality is , where firms’ security state changes from to . Similarly, the probability of state transfer from to is , the probability of state transfer from to is , and the probability of state transfer from to is . It is worth noting that the service ability of MSSP determines the quality of firms’ security products which affect the probability of invasion , the probability of information systems recovery , the probability of re-invasion , and the security externality . After firms are invaded, they are dissatisfied with the existing security strategy and may change their information security strategy. We call this process of strategy change “strategy transfer.” is the proportion of firms transferring from autonomous defense to outsourcing strategy after hackers invade; is the proportion of firms transferring from the strategy of outsourcing to autonomous defense. Based on the above, Figure 1 shows the state evolution of process firms after hacker intrusion.

2.2. SIR Model of Hacker Intrusion Propagation

According to the model assumptions and the rules of state transfer, invaded firms and their affiliated firms constitute a social network. The SIR model of intrusion propagation can be expressed as follows:where , , and , respectively, represents the proportion of susceptible state, infected state, or recovered state relative to the total firms in the network when they implement the strategy of autonomous defense at the time ; similarly, , , and , respectively, represent that of when they implement the strategy of information security outsourcing at the time , where .

3. Steady-State Analysis

3.1. Steady-State Analysis without considering Immune Failure and Strategy Transfer

First, we assume that the strategy of autonomous defense can resist attacks successfully. In other words, the firms’ security state does not change from to . Meanwhile, firms will not change their minds after adopting this strategy. In this case, there are and , and substitute them into equations (1), (2), (4), and (5). We can yieldwhere and , respectively, represent the proportion of initial susceptible state and infected state relative to total firms in the network when they are at the beginning of the invasion. Then, the variation trend of with , and with is studied, and the threshold of intrusion propagation is calculated subsequently. Next, it is necessary to analyze the monotonicity of and .

Let and , and the monotonicity of and are as follows: if , then ; if , then . If , then ; if , then .

Based on reality, the intrusion will propagate only when the proportion of infected firms increases. The threshold of intrusion propagation is when firms implement the strategy of autonomous defense; i.e., the intrusion will propagate only when . Similarly, the threshold of intrusion propagation is when firms implement the strategy of outsourcing; i.e., the intrusion will propagate only when . We can derive that and tend to be 0 with decreasing . Furthermore, the firms’ ability to resist risk will increase with a higher threshold of intrusion propagation. Meanwhile, the threshold of intrusion propagation is positively correlated with both the probability of information systems recovery (or ) and the externality , and is negatively correlated with the probability of invasion or . This means that if the MSSP has a high level of service ability to provide the firms high quality of security products, it can effectively reduce the probability of successful intrusion by hackers, improve the probability of successful repair after intrusion, and increase the positive security externality, so as to increase the threshold of intrusion propagation and enhance the ability of firms to resist risks.

Hereafter, we compare the thresholds of intrusion propagation with the two different security strategies. Let , , and then . We can obtain that if and vice versa. In other words, when the externality is positive, the strategy of outsourcing will increase the threshold of intrusion propagation; otherwise, it will decrease the threshold of intrusion propagation.

To conclude this section, we came to the following conclusions without considering immune failure and strategy transfer. Conclusion 1. If firms implement the strategy of autonomous defense, the threshold of intrusion propagation is ; if firms implement the strategy of outsourcing, the threshold of intrusion propagation is . Only when the propagation of the initial susceptible state is beyond the threshold, the intrusion will propagate. Furthermore, regardless of whether the intrusion propagates or not, the final proportion of firms in the infected state is 0. Conclusion 2. When the externality is positive, the strategy of outsourcing can better restrain hacker intrusion propagation. Compared with the strategy of autonomous defense, the threshold of intrusion propagation increases by . On the other hand, when the externality is negative, the strategy of outsourcing hard attains to expect the result. Compared with the strategy of autonomous defense, the threshold of intrusion propagation decreases by .

3.2. Steady-State Analysis considering Immune Failure

Based on the SIR model in Section 3.1, we consider the situation of immune failure; that is, the security state can change from “immune state” to “infected state.” However, it is still not considered of information security strategy transfer (). is the probability of immune failure, in which the security state may change from to , and is the probability of immune failure, in which the security state may change from to . Then, the SIR model is

Similarly, to analyze the threshold of intrusion propagation when immune failure occurs, it is necessary to discuss the monotonicity of equation (7). According to , we obtain that

The threshold of intrusion propagation is changing with the variation of , , and . Hence, we need to examine the following six situations, respectively. Situation 1. If , formula (13) can be simplified to , and we have the threshold of intrusion propagation . When , the intrusion does not propagate. Situation 2. If , formula (13) can be simplified to . In this situation, no matter what the value is, the intrusion will never propagate. Situation 3. If , formula (13) can be simplified to , and we have the threshold of intrusion propagation . In this situation, no matter what the value is, the intrusion will never propagate. Situation 4. If , formula (13) can be simplified to , and we have the threshold of intrusion propagation . When , the intrusion does not propagate. Situation 5. If , formula (13) can be simplified to , and we have the threshold of intrusion propagation . In this situation, no matter what the value is, the intrusion will always propagate. Situation 6. If , formula (13) can be simplified to , and we have the threshold of intrusion propagation . In this situation, no matter what the value is, the intrusion will always propagate.

Similarly, when firms choose the strategy of outsourcing, we can discuss the similar six situations, respectively. Situation 1. If , the intrusion will always propagate. Situation 2. If , no matter what the value is, the intrusion will never propagate. Situation 3. If , no matter what the value is, the intrusion will never propagate. Situation 4. If , we have the threshold of intrusion propagation . When , the intrusion does not propagate. When , the intrusion will first propagate at increasing speed and then slowly die out. Situation 5. If , no matter what the value is, the intrusion will always propagate. Situation 6. If , no matter what the value is, the intrusion will always propagate.

To conclude this section, we can drive the following conclusions when considering immune failure . Conclusion 3. Infected firms always exist in the network when . Conclusion 4. When externality is positive, the overall trend of intrusion propagation is not changed, but if MSSP security ability prevents hackers from continuing attacks on affiliated organizations by the positive externality, it can reduce the proportion of infected firms and the scale of intrusion propagation. Conclusion 5. If the strategy of autonomous defense is implemented, the intrusion will propagate when or . On the contrary, the intrusion will not propagate when , or ,or and ,or and . Conclusion 6. If the strategy of outsourcing is implemented, the intrusion will propagate when , or , or . On the contrary, the intrusion will not propagate when , or , or and .

3.3. Steady-State Analysis considering Immune Failure and Strategy Transfer

Based on the SIR model in Section 3.2, we consider the situation of both immune failure and strategy transfer. In reality, firms compare the strategy advantages of autonomous defense and outsourcing combining the situation of intrusion propagation and then dynamically adjust the information security strategy to ensure information system security. For example, if intrusion propagation occurs, the externality is positive , and firms may change their strategy from autonomous defense to outsourcing, which achieves the positive effects of externality. Alternatively, the externality is negative , and firms may stop cooperating with MSSP to avoid the negative effects of externality.

3.3.1. Steady-State Analysis When the Externality Is Positive

Let , , the other parameters are unequal zero, and we can yield

Let , , and when firms choose the strategy of autonomous defense, the threshold of intrusion propagation is

When firms choose the strategy of outsourcing, the threshold of intrusion propagation is

Suppose that all parameters are equal except , the security level increases after the strategy transfer, and it should be satisfied , that is, . It can be simplified to . Then, the strategy transfer from autonomous defense to outsourcing will improve the security level of the firms.

3.3.2. Steady-State Analysis When the Externality Is Negative

Let , , the other parameters are unequal zero, and when firms choose the strategy of autonomous defense, the threshold of intrusion propagation is

When firms choose the outsourcing strategy, the threshold of intrusion propagation is

Suppose that all parameters are equal except , the security level increases after the strategy transfer, and it should be satisfied . We can examine that is always true, which shows that when the externality is negative, firms should stop information security outsourcing.

To conclude this section, we can derive the following conclusions when considering immune failure and strategy transfer simultaneously: Conclusion 7. When the externality is positive and , the invaded firms should choose the strategy of outsourcing to protect their information security. Conclusion 8. When the externality is negative, the decision factors of the information security strategy are not correlated with and . In other words, invaded firms should choose the strategy of outsourcing for better security level.

According to the above conclusions, we summarize the conditions of hacker intrusion propagation or nonpropagation under different information security strategies (Table 1), in which Case I indicates that immune failure and strategy transfer are not considered, Case II indicates that only immune failure is considered, and Case III indicates that immune failure and strategy transfer are considered at the same time. Firms and MSSP could adjust their own information security strategy or network security level due to the conditions of hacker intrusion propagation or nonpropagation in the case of autonomous defense or outsourcing information security.

For example, we discuss the situations when firms choose autonomous defense strategy. In Case I, hacker intrusion propagation is related to the probability that the firm is invaded and the probability that the systems are successfully repaired after being invaded, while in Case II, hacker intrusion propagation is also affected by the probability of immune failure and the proportion of infected states in network nodes. Besides in Case III, hacker intrusion propagation is restricted by the probability of immune failure, the proportion of infected states in network nodes together with the proportion of strategy transfer.

To sum up, firms will choose the security technology according to the above influencing factors and improve their security levels. In addition, the proportion of susceptible states should be controlled in the range of hacker intrusion nonpropagation. For instance, in Case I, compared with the firms choosing autonomous defense, if the information security outsourcing strategy is implemented, hacker intrusion propagation is affected by the security externalities. Similarly, MSSP should also adjust its own security service level according to the network environment to control the proportion of susceptible state in the range of hacker intrusion nonpropagation.

4. Numerical Analysis

To better understand the conclusions of steady-state analysis, numerical simulation is a valid means to clarify the analytical process of the overall and local details. We set simulation parameters which accord with the numerical range in Section 2.1.

4.1. Numerical Simulation without considering Immune Failure and Strategy Transfer

Let , , , and the externalities are and , the phase trajectory of with when firms choose the strategy of outsourcing, and the phase trajectory of with when firms choose the strategy of autonomous defense.

Firms in the susceptible state tend to turn into or , and the proportion of the susceptible state decreases. Figure 2 shows that with the decline of the proportion of susceptible firms, the proportion of infected firms first increases, then decreases, and eventually tends to be 0. Due to hackers having invaded certain firms and copied successful experiences to invade the affiliated firms, the proportion of infected firms is increased. However, firms will develop effective security defense strategies that increase the number of immunized firms in the network. In addition, the above discussion is an ideal case, in which the negative impact of the immune failure on the security level is not considered. Therefore, firms in the infected state will eventually change to the recovered state as long as the defense is successful. Figure 2 also shows that if the proportion of susceptible firms is less than the threshold, the proportion of infected firms will decrease, which is consistent with Conclusion 1.

Next, we study the impact of externality on the security state of firms. Let , , , and . Figures 3 and 4 show the security transfer if firms choose different security strategies, when positive externality or negative externality occurs during outsourcing, in which , , is the security state when firms choose the strategy of autonomous defense; in this situation, the externality is 0. Figure 3 shows , , is the security state curve when firms choose the strategy of information outsourcing with the positive externality . Figure 4 shows , , is the security state curve when firms choose the strategy of outsourcing with negative externality .

When , we obtain that , , and satisfy the condition that the intrusion does not propagate in Conclusion 1, which is consistent with the declining trend of and in Figure 3. When , we obtain that and satisfy the condition that the intrusion propagates in Conclusion 1, which is consistent with the trend of that first increases and then declines in Figure 4. In addition, Figure 3 shows that when the externality is positive, the declining trend of is faster than that of . On the other hand, Figure 4 shows that when the externality is negative, the declining trend of is faster than that of , which is consistent with Conclusion 2.

4.2. Numerical Simulation considering Immune Failure

In this section, we first consider the case of immune failure when firms choose the strategy of autonomous defense. For situation 1, let , , and , . For situation 2, let , , and . For situation 3, let , , , and . For situation 4, let , , , and . For situation 5, let , , , and . For situation 6, let , , , and . Figure 5 shows the variation curves of the proportion of infected firms with when the firms choose the strategy of autonomous defense.

Secondly, we consider the case of immune failure when firms choose the strategy of outsourcing. For situation 1, let , , , , and . For situation 2, let , , , and . For situation 3, let , , , and . For situation 4, let , , , and . For situation 5, let , , , and . For situation 6, let , , , and . Figure 6 shows the variation curves of the proportion of infected firms with when the firms choose the strategy of outsourcing if the externality is 0.2.

Figures 5 and 6, respectively, show the variation curves of the proportion of infected firms when they choose the strategy of autonomous defense and outsourcing. When immune failure occurs, whichever security strategy firms choose, there are always invaded firms, and the variation trend of the proportion of infected firms is the same. Specifically, the proportion of infected firms in situation 1, situation 5, and situation 6 shows an increasing trend, while the proportion of infected firms in situation 2, situation 3, and situation 4 shows a declining trend. In addition, comparing Figures 5 and 6, we derive when firms choose the strategy of outsourcing and the externality is positive, the proportion of infected firms as well as the scale of intrusion propagation can be decreased in the network.

4.3. Numerical Simulation considering Immune Failure and Strategy Transfer

In this section, regardless of whether externality is positive or negative, let , , , and . Figures 7 and 8(a) show that is the variation curve of infected firms when the strategy of autonomous defense is chosen. The remaining four curves , respectively, correspond to the variation curves of infected firms when they transfer the strategy from autonomous defense to that of outsourcing with gradually increasing externality.

(a)

(b)

In addition, to clarify how the strategy transfer affects the information security strategy, we compare the trends of and under a certain negative externality in Figure 8(b) (i.e., let ).

Figure 7 shows that the strategy of outsourcing is inferior to that of autonomous defense when , which implies that . With the continuous increase of positive externality (i.e., , , ), the scale of invaded firms in the network decreases after implementing the strategy of outsourcing. And the greater impact of positive externality leads to a lower proportion of infected firms. This demonstrates that if the MSSP plays an active role through positive externality, strategy transfer can better ensure the firms’ security. Therefore, firms have more motivation to transfer from the strategy of autonomous defense to that of outsourcing, which is consistent with Conclusion 7.

Figures 8(a) and 8(b) show that in the case of negative externality, no matter how the externality influences and the proportion of strategy transfer varies, the proportion of infected firms when choosing the strategy of autonomous defense is always less than that of outsourcing. This demonstrates that the strategy of autonomous defense can better protect the firms’ security.

5. Conclusion

In this paper, the SIR model of intrusion propagation in complex networks is established under different information security states. The threshold conditions of intrusion propagation are studied by steady-state analysis when firms choose different security strategies. The influences of externalities on the scale of intrusion propagation and strategy transfer are also discussed. We showed that (i) without considering immune failure and strategy transfer, the intrusion will propagate if the initial proportion of susceptible firms is greater than the threshold of intrusion propagation; firms can effectively resist the intrusion propagation only if the externality is positive. (ii) Considering immune failure, there are always infected firms in the network. When the externality is positive, it will not change the fact of intrusion propagation if firms choose the strategy of outsourcing; however, it can reduce the propagation speed. The probability of intrusion propagation is influenced by the proportion of the initial infected state, the probability of invasion, and the probability of immune failure. (iii) Considering both immune failure and strategy transfer, if the externality is positive and greater than a certain threshold, invaded firms can seek the help of outsourcing; otherwise, firms should stop outsourcing information security as soon as possible.

In addition, the conclusions of this paper also provide guidance when firms encounter hacker intrusion.

First, if the hacking damage is not serious or the firms’ defense is successful and can resist the same type of attack again, the ratio between the effect of recovering information systems and the probability of invasion should be comprehensively considered. And the probability of intrusion propagation can be judged by the proportion of firms that have not been invaded relative to the total firms in the network. If firms choose the strategy of outsourcing, the MSSP must play an active role in ensuring information systems security by positive externality of intrusion event associative processing.

Secondly, if the hacking methods are upgraded, which probably leads to the immune failure, firms need to be prepared for a long battle with hackers. And the probability of intrusion propagation can be comprehensively judged by the proportion of infected firms in total and the probability of immune failure. If the quality of the MSSP’s security service is relatively high, the strategy of outsourcing can slow down the speed of hacker intrusion propagation, which reduces the scale of invaded firms.

Finally, when the firms transfer their information security strategy after they are invaded, then collaborating with the MSSP is a better choice only if the MSSP may collect hackers’ information by analysis tools to develop personalized defense measures, dynamically respond to security threats, and maximize security benefits. On the contrary, if the MSSP cannot effectively detect system vulnerabilities and ignore the potential risk of the threat to affiliated firms, which reduces the hackers’ cost of copying intrusion experience, leading to a poor outsourcing service quality, firms should stop outsourcing security service as soon as possible.

Data Availability

The data used to support the findings of this study are available from the corresponding author upon request.

Conflicts of Interest

The authors declare that there are no conflicts of interest regarding the publication of this paper.

Acknowledgments

This research was funded by the National Natural Science Foundation of China (71801125 and 71701093), China Postdoctoral Science Foundation funded project (2018M630544), and Jiangsu Postdoctoral Science Foundation funded project (1701080C).

References

“Positive Technologies. “Industrial Companies: Attack Vectors,” 2018, https://www.ptsecurity.com/ww-en/analytics/ics-attacks-2018.
View at: Google Scholar
N. FengY. ChenD. LiD. LiM. Li, “To outsource or not: the impact of information leakage risk on information security strategy Information & Management,” vol. 57, no. 5, Article ID 103215, 2020.
View at: Publisher Site | Google Scholar
Y. Zhao, D. Liu, J. Li, X. Zhang, and X. Wang, “L-NBP, a multiple growth factor activator, attenuates ischemic neuronal impairments possibly through promoting neuritogenesis,” Neurochemistry International, vol. 124, no. 12, pp. 94–105, 2019.
View at: Publisher Site | Google Scholar
J. Ren, X. Yang, Q. Yang, L. X. Zhang, and C. Zhang, “A novel computer virus model and its dynamics,” Nonlinear Analysis: Real World Applications, vol. 13, no. 1, pp. 376–384, 2012.
View at: Publisher Site | Google Scholar
A. Kigerl, “Routine activity theory and malware, fraud, and spam at the national level,” Crime, Law and Social Change, vol. 76, no. 2, pp. 109–130, 2021.
View at: Publisher Site | Google Scholar
R. Swami, M. Dave, and V. Ranga, “Software-defined networking-based DDoS defense mechanisms,” ACM Computing Surveys, vol. 52, no. 2, pp. 1–36, 2020.
View at: Publisher Site | Google Scholar
X. Gao and W. Zhong, “A differential game approach to security investment and information sharing in a competitive environment,” IIE Transactions, vol. 48, no. 6, pp. 511–526, 2016.
View at: Publisher Site | Google Scholar
K. Hausken, “A strategic analysis of information sharing among cyber hackers,” JISTEM-Journal of Information Systems and Technology Management, vol. 12, no. 2, pp. 245–270, 2015.
View at: Publisher Site | Google Scholar
K. Hausken, “Security investment, hacking, and information sharing between companys and between hackers,” Games, vol. 8, no. 2, pp. 1–23, 2017.
View at: Publisher Site | Google Scholar
H. F. Gagliardi and D. Alves, “Small-world effect in epidemics using cellular automata,” Mathematical Population Studies, vol. 17, no. 2, pp. 79–90, 2010.
View at: Publisher Site | Google Scholar
A. M. D. Rey, G. Hernández, A. B. Tabernero, and A. Q. Dios, “Advanced malware propagation on random complex networks,” Neurocomputing, vol. 423, no. 7, pp. 689–696, 2021.
View at: Publisher Site | Google Scholar
Y. Wang, D. Li, and N. Dong, “Cellular automata malware propagation model for WSN based on multi‐player evolutionary game,” IET Networks, vol. 7, no. 3, pp. 129–135, 2018.
View at: Publisher Site | Google Scholar
Y. H. Hsieh and Y. H. Hsieh, “Global analysis of an SEIR model with varying population size and vaccination,” Applied Mathematical Modelling, vol. 34, no. 10, pp. 2685–2697, 2010.
View at: Publisher Site | Google Scholar
L. Lu, D. Chen, X. L. Ren et al., “Vital nodes identification in complex networks,” Physics Reports, vol. 650, no. 13, pp. 1–63, 2016.
View at: Google Scholar
C. Li, L. Wang, and S. Sun, “Identification of influential spreaders based on classified neighbors in real-world complex networks,” Applied Mathematics and Computation, vol. 320, no. 3, pp. 512–523, 2018.
View at: Google Scholar
L. X. Yang, J. M. Zhu, Q. Gan, and C. Gan, “Epidemics of computer viruses: a complex-network approach,” Applied Mathematics and Computation, vol. 219, no. 16, pp. 8705–8717, 2013.
View at: Publisher Site | Google Scholar
P. ZhuX. WangS. D. GuoY. Wang and Z. Wang, “Investigation of epidemic spreading process on multiplex networks by incorporating fatal properties,” Applied Mathematics and Computation, vol. 359, no. 8, pp. 512–524, 2019.
View at: Publisher Site | Google Scholar
W. C. Yeh, E. Lin, and C. L. Huang, “Predicting spread probability of learning-effect computer virus,” Complexity, vol. 2021, Article ID 6672630, pp. 1–17, 2021.
View at: Publisher Site | Google Scholar
Y. Feng, M. Qiu, G. Wang, and R. Ma, “Virus propagation model and node defense strategy of single operation system viru,” in Proceedings of the 2019 International Conference on Intelligent Computing, pp. 374–378, IEEE, Chongqing, China, December 2019.
View at: Google Scholar
P. Zhou, X. Gu, and S. Nepal, “Modeling social worm diffusion for advanced persistent threats,” Computers & Security, vol. 108, Article ID 102321, 2021.
View at: Google Scholar
X. Ye, S. Xie, and S. Shen, “SIR1R2: characterizing malware propagation in WSNs with second immunization,” IEEE Access, vol. 9, no. 99, pp. 82083–82093, 2021.
View at: Publisher Site | Google Scholar
W. Wei, M. Tang, H. Eugene et al., “Unification of theoretical approaches for epidemic spreading on complex networks,” Reports on Progress in Physics, vol. 80, no. 3, pp. 36–63, 2017.
View at: Google Scholar
X. QianX. LiuP. M. PardalosP. M. LiuL. Liu, “A game-theoretic analysis of information security investment for multiple firms in a network,” Journal of the Operational Research Society, vol. 68, no. 10, pp. 1290–1305, 2017.
View at: Publisher Site | Google Scholar
X. Qian, W. Yang, X. Liu, X. Pardalos, and P. M. Pardalos, “A game of information security investment considering security insurance and complementary information assets,” International Transactions in Operational Research, vol. 29, no. 3, pp. 1791–1824, 2021.
View at: Publisher Site | Google Scholar
B. Smirnova and I. Smirnova, “Optimal configuration of intrusion detection systems,” Information Technology and Management, vol. 22, no. 4, pp. 231–244, 2021.
View at: Publisher Site | Google Scholar
Y. Wu, R. Y. Fung, G. Wang, and N. Wang, “Decisions making in information security outsourcing: impact of complementary and substitutable firms,” Computers & Industrial Engineering, vol. 110, no. 10, pp. 1–12, 2017.
View at: Publisher Site | Google Scholar
A. Cezar, H. Cavusoglu, and S. Raghunathan, “Outsourcing information security: contracting issues and security implications,” Management Science, vol. 60, no. 3, pp. 638–657, 2014.
View at: Publisher Site | Google Scholar
C. Zhang, N. Feng, J. Li, D. Li, and M. Li, “Outsourcing strategies for information security: correlated losses and security externalities,” Information Systems Frontiers, vol. 23, no. 3, pp. 773–790, 2021.
View at: Publisher Site | Google Scholar

Copyright

Copyright © 2022 Liurong Zhao et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

PDF Download Citation

Download other formats

Order printed copies