Predicting Malicious Behavior of Insiders using Game Theory

Sepehrzadeh, Hamed; Haghighi, Sana

doi:10.48301/jear.2025.385426.1002

Predicting Malicious Behavior of Insiders using Game Theory

Document Type : Original Article

Authors

Hamed Sepehrzadeh ¹

Sana Haghighi ²

¹ Department of Computer Engineering, Technical and Vocational University, Tehran, Iran.

² Faculty of Computer Science and Engineering, Shahid Beheshti University, Tehran, Iran

10.48301/jear.2025.385426.1002

Abstract

Nowadays, information security is a crucial issue in organizations. Security flaws are serious threats to an organization. Every organization has sensitive information that may be threatened by malicious adversaries and even employees (insiders). In order to limit security incidents, each organization must concentrate on employee’s behavior. Indeed, employees of an organization act as a natural safeguard for information. Therefore, predicting the behavior of internal employees against the information assets of the organization is very important. To this end, this paper proposes a game-theoretic modeling approach to capture the interaction between employees and organization to predict malicious employees (insiders) and organizations behavior with incomplete information. The game parameters are some important elements of security culture including influencing and organizational behavior factors, and security related factors. By solving the game model, Nash equilibriums are computed and best possible strategies for the participants are recognized. Quantitative evaluation of the information security of organization can be done according to the probability of performing unacceptable behavior by employees and the probability of organization investment in order to increase the organizational information security.

Keywords

Information Security

Organization

Employee

Insider

Game Theory

Modeling

Evaluation

Subjects

Computer Engineering

[1] AlHogail, A., (2015). Design and validation of information security culture framework. Computers in human behavior, 49, 567-575.

[2] Reid, R. and Van Niekerk, J., (2014). Brain-compatible, web-based information security education: a statistical study. Information Management & Computer Security.

[3] Orojloo, H. and Azgomi, M.A., (2017). A method for evaluating the consequence propagation of security attacks in cyber–physical systems. Future Generation Computer Systems, 67, 57-71.

[4] Humayed, A., Lin, J., Li, F. and Luo, B., (2017). Cyber-physical systems security—A survey. IEEE Internet of Things Journal, 4(6), 1802-1831.

[5] Parsons, K., McCormac, A., Butavicius, M., Pattinson, M. and Jerram, C., (2014). Determining employee awareness using the human aspects of information security questionnaire (HAIS-Q). Computers & security, 42, 165-176.

[6] Parsons, K., Calic, D., Pattinson, M., Butavicius, M., McCormac, A. and Zwaans, T., (2017). The human aspects of information security questionnaire (HAIS-Q): two further validation studies. Computers & Security, 66, 40-51.

[7] Osborne, M.J., (2004). An introduction to game theory (Vol. 3, No. 3). New York: Oxford university press.

[8] Liang, X. and Xiao, Y., (2012). Game theory for network security. IEEE Communications Surveys & Tutorials, 15(1), 472-486.

[9] Cui, Y., Quddus, N., & Mashuga, C. V. (2020). Bayesian network and game theory risk assessment model for third-party damage to oil and gas pipelines. Process Safety and Environmental Protection, 134, 178-188.

[10] Siponen, M. and Willison, R., (2009). Information security management standards: Problems and solutions. Information & management, 46(5), 267-270.

[11] Shamala, P., Ahmad, R., Zolait, A. and Sedek, M., (2017). Integrating information quality dimensions into information security risk management (ISRM). Journal of Information Security and Applications, 36, 1-10.

[12] Kim, J.Y. and Kwon, H.Y., (2022). Threat Classification Model for Security Information Event Management Focusing on Model Efficiency. Computers & Security, p.102789.

[13] Wiley, A., McCormac, A. and Calic, D., (2020). More than the individual: Examining the relationship between culture and Information Security Awareness. Computers & Security, 88, p.101640.

[14] Tolah, A., Furnell, S.M. and Papadaki, M., (2021). An empirical analysis of the information security culture key factors framework. Computers & Security, 108, p.102354.

[15] Figueira, P.T., Bravo, C.L. and López, J.L.R., (2020). Improving information security risk analysis by including threat-occurrence predictive models. Computers & Security, 88, p.101609.

[16] McCormac, A., Zwaans, T., Parsons, K., Calic, D., Butavicius, M. and Pattinson, M., (2017). Individual differences and information security awareness. Computers in Human Behavior, 69, 151-156.

[17] Thangavelu, M., Krishnaswamy, V. and Sharma, M., (2021). Impact of comprehensive information security awareness and cognitive characteristics on security incident management–an empirical study. Computers & Security, 109, p.102401.

[18] Nazareth, D.L. and Choi, J., 2015. A system dynamics model for information security management. Information & Management, 52(1), 123-134.

[19] Abapour, S., Mohammadi-Ivatloo, B., & Hagh, M. T. (2020). A Bayesian game theoretic based bidding strategy for demand response aggregators in electricity markets. Sustainable Cities and Society, 54, 101787.

[20] Dahiya, A., & Gupta, B. B. (2021). A reputation score policy and Bayesian game theory based incentivized mechanism for DDoS attacks mitigation and cyber defense. Future Generation Computer Systems, 117, 193-204.

[21] Pattinson, M., Parsons, K., Butavicius, M., McCormac, A. and Calic, D., (2016). Assessing information security attitudes: a comparison of two studies. Information & Computer Security, 24(2), 228-240.

[22] Safa, N.S. and Von Solms, R., (2016). An information security knowledge sharing model in organizations. Computers in Human Behavior, 57, 442-451.

[23] Hadlington, L., Binder, J. and Stanulewicz, N., (2021). Exploring role of moral disengagement and counterproductive work behaviours in information security awareness. Computers in Human Behavior, 114, p.106557.

[24] Lye, K.W. and Wing, J.M., (2005). Game strategies in network security. International Journal of Information Security, 4(1), 71-86.

[25] Njilla, L.Y., Pissinou, N. and Makki, K., (2016). Game theoretic modeling of security and trust relationship in cyberspace. International Journal of Communication Systems, 29(9), 1500-1512.