Behavioral validation for a game-theoretic model of attacker strategic decisions, signaling, and deterrence in multi-layer security for soft targets.

Abstract

Understanding what factors influence an attacker's decision to attack a soft target is important for allocating resources effectively to defend valuable targets. In this study, we aim to validate a game-theoretic model that explores the relationship between the reward and probability of successfully attacking through multiple layers of defense. We created multiple scenarios corresponding to each of four game-theoretic cases, resulting in a 2 × 2 factorial design (defended vs. undefended targets X low vs. high expected values [EVs] for attackers). We recruited 454 US adults from Prolific.com to decide whether to attack for a series of 24 scenarios, which varied the probability of success, the magnitude of reward, and whether Layer 1 was signaled to be defended or not. Results were generally consistent with the game model predictions, including a greater tendency to attack undefended targets with a higher EV. Targets with a low probability of success and greater reward were less likely to be attacked than targets with a higher probability of success and smaller reward. Additionally, participants with a higher self-reported risk-taking were significantly more likely to attack for a given trial compared to participants with lower self-reported risk-taking. This validated game model can be used as a tool to help stakeholders identify where threats are the most likely to occur based on inherent defenses and appeal to attackers.