Fictitious Play with Time-Invariant Frequency Update for Network Security

We study two-player security games which can be viewed as sequences of nonzero-sum matrix games played by an Attacker and a Defender. The evolution of the game is based on a stochastic fictitious play process, where players do not have access to each other’s payoff matrix. Each has to observe the other’s actions up to present and plays the action generated based on the best response to these observations. In a regular fictitious play process, each player makes a maximum likelihood estimate of her opponent’s mixed strategy, which results in a time-varying update based on the previous estimate and current action. In this paper, we explore an alternative scheme for frequency update, whose mean dynamic is instead time-invariant. We examine convergence properties of the mean dynamic of the fictitious play process with such an update scheme, and establish local stability of the equilibrium point when both players are restricted to two actions. We also propose an adaptive algorithm based on this time-invariant frequency update.

💡 Research Summary

This paper focuses on two-player security games, which can be viewed as sequences of nonzero-sum matrix games played by an Attacker and a Defender. The evolution of the game is based on a stochastic fictitious play process where players do not have access to each other’s payoff matrices but observe each other’s actions up to that point and respond with their best action based on these observations.

Traditionally, in fictitious play processes, players make maximum likelihood estimates of their opponent’s mixed strategies, leading to time-varying updates based on previous estimates and current actions. This paper explores an alternative scheme for frequency update where the mean dynamic is instead time-invariant. The authors examine the convergence properties of this new fictitious play process with a time-invariant frequency update and establish local stability at equilibrium points when both players are restricted to two actions.

The research also proposes an adaptive algorithm based on this time-invariant frequency update scheme, which could potentially improve the efficiency and robustness of security systems. The study contributes significantly to understanding interactions between attackers and defenders in network security contexts by providing a more stable framework for predicting and responding to strategic behaviors. This approach not only enhances theoretical insights but also offers practical implications for designing adaptive security mechanisms that can better withstand evolving threats.