## A Quantal Response Analysis of Defender-Attacker Sequential Security Games

Md Reya Shad Azim, and Mustafa Abdallah.

Abstract -We explore a scenario involving two sites and a sequential game between a defender and an attacker, where the defender is responsible for securing the sites while the attacker aims to attack them. Each site holds a loss value for the defender when compromised, along with a probability of successful attack. The defender can reduce these probabilities through security investments at each site. The attacker's objective is to target the site that maximizes the expected loss for the defender, taking into account the defender's security investments. While previous studies have examined security investments in such scenarios, our work investigates the impact of bounded rationality exhibited by the defender, as identified in behavioral economics. Specifically, we consider quantal behavioral bias, where humans make errors in selecting efficient (pure) strategies. We demonstrate the existence of a quantal response equilibrium in our sequential game and analyze how this bias affects the defender's choice of optimal security investments. Additionally, we quantify the inefficiency of equilibrium investments under quantal decision-making compared to an optimal solution devoid of behavioral biases. We provide numerical simulations to validate our main findings.

Notably, the quantal response equilibrium takes into account the fact that human decision-makers may not always make perfectly rational decisions. Instead, it allows for decision-making where the players in a game may not always choose the best response with certainty, but their choices are probabilistic and influenced by factors such as noise and cognitive limitations. Many empirical studies have provided evidence for this class of behavioral models [8]-[10].

## I. INTRODUCTION

Enhancing the security of cyber-physical systems (CPS) against sophisticated adversaries presents a formidable challenge [1]. In such contexts, adversaries often exploit vulnerabilities to target specific objectives, while defenders typically contend with limited resources for vulnerability mitigation [2], [3]. Game-theoretic models have been leveraged to capture these settings under various assumptions regarding the strategies available to defenders and attackers [4]-[6]. Of particular relevance to our study is the work by Powell et al. [6], which examined a sequential framework involving defenders and attackers, elucidating optimal strategies for each player.

A common thread in much of the existing work for securing CPS is that the defenders and attackers are assumed to behave according to classical models of fully rational decision-making, taking actions to minimize their expected loss (or maximizing expected utility). However, a large body of work in behavioral economics and psychology has shown that humans consistently deviate from such classical models of decision-making. For example, quantal response research showed that humans consistently make errors in choosing efficient (pure) strategies when making decisions [7].

This research was supported by EMPOWER grant from the Vice Chancellor for Research at Indiana University-Purdue University Indianapolis. Md Reya Shad Azim is with the Department of Electrical and Computer Engineering at Indiana University-Purdue University Indianapolis. Email: azimm@iu.edu . Mustafa Abdallah is with the Department of Computer and Information Technology at Indiana University-Purdue University Indianapolis. Email: abdalla0@iu.edu .

While a substantial body of literature on quantal response exists in economics and psychology, the existing research exploring the impact of such behavioral decision-making on CPS security and robustness primarily draws from psychological studies [11] and human subject experiments [12], [13]. However, these studies often lack rigorous mathematical models of players' behavior. Recently, there has been a growing trend towards leveraging mathematical analysis to model and predict the effect of behavioral decision-making on players' investments [14]-[17]. However, these works have only focused only on prospect-theoretic attitudes and have not considered quantal behavioral errors which is the focus of our work.

In this paper, we introduce quantal response into a game-theoretic framework involving one defender and one attacker. We consider the case where the defender places her investments to best protect her sites, accounting for a strategic attacker who chooses which site to compromise to maximize the expected loss of the defender. We first show that such a game with behavioral players (with quantal responses) has a quantal response equilibrium (QRE). We then show that the probability of choosing the best investment strategy is non-decreasing in the behavioral level of the defender. We then characterize the main impacts of the behavioral level and the assets' losses on the security investments made by the defender.

We introduce a formal setting for quantal behavioral decision-making, described in further detail in the next two sections. We first show the uniqueness of the optimal defense allocation of the defender. We then characterize the impacts of quantal response behavioral level on choosing the best investment decision by the defender; in particular, we show that the defender tends to choose her optimal investments with lower probability under higher level of quantal bias which increases her loss when attacked. We then show that the choice of the optimal defense strategy depends on the sites' losses and other available strategies. Finally, we introduce the notion of Price of Quantal Anarchy (PoQA) to quantify the inefficiency of the behavioral defender's choice of less efficient investments on her expected loss and provide bounds on the PoQA. We finally provide numerical simulations to illustrate our findings.

## II. THE DEFENDER-ATTACKER SEQUENTIAL GAME

In this section, we describe our sequential game framework, which builds upon the model introduced in [6].

## A. Defender-Attacker Sequential Game Setup

Game Setup: We consider a security game which consisting of two players, a defender and an attacker. There are two sites , denoted site 1 and site 2 , which the defender is trying to protect (and the attacker is trying to compromise). The defender has a budget R ∈ R &gt; 0 that she can spend on defending the both sites. In particular, the defender moves first and allocates an amount r ∈ [0 , R ] to site 1 and an amount R -r to site 2 . We assume that the attacker can observe the allocations made by the defender to each of the sites, after which she targets one of the two sites to attack.

Defense Strategy Space: The defense strategy space of the defender is defined by

$$X \coloneqq \{ \dot { \mathbf r } \in \mathbb { R } _ { \geq 0 } ^ { 2 } | 1 ^ { T } \mathbf r = R \}.$$

In words, X is the set of feasible security investments for the defender. It consists of all possible non-negative investments on the two sites such that the sum of these investments equals the defender's security budget R . This captures the real-world assumption of limited security resources for human security decision-makers. We denote any particular vector of investments by the defender as r ∈ X , where r = [ r, R -r ] .

Probability of Successful Attack: The probability of successful attack on site 1 , when the defense investment on that site is r , is denoted by p 1 ( r ) . We assume p ′ 1 &lt; 0 and p ′′ 1 &gt; 0 . Similarly, for site 2, let p 2 ( x ) be the probability that an attack on site 2 succeeds if the defender spends x = R -r defending that site. Once again, we assume that p ′ 2 &lt; 0 and p ′′ 2 &gt; 0 . In words, the probability that the attacker successfully compromises the site that it targets is a decreasing function of the amount invested in protecting that site by the defender. We emphasize that these assumptions are common in security games literature (e.g., [6], [18]).

Defender's Loss and Attacker's Gain: The defender suffers a loss of one if site 1 is successfully attacked, and a loss of A &gt; 0 if site 2 is successfully attacked. After the defender allocates her resources, the attacker targets the site that will maximize the defender's expected loss. Thus, the defender's expected loss if it allocates r to site 1 is given by

$$L ( { \mathbf r } ) = \max \left \{ p _ { 1 } ( r ), A p _ { 2 } ( R - r ) \right \}. \quad \quad ( 1 )$$

This is also the attacker's expected gain. In other words, the attacker chooses which site to attack in order to maximize the defender's true expected loss. Thus, the attacker's action under a defense investment of r on site 1 will yield the utility

$$U ( { \mathbf r } ) = \max \{ p _ { 1 } ( r ), A p _ { 2 } ( R - r ) \}. \quad \quad ( 2 )$$

Figure 1 illustrates an illustrative example of our sequential game setup, which serves as the basis for evaluating our analysis throughout this paper.

Fig. 1: A sequential game setup where the defender invests r on site-1 and R -r in site-2 (solid green arrows). The attacker attacks either site-1 or site-2 (dashed red arrows) after observing defender's investments on the two sites.

![image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00964v1-figure-0a31ab84-f5dd-46f5-9eb7-eedd63a83102.jpg)

## B. Uniqueness of defender's optimal investment strategy

Proposition 1: The defender's optimal allocation to site 1 to minimize L ( r ) in (1) is unique, and denoted by r ∗ .

Proof: First, note that by our assumption p 1 ( r ) is strictly decreasing in r . Similarly, by our assumption that p 2 ( x ) is strictly decreasing in its argument, the function p 2 ( R -r ) is strictly increasing in r . Thus, Ap 2 ( R -r ) is strictly increasing in r .

First, consider the case where p 1 ( r ) &lt; Ap 2 ( R -r ) ∀ r ∈ [0 , R ] . Then, r ∗ = 0 is the unique solution that minimizes the defender's expected loss (since if the defender deviates to any investment r &gt; 0 , the defender's expected loss Ap 2 ( R -r ) would be larger as Ap 2 ( R -r ) is increasing in r .

Second, consider the case in which p 1 ( r ) &gt; Ap 2 ( R -r )) ∀ r ∈ [0 , R ] . Then, r ∗ = R is the unique solution that minimizes the defender's expected loss (since if the defender deviates to any investment r &lt; R , the defender's expected loss p 1 ( r ) would increase as p 1 ( r ) is decreasing in r as shown earlier due to this second case).

Now, consider the cases that are not considered by the above two (corner) cases. Note that since p 1 ( r ) is strictly decreasing in r , and since Ap 2 ( R -r ) is strictly increasing in r , and since neither function is always larger than the other (which was captured by the above two cases), there must be a unique value of r at which p 1 ( r ) = Ap 2 ( R -r ) . This will be the unique solution to the problem of minimizing (1), which we denote by r ∗ .

Corollary 1: Suppose that the quantities p 1 ( r ) and Ap 2 ( R -r ) are such that p 1 (0) &gt; Ap 2 ( R ) and p 1 ( R ) &lt; Ap 2 (0) . Let p 1 ( r ) = exp( -r ) and p 2 ( r ) = e -( R -r ) , respectively. Then, the defender's optimal allocation to site 1 in order to minimize L ( r ) in (1) is given by r ∗ = R -log A 2 .

Proof: Since p 1 ( r ) and Ap 2 ( R -r ) are such that p 1 (0) &gt; Ap 2 ( R ) and p 1 ( R ) &lt; Ap 2 (0) (from the corollary statement), there is a unique quantity r ∗ such that p 1 ( r ∗ ) = Ap 2 ( R -r ∗ ) . Now, substituting in the equality yields

$$\text{action} \quad \mu r \, \cdots \quad \cdot \, \nu \, \cdots \, \cdots \, \cdots \, \nu \, \cdots \, \nu \, \cdots \, \\ \text{utility} \quad p _ { 1 } ( r ^ { * } ) = A p _ { 2 } ( R - r ^ { * } ) & \iff \exp ( - r ^ { * } ) = A \exp ( r ^ { * } - R ) \\ ( 2 ) & \iff - r ^ { * } = \log A - R + r ^ { * } \\ \text{$r$ or} \quad \iff r ^ { * } = \frac { R - \log A } { 2 }.$$

$$2$$

Note that (a) holds by taking logarithms for both sides.

![image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00964v1-figure-30340d58-7c33-4d64-9817-2a84b2845343.jpg)

Investment at Site 1, r

Fig. 2: Illustration of the defender's optimal resource allocation that minimizes the maximum expected loss.

From the above corollary, it is clear that under the above assumptions, when A = 1 the best investment strategy is r ∗ = R 2 (i.e., the defender half of the budget on each site). For A &lt; 1 , the log A term is negative, hence r ∗ &gt; R 2 (i.e., the defender allocates more resources on site 1). Finally, for A &gt; 1 , we have r ∗ &lt; R 2 (i.e., the defender allocates more resources on site 2 since it has higher loss valuation).

Fig. 2 illustrates r ∗ , i.e., the allocation that minimizes the maximum expected loss for the defender. In this illustrative figure, we consider that the defense budget is 10 and loss at site 2 is one, i.e., both sites incur same loss (unit loss) when compromised by the attacker.

As anticipated, the optimal approach for the defender is to select r to equalize the expected loss from both sites, if feasible. While the paper [6] investigated this game under the assumption of perfect rationality for both the defender and the attacker, they did not delve into the effects of quantal behavioral biases exhibited by either party. On the other hand, the prior work [17] focused only on the effect of non-linear probability weighting of attack success probability (from prospect theory) on the defender's investments in that sequential game setup. In this paper, we delve into the quantal behavioral bias of the defender (where the defender is assumed to make errors in choosing which pure security investment to allocate on the sites). We outline this scenario in the following section and subsequently scrutinize the consequences of this quantal behavioral decision-making.

## III. QUANTAL RESPONSE EQUILIBRIUM

## A. Quantal Response Modeling

Quantal response equilibrium (QRE) is a solution concept in game theory which provides an equilibrium concept with bounded rationality [19]. It takes into account bounded rationality and stochasticity in players' decision-making processes. It provides a structural, statistical model of human operators where humans consistently make errors in choosing efficient strategies as shown in behavioral economics and psychology when modeling human decision-making (e.g., [8], [9]). In contrast to the deterministic and perfect best-response behavior of PNE, in the QRE players 'better respond' and choose strategies that provide higher payoffs with a higher probability.

Incorporating QRE in Our Sequential Game: In sequential security games, incorporating QRE allows for a more realistic representation of human decision-making, acknowledging that players may not always select the optimal strategies but instead exhibit a degree of randomness or error in their choices. In our setup we use logit QRE where defender's and attacker's strategies are chosen probabilistically, with the likelihood of selecting a particular strategy influenced by its expected benefit (i.e., expected loss for defender and expected gain for the attacker) relative to other available strategies and a noise parameter λ representing the level of noise or randomness in decision-making. This reflects the inherent unpredictability of real-world cybersecurity scenarios [20].

We incorporate such a QRE concept into our game setup, as detailed next.

Defender's Quantal Response: In our sequential defender-attacker security game, the defender's security investment profiles would be chosen according to the following probability distributions (given by logit function)

$$\sigma _ { d } ( { \mathbf r } ) = \frac { e ^ { - \lambda _ { d } L ( { \mathbf r } ) } } { \sum _ { { \mathbf r } \in X } e ^ { - \lambda _ { d } L ( { \mathbf r } ) } },$$

where σ d ( r ) is the probability of defender choosing investment profile r ∈ X , and λ d represents the rationality level of the defender. Note that L ( r ) is the expected loss of defender when choosing investment strategy r which is given by (1). Here, the probability σ d ( r ) of defender choosing security investment profile r increases if the defender's expected loss L ( r ) decreases under that r .

Attacker's Quantal Response: After observing the defender's investment, the attacker chooses the site with maximum loss to put its effort. The attacker action (which site to attack after observing defender's investments) would be chosen according to the following probability distributions

$$\sigma _ { a } ( \mathbf y ) = \frac { e ^ { - \lambda _ { a } U ( \mathbf y ) } } { \sum _ { \mathbf y \in Y } e ^ { - \lambda _ { a } U ( \mathbf y ) } },$$

where σ a ( y ) is the probability of attacker choosing attack profile y ∈ Y , where Y := { (1 , 0) (0 , , 1) } with the first strategy denoting attacking site 1 and the second strategy denoting attacking site 2 , and λ a represents the rationality level of the attacker. Thus, we denote the vectors of probabilities of choosing defense and attack strategies by σ d and σ a , respectively. Based on such quantal responses, our search seeks to find fixed strategies to achieve quantal response equilibrium ( σ ∗ d , σ ∗ a ) as in mean field theory [8].

In our evaluation, we show the effects of the non-negative parameters λ i , i ∈ { a, d } which represent the rationality level of the player. When λ i → 0 , the player becomes 'completely non-rational (behavioral)' and chooses each investment profile with equal probability. As λ i → ∞ , players become 'perfectly rational' and the game approaches a Pure-strategy Nash equilibrium (PNE).

## B. Existence of a QRE

We first establish the existence of a QRE for the class of sequential attacker-defender game defined in Section III. Recall that the vector σ d represents the likelihoods of selecting each security investment profile by the defender. These likelihoods are determined by the defender's quantal response function (3), which describes how sensitive defender is to the differences in expected loss between different defense investment strategies. Similarly, the vector σ a represents the likelihoods of selecting each attack strategy by the attacker. These likelihoods are determined by the attacker's quantal response function (4). This motivates showing the existence of QRE in our setup in Section III.

Proposition 2: Suppose the quantal response function for the defender is given by (3) and the quantal response function for the attacker is given by (4). Suppose that the probability of successful attack p i ( ) · has p ′ i &lt; 0 and p ′′ i &gt; 0 for every site i . Then, our sequential security game possesses a QRE when λ d ∈ [0 , ∞ ) and λ a ∈ [0 , ∞ ) .

Proof: Since λ d ∈ [0 , ∞ ) and λ a ∈ [0 , ∞ ) and p ′ i &lt; 0 and p ′′ i &gt; 0 for each site i , thus the logit quantal response functions in (3) and (4) are interior, continuous, monotonic, and responsive [19]. Therefore, they are regular quantal response functions [19]. As a result, the sequential security game considered in our work possesses a quantal response equilibrium (QRE) [20].

Having defined our setup and proved the existence of QRE in our defender-attacker sequential games, we next show the main properties that arise under QRE.

## IV. MAIN PROPERTIES OF QRE

In this section, we focus only on the properties of quantal behavioral decision-making by the defender in order to better understand its impact on the game, and leave the consideration of a behavioral attacker for future work.

## A. Effect of Behavioral Level λ

We start by analyzing the effect of behavioral parameter ( λ d for defender). In particular, we show the effect of λ d on the best defense strategy r ∗ for the defender.

Proposition 3: Suppose that the expected loss of the defender L ( r ) is given by (1) and that the quantal response function for the defender is given by (3). Let the defender's best strategy be given by r ∗ . Then, the probability of choosing the best investment strategy r ∗ (denoted by σ ( r ∗ ) ) is non-decreasing in λ d , where λ d is the quantal behavioral level of the defender.

Proof: To find the relationship between the probability of choosing defender's best investment profile r ∗ , given by σ ( r ∗ ) , and the behavioral level of the defender λ d , we need to find the partial derivative of σ ( r ∗ ) with respect to λ d .

$$\varkappa \ p a u a u e v a u v e o n \, \varkappa ( 1 ) \, \text{ with express} \\ \frac { \partial \sigma ( \mathbf r ^ { * } ) } { \partial \lambda _ { d } } & = \frac { \partial } { \partial \lambda } \frac { e ^ { - \lambda _ { d } L ( \mathbf r ^ { * } ) } } { \sum _ { \mathbf r \in X } e ^ { - \lambda _ { d } L ( \mathbf r ) } } \\ & = \frac { A - B } { \left ( \sum _ { \mathbf r \in X } e ^ { - \lambda _ { d } L ( \mathbf r ) } \right ) ^ { 2 } },$$

$$A = \left ( \sum _ { \mathbf r \in X } e ^ { - \lambda _ { d } L ( \mathbf r ) } \right ) \times \frac { \partial } { \partial \lambda } e ^ { - \lambda _ { d } L ( \mathbf r ^ { * } ) },$$

and

$$B = e ^ { - \lambda _ { d } L ( { \mathbf r } ^ { * } ) } \times \frac { \partial } { \partial \lambda } ( \sum _ { { \mathbf r } \in X } e ^ { - \lambda _ { d } L ( { \mathbf r } ^ { * } ) } ).$$

Thus, doing the differentiation, we have A -B given as follows

$$\Gamma _ { \ } u s, \, \text{using use unreferencing} \, \text{, we have } A - D \, \text{given as} \\ \Gamma _ { \ } f o l w s \\ A - B & = - L ( \mathbf r ^ { * } ) \times \left ( \sum _ { \mathbf r \in X } e ^ { - \lambda _ { d } L ( \mathbf r ) } \right ) \times e ^ { - \lambda _ { d } L ( \mathbf r ^ { * } ) } \\ & - e ^ { - \lambda _ { d } L ( \mathbf r ^ { * } ) } \times \left ( \sum _ { \mathbf r \in X } ( - L ( \mathbf r ) ) \cdot e ^ { - \lambda _ { d } L ( \mathbf r ) } \right ) \\ & = e ^ { - \lambda _ { d } L ( \mathbf r ^ { * } ) } \times \sum _ { \mathbf r \in X } ( L ( \mathbf r ) - L ( \mathbf r ^ { * } ) ). \\ \Gamma _ { \ } f o l w s \quad \text{that} \quad \text{and} \quad \partial \sigma ( \mathbf r ^ { * } ) \quad \text{and} \quad \text{has} \quad \text{given}$$

Therefore, the derivative ∂ σ ( r ∗ ) ∂λ d would be given by

$$\frac { \partial \sigma ( { \mathbf r } ^ { * } ) } { \partial \lambda _ { d } } = \frac { e ^ { - \lambda _ { d } L ( { \mathbf r } ^ { * } ) } \times \sum _ { { \mathbf r } \in X } ^ { \nu _ { \lambda _ { d } } } ( L ( { \mathbf r } ) - L ( { \mathbf r } ^ { * } ) ) } { \left ( \sum _ { { \mathbf r } \in X } e ^ { - \lambda _ { d } L ( { \mathbf r } ) } \right ) ^ { 2 } }. \quad ( 5 )$$

Note that the exponential parts of the derivative in (5) is always positive, hence the sign of the derivative in (5) depends on the term L ( r ) -L ( r ∗ ) . Since r ∗ is the defender's best strategy, then the expected loss of the defender when choosing strategy r ∗ , given by L ( r ∗ ) , is always less then or equal that under any other investment strategy of the defender. In other words, we have L ( r ) ≥ L ( r ∗ ) ∀ r ∈ X . Thus, the numerator of (5) is always non-negative. Since the denominator is always positive (summation of exponential terms), we have ∂ σ ( r ∗ ) ∂λ d ≥ 0 . This concludes the proof.

In words, Proposition 3 shows that the defender's QRE probability of choosing the best investment strategy r ∗ is non-decreasing in the quantal behavioral level of the defender λ d . This shows that the defender would choose the best investment strategy with higher probability when her quantal behavioral level decreases (i.e., λ d increases).

## B. Effect of Loss on QRE

We now characterize the impact of the sites' losses on the defender's investments in each of the two sites. In particular, we show the effect of loss parameter A on choosing the best strategy in the QRE by the defender. In order to keep the exposition clear, we will make the following assumption on the probabilities and site loss values for the defender (this assumption rules out the two corner cases where a defender invests entirely in only one of the two sites under her control). This assumption was also considered in [6].

Assumption 1: The quantities p 1 ( r ) and Ap 2 ( R -r ) are such that p 1 (0) &gt; Ap 2 ( R ) and p 1 ( R &lt; Ap ) 2 (0) , i.e., there is a unique quantity r ∗ such that p 1 ( r ∗ ) = Ap 2 ( R -r ∗ ) .

Proposition 4: Under Assumption 1, suppose that the defender's best strategy is given by r ∗ = [ r ∗ , R -r ∗ ] . Let p 1 ( r ) = e -r and p 2 ( r ) = e -( R -r ) , respectively. Suppose that any other feasible defense strategy be given by ˆ r ∈ X -{ r ∗ } . Thus, we have the following cases.

- i) If p 1 (ˆ) r &gt; Ap 2 ( R -ˆ) r ∀ ˆ r ∈ X -{ r ∗ } . Suppose that there are two possible values for the loss A at site 2 , given by A 1 and A 2 where A 1 &lt; A 2 , then we have σ ( r ∗ ) | A 1 &gt; σ ( r ∗ ) | A 2 .
- ii) If p 1 (ˆ) r &lt; Ap 2 ( R -ˆ) r ∀ ˆ r ∈ X -{ r ∗ } , then we have ∂ σ ( r ∗ ) ∂A &gt; 0 .

Proof: We analyze the effect of loss A , by calculating the difference between σ ( r ∗ ) | A 1 and σ ( r ∗ ) | A 2 for the all different cases of the proposition. We begin with case (i):

$$\text{different cases of the proposition. We begin with case (1):} \\ \sigma ( r ^ { * } ) | _ { A _ { 1 } } & = \frac { e ^ { - \lambda _ { d } L ( r ^ { * } ) } } { \sum _ { r \in X } e ^ { - \lambda _ { d } L ( r ) } } \\ & \overset { ( a ) } { = } \frac { e ^ { - \lambda _ { d } A _ { 1 } p _ { 2 } ( R - r ^ { * } ) } } { e ^ { - \lambda _ { d } A _ { 1 } p _ { 2 } ( R - r ^ { * } ) } + \sum _ { \tilde { r } \in X - \{ r ^ { * } \} } e ^ { - \lambda _ { d } p _ { 1 } ( \tilde { r } ) } } \quad \text{ Thus,} \\ & \overset { ( b ) } { = } \frac { e ^ { - \lambda _ { d } A _ { 1 } e ^ { - \left ( \frac { - \log ( A _ { 1 } ) + R } { 2 } \right ) } } } { e ^ { - \lambda _ { d } A _ { 1 } e ^ { - \left ( \frac { - \log ( A _ { 1 } ) + R } { 2 } \right ) } } + \sum _ { \tilde { r } \in X - \{ r ^ { * } \} } e ^ { - \lambda _ { d } p _ { 1 } ( \tilde { r } ) } }. \quad \frac { \partial \sigma ( r } { \partial A } } \\ \text{L^^{\epsilon} \times \text{ that } \lambda \times \text{ } \lambda \times \text{ } \lambda \times \text{ } \lambda \times \text{ } \lambda \times \text{ } \lambda \times \text{ } \lambda \times \text{ } \lambda \times \text{ }$$

Note that (a) holds since p 1 ( r ∗ ) = Ap 2 ( R -r ∗ ) and p 1 (ˆ) r &gt; Ap 2 ( R -ˆ) r ∀ ˆ r ∈ X - { r ∗ } , and (b) holds from r ∗ given by Corollary 1 (since p 1 ( r ∗ ) = Ap 2 ( R -r ∗ ) and from substituting p 2 ( r ) from the proposition statement).

Similarly, σ ( r ∗ ) | A 2 would be

$$\sigma ( \mathbf r ^ { * } ) | _ { A _ { 2 } } = \frac { e ^ { - \lambda _ { d } A _ { 2 } e ^ { - \left ( \frac { - \log ( A _ { 2 } ) + R } { 2 } \right ) } } } { e ^ { - \lambda _ { d } A _ { 2 } e ^ { - \left ( \frac { - \log ( A _ { 2 } ) + R } { 2 } \right ) } } } + \sum _ { \mathbf r \in X - \{ \mathbf r ^ { * } \} } e ^ { - \lambda _ { d } p _ { 1 } ( \hat { r } ) } }.$$

Now, subtracting σ ( r ∗ ) | A 1 and σ ( r ∗ ) | A 2 would yield

$$\sigma ( { \mathbf r } ^ { * } ) | _ { A _ { 1 } } - \sigma ( { \mathbf r } ^ { * } ) | _ { A _ { 2 } } = \frac { B - C } { D },$$

where

$$B - C & = \sum _ { \mathfrak { r } \in X - \{ \mathbf r ^ { * } \} } e ^ { - \lambda _ { d } p _ { 1 } ( \mathfrak { r } ) } \times \left ( e ^ { - \lambda _ { d } A _ { 1 } e ^ { - \left ( \frac { - \log ( A _ { 2 } ) + R } { 2 } \right ) } } \right ) \quad \text{$\min$} \\ & - e ^ { - \lambda _ { d } A _ { 2 } e ^ { - \left ( \frac { - \log ( A _ { 2 } ) + R } { 2 } \right ) } } \right ), \text{ and}$$

$$D & = \left ( e ^ { - \lambda _ { d } A _ { 1 } e ^ { - \left ( \frac { - \log ( A _ { 1 } ) + R } { 2 } \right ) } } + \sum _ { \hat { r } \in X - \{ r ^ { * } \} } e ^ { - \lambda _ { d } p _ { 1 } ( \hat { r } ) } \right ) \quad \text{Note t} \\ & \times \left ( e ^ { - \lambda _ { d } A _ { 2 } e ^ { - \left ( \frac { - \log ( A _ { 2 } ) + R } { 2 } \right ) } } + \sum _ { \hat { r } \in X - \{ r ^ { * } \} } e ^ { - \lambda _ { d } p _ { 1 } ( \hat { r } ) } \right ). \quad \frac { \partial } { \partial A }$$

Note that D is always positive (since it is multiplication of two terms, with each term being composed of summation of several exponential terms). Now, we check the term B -C .

$$\mathfrak { e } \, \text{that} \quad \text{several exponential terms} \,. \, Now, \, we \, \text{check the term } B - C. \\ \mathfrak { s } \, \text{ite} \, 2, \quad \text{$A_{1} < A_{2}$} \, \Longleftrightarrow \, \log ( A _ { 1 } ) < \log ( A _ { 2 } ) \\ \Longleftrightarrow \, - \, \log ( A _ { 1 } ) > - \log ( A _ { 2 } ) \\ \Longleftrightarrow \, R - \log ( A _ { 1 } ) > R - \log ( A _ { 2 } ) \\ \quad \Longleftrightarrow \, - \, \left ( \frac { R - \log ( A _ { 1 } ) } { 2 } \right ) < - \, \left ( \frac { R - \log ( A _ { 2 } ) } { 2 } \right ) \\ \text{lating} \quad \Longleftrightarrow \, A _ { 1 } e ^ { - \left ( \frac { - \log ( A _ { 1 } ) + R } { 2 } \right ) < A _ { 2 } e ^ { - \left ( \frac { - \log ( A _ { 2 } ) + R } { 2 } \right ) } } \\ \mathfrak { e } \, ( i ) \colon \quad \Longleftrightarrow \, e ^ { - \lambda _ { d } A _ { 1 } e ^ { - \left ( \frac { - \log ( A _ { 1 } ) + R } { 2 } \right ) } } \\ \quad \ > \, e ^ { - \lambda _ { d } A _ { 2 } e ^ { - \left ( \frac { - \log ( A _ { 2 } ) + R } { 2 } \right ) } }. \\ \quad \text{ Thus, we have } B - C > 0. \, \text{Thus, $\sigma(r^{*})|_{A_{1} -\sigma(r^{*})|_{A_{2} > 0},$},}$$

Thus, we have B -C &gt; 0 . Thus, σ ( r ∗ ) | A 1 -σ ( r ∗ ) | A 2 &gt; 0 , which concludes the case (i).

Case (ii): We do this case by differentiating σ ( r ∗ ) with respect to A as follows.

$$\underset { \tau _ { 1 } ( \tilde { r } ) } { \text{respect to $A$ as follows.} } \underset { \frac { \partial \sigma ( \tilde { r } ^ { * } ) } { \partial A } } & = \frac { \partial } { \partial A } \frac { e ^ { - \lambda _ { d } L ( \tilde { r } ^ { * } ) } } { \sum _ { \tau _ { 1 } X } e ^ { - \lambda _ { d } L ( \tilde { r } ) } } \\ & \overset { ( c ) } { = } \frac { \partial } { \partial A } \frac { e ^ { - \lambda _ { d } A p _ { 2 } ( R - r ^ { * } ) } } { e ^ { - \lambda _ { d } A _ { 1 } p _ { 2 } ( R - r ^ { * } ) } } + \underset { \tilde { r } \in X - \{ \tilde { r } ^ { * } \} } { \sum _ { \tilde { r } \in X - \{ \tilde { r } ^ { * } \} } } e ^ { - \lambda _ { d } A p _ { 2 } ( R - \tilde { r } ) } } \\ \text{$\text{and} } \\ \text{$f$}.$$

Note that (c) holds since p 1 ( r ∗ ) = Ap 2 ( R -r ∗ ) and p 1 (ˆ) r &lt; Ap 2 ( R -ˆ) r ∀ ˆ r ∈ X -{ r ∗ } . Now, we give the expressions for E F , , and G , which are given as follows.

$$\text{for $E$, $F$, and $G$, which are given as follows.} \\ E & = \left ( e ^ { - \lambda _ { d } A p _ { 2 } ( R - r ^ { * } ) } + \sum _ { \hat { r } \in X - \{ r ^ { * } \} } e ^ { - \lambda _ { d } A p _ { 2 } ( R - \hat { r } ) } \right ) \\ & \times \frac { \partial } { \partial A } e ^ { - \lambda _ { d } A p _ { 2 } ( R - r ^ { * } ) }, \\ F & = e ^ { - \lambda _ { d } A p _ { 2 } ( R - r ^ { * } ) } \frac { \partial } { \partial A } \left ( e ^ { - \lambda _ { d } A p _ { 2 } ( R - r ^ { * } ) } \\ &. \quad \bigtriangledown \quad _ { - \lambda _ { d } A p _ { 2 } ( R - \hat { r } ) } \right )$$

$$+ \sum _ { \hat { r } \in X - \{ { \mathbf r } ^ { * } \} } e ^ { - \lambda _ { d } A p _ { 2 } ( R - \hat { r } ) } \Big ),$$

$$\text{and } G _ { \dots } = \left ( e ^ { - \lambda _ { d } A p _ { 2 } ( R - r ^ { * } ) } _ { \dots } + \sum _ { \hat { r } \in X - \{ r ^ { * } \} } e ^ { - \lambda _ { d } A p _ { 2 } ( R - \hat { r } ) } \right ) ^ { 2 }.$$

.

Since the denominator G is always positive, we explore the numerator part E -F to check its sign as follows.

$$\div ) \quad & \text{numerator part $E-r$ to check $us$ sign as follows.} \\ E - F & = \left ( \sum _ { \hat { r } \in X - \{ r ^ { * } \} } e ^ { - \lambda _ { d } A p _ { 2 } ( R - \hat { r } ) } \right ) \frac { \partial } { \partial A } e ^ { - \lambda _ { d } A p _ { 2 } ( R - r ^ { * } ) } \\ ( \hat { r } ) \right ) \quad & - e ^ { - \lambda _ { d } A p _ { 2 } ( R - r ^ { * } ) } \frac { \partial } { \partial A } \left ( \sum _ { \hat { r } \in X - \{ r ^ { * } \} } e ^ { - \lambda _ { d } A p _ { 2 } ( R - \hat { r } ) } \right ).$$

Note that

$$\Big { ) } \cdot \quad \frac { \partial } { \partial A } e ^ { - \lambda _ { d } A p _ { 2 } ( R - r ^ { * } ) } & = \Big { ( } p _ { 2 } ( R - r ^ { * } ) + A \frac { \partial p _ { 2 } ( R - r ^ { * } ) } { \partial A } \Big { ) } \\ & \times e ^ { - \lambda _ { d } A p _ { 2 } ( R - r ^ { * } ) } \times \Big { ( } - \lambda _ { d } \Big { ) } \\ \intertext { n o f } \, \underbrace { \stackrel { ( d ) } { = } } - \lambda _ { d } \frac { p _ { 2 } ( R - r ^ { * } ) } { 2 } e ^ { - \lambda _ { d } A p _ { 2 } ( R - r ^ { * } ) }.$$

Note that (d) holds since the differentiating ∂p 2 ( R -r ∗ ) ∂A would be given by ∂p 2 ( R -r ∗ ) ∂A = -p 2 ( R -r ∗ ) 2 A (using the equality p 1 ( r ∗ ) = A p 2 ( R -r ∗ ) in Assumption 1 and r ∗ from Corollary 1). Moreover, we have

$$\frac { \partial } { \partial A } & \left ( \sum _ { \hat { r } \in X - \{ r ^ { * } \} } e ^ { - \lambda _ { d } A p _ { 2 } ( R - \hat { r } ) } \right ) \\ & = - \sum _ { \hat { r } \in X - \{ r ^ { * } \} } \lambda _ { d } p _ { 2 } ( R - \hat { r } ) e ^ { - \lambda _ { d } A p _ { 2 } ( R - \hat { r } ) }. \\ \text{Subtinct with the above two terms in $E$ - $E$ was have}$$

Substituting with the above two terms in E -F , we have

$$& \text{$row_counting $p$} \, \text{$num_on_avo$} \, \text{$row_counting $m$} \, \text{$x$} \,, \, \text{$y$} \, \text{$row_counting $p$} \, \text{$num_on_avo$} \, \text{$x$} \,, \, \text{$y$} \, \text{$row_counting $p$} \, \text{$num_on_avo$} \, \text{$x$} \,, \, \text{$y$} \, \text{$row_counting $p$} \, \text{$num_on_avo$} \, \text{$x$} \,, \, \text{$y$} \, \text{$row_counting $p$} \, \text{$num_on_avo$} \, \text{$x$} \,, \, \text{$y$} \, \text{$row_counting $p$} \, \text{$num_on_avo$} \} \text{$x$} \,, \, \text{$y$} \, \text{$row_counting $p$} \, \text{$num_on_avo$} \, \text{$x$} \,, \, \text{$y$} \, \text{$row_counting $p$} \, \text{$num_on_avo$} \, \text{$x$} \,, \, \text{$y$} \, \text{$row_counting $p$} \, \text{$num_on_avo$} \, \text{$x$} \,, \, \text{$y$} \, \text{$row_counting $p$} \, \text{$num_on_avo$} \, \text{ $x$} \,, \, \text{$y$} \, \text{$row_counting $p$} \, \text{$num_on_avo$} \, \text{$x$} \,, \, \text{$y$} \, \text{$row_counting $p$} \, \text{$num_on_avo$} \, \text{$x$} \,, \, \text{$y$} \, \text{$row_counting $p$} \, \text{$num_on_avo$} \, \text{$x$} \,, \, \text{$y$} \, \text{$row_counting $p$} \, \text{$num_on_avo$} \, \text{$x$} \\ & E - F = \lambda _ { d } e ^ { - \lambda _ { d } A p _ { 2 } ( R - r ^ { * } ) } } & \text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text	$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text#$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text$$\text$$\text$$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text	$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$	\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\tt$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$
$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$}\} } } \text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$} } } \text{$\text{$\text{$\text{$\text{$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$}\} } \text{$\text{$\text{$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$.} } } \text{$\text{$\text{$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$}\} } \text{$\text{$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\text$\$$

Note that the exponential terms and λ d in equation (6) are always positive. Hence, the sign of the derivative ∂ σ ( r ∗ ) ∂A depends on the term p 2 ( R -ˆ) r -p 2 ( R -r ∗ ) 2 . Since r ∗ is the defender's unique best strategy in the QRE (by Assumption 1), the probability of successful attack for QRE strategy r ∗ is always less than the probability of successful attack for any other strategy ˆ r for the defender. Hence, we have

$$\stackrel { \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots, \dots } } { p _ { 2 } ( R - \hat { r } ) > p _ { 2 } ( R - r ^ { * } ) } \iff p _ { 2 } ( R - \hat { r } ) > \frac { p _ { 2 } ( R - r ^ { * } ) } { 2 }. \quad \lambda _ { d } \in \real \\ \text{Thus, we have } E - F > 0, \text{ which yields that } \frac { \partial \sigma ( \mathbf r ^ { * } ) } { \partial A } > 0. \quad \lambda _ { d } \in \real \\ \text{While, we have } E - F > 0, \text{ which yields that } \frac { \partial \sigma ( \mathbf r ^ { * } ) } { \partial A } > 0. \quad \lambda _ { d } \in \real$$

Proposition 4 shows that the defender's choice of the best strategy at the quantal response equilibrium increases with the increase of the loss of the second site A when p 1 (ˆ) r &lt; Ap 2 ( R -ˆ) r , where ˆ r are all the strategies except the optimal strategy (i.e., when other strategies under-invest defense budget on site 2). On the other hand, it decreases with the loss of the second site A if p 1 (ˆ) r &gt; Ap 2 ( R -ˆ) r (i.e., when other strategies over-invest budget on site 2).

## V. MEASURING INEFFICIENCY OF QRE: THE PRICE OF QUANTAL RESPONSE

The notion of Price of Anarchy (PoA) is commonly utilized to assess the inefficiencies of a Nash equilibrium when compared to the socially optimal outcome [21]. In our context, we aim to establish a metric that accounts for inefficiencies in the equilibrium resulting from the individual strategic behaviors of defender and its behavioral decision-making characterized by quantal errors. Therefore, we introduce the concept of Price of Quantal Anarchy (PoQA), which quantifies the ratio of the total expected cost of the defender when considering defender's behavioral choices at the quantal response equilibrium in comparison to the minimum possible loss of the non-behavioral defender (that always chooses optimal defense strategy).

Specifically, we define L ( r ∗ ) ≜ Minimum r ∈ X L ( r ) , where L ( r ∗ ) (where L ( ) · is defined in (1)) is the minimum loss suffered by defender under optimal investment vector r ∗ . Let

X QRE denotes the set of all possible investments at QRE for the defender. We now define the Price of Quantal Anarchy as

$$P o Q A = \frac { \sum _ { \mathbf r \in X ^ { \text{qR} } } \sigma ( \mathbf r ) L ( \mathbf r ) } { L ( \mathbf r ^ { * } ) },$$

where each expected loss L ( r ) for defender in the numerator under investment profile r ∈ X QRE is weighted with the probability σ ( r ) of choosing that investment profile, and r ∗ = [ r ∗ , R -r ∗ ] with r ∗ = min r ∈ [0 ,R ] max { p 1 ( r , Ap ) 2 ( R -r ) } is the optimal investment profile that yields the minimum expected loss of the rational defender. In our evaluation, we also refer to the PoQA as the 'inefficiency' of the QRE.

## A. Bounds on the PoQA

We now establish an upper bound on the PoQA. In particular, we show that the PoQA is bounded if the total budget is bounded (regardless of the defenders' behavioral level λ d ). We show such bound with the following proposition.

Proposition 5: Let the budget available to the defender be R , and let the probability of successful attack on sites 1 and 2 be given by p 1 ( r ) = e -r and p 2 ( r ) = e -( R -r ) , respectively. Let X QRE denotes the set of all possible investments at QRE for the defender. Then, for any A and any behavioral level λ d ∈ [0 , ∞ ) , PoQA ≤ max { A, 1 A }| X QRE | exp( R ) .

Proof: Starting with the PoQA equation in (7), we have

$$f \colon & \text{ Starting with the PoQA equation in } ( 7, \\ & P o Q A = \frac { \sum _ { r \in X ^ { \Omega \mathbb { R } } } \sigma ( r ) L ( r ) } { L ( r ^ { * } ) }, \\ & \stackrel { ( a ) } { \leq } \frac { \sum _ { r \in X ^ { \Omega \mathbb { R } } } L ( r ) } { L ( r ^ { * } ) } \\ & \stackrel { ( b ) } { \leq } \frac { | X ^ { \Omega \mathbb { R } } | \times L ( \hat { r } ) } { L ( r ^ { * } ) }, \\ \hat { r } \wr \overset { \triangle } { \, \triangle } \ \max \ \text{ } L ( r ) \ \text{ Note that } ( a ) \ \text{ holds}$$

where L ( ˆ r ) ≜ max r ∈ X QRE L ( r ) . Note that (a) holds since the probability of choosing investment profile r is upper bounded by 1 , i.e., σ ( r ) ∈ (0 , 1] , and that ( b ) holds from the definition of L ( ˆ r ) , which is the worst case defender's loss.

Now, substituting from (1) into the above bound, we have

$$P o Q A \leq \frac { | X ^ { \text{QRE} } | \times \max \left \{ p _ { 1 } ( \hat { r } ), A p _ { 2 } ( R - \hat { r } ) \right \} } { \max \left \{ p _ { 1 } ( r ^ { * } ), A p _ { 2 } ( R - r ^ { * } ) \right \} }.$$

Note that e -R ≤ p 1 ( r ) ≤ 1 and e -R ≤ p 2 ( r ) ≤ 1 from the proposition statement. We thus consider the following four possible sub-cases as follows.

i) If p 1 (ˆ) r &gt; Ap 2 ( R -ˆ) r and p 1 ( r ∗ ) &gt; Ap 2 ( R -r ∗ ) , then we have

$$\ w c { \ m a v c } P o Q A & \leq \frac { | X ^ { Q R E } | \times p _ { 1 } ( \hat { r } ) } { p _ { 1 } ( r ^ { * } ) } \\ & \stackrel { ( c ) } { = } \frac { | X ^ { Q R E } | \times \exp ( - \hat { r } ) } { \exp ( - r ^ { * } ) } \stackrel { ( d ) } { \leq } | X ^ { Q R E } | \exp ( R ). \\ \tau \dots \dots \times \infty \colon c \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \dots \end{array}$$

Note that (c) holds from the proposition statement and (d) holds since the numerator is upper bounded by | X QRE | and the denominator is lower bounded by e -R .

ii) If p 1 (ˆ) r ≤ Ap 2 ( R -ˆ) r and p 1 ( r ∗ ) ≤ Ap 2 ( R -r ∗ ) , then we have

$$P o Q A \leq & \frac { | X ^ { \text{QRE} } | \times A p _ { 2 } ( R - \hat { r } ) } { A p _ { 2 } ( R - r ^ { * } ) } \\ & = \frac { | X ^ { \text{QRE} } | A \exp ( - R + \hat { r } ) } { A \exp ( - R + r ^ { * } ) } \leq | X ^ { \text{QRE} } | \exp ( R ). \\ \dots \, - \, - \, \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar{ \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar { \ } \bar$$

iii) If p 1 (ˆ) r &gt; Ap 2 ( R -ˆ) r and p 1 ( r ∗ ) ≤ Ap 2 ( R -r ∗ ) , then we have

$$\text{under the max} \\ P o Q A \leq & \frac { | X ^ { \text{QRE} } | \times p _ { 1 } ( \hat { r } ) } { A p _ { 2 } ( R - r ^ { * } ) } \\ = & \frac { | X ^ { \text{QRE} } | \exp ( - \hat { r } ) } { A \exp ( - R + r ^ { * } ) } \, \stackrel { ( e ) } { \leq } \frac { | X ^ { \text{QRE} } | \exp ( R ) } { A }. \\ \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots.$$

Note that (e) holds since the numerator is upper bounded by | X QRE | and the denominator is lower bounded by Ae -R . iv) If p 1 (ˆ) r ≤ Ap 2 ( R -ˆ) r and p 1 ( r ∗ ) &gt; Ap 2 ( R -r ∗ ) , then we have

$$P o Q A \leq & \frac { A \times | X ^ { \text{QRE} } | \times p _ { 2 } ( R - \hat { r } ) } { p _ { 1 } ( r ^ { * } ) } \quad \begin{array} { c } & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & \\ & = \frac { A | X ^ { \text{QRE} } | \exp ( - R + \hat { r } ) } { \exp ( - r ^ { * } ) } & \leq & & A | X ^ { \text{QRE} } | \exp ( R ). \quad & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & &  & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & && & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & &
 & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & \ & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & - & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & ; & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & } & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & &   & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & &  \ & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & &  ; & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & . \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ { \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ } { \ } }$$

Similarly, (f) holds since the numerator is upper bounded by A X | QRE | and the denominator is lower bounded by e -R . In all of the possible scenarios (as shown above), PoQA ≤ max { A, 1 }| X QRE | exp( R ) , which concludes the proof.

A

Now, we illustrate our characterizations of the impacts of quantal decision-making via numerical simulations.

## VI. NUMERICAL SIMULATIONS

In this section, we show our main numerical simulation results for our defender-attacker sequential game described in Section II and the QRE setup described in Section III.

## A. Experimental Setup

For our simulations, we consider three different defense strategy spaces (shown in Table I) which are chosen such that r 3 remains the defender's best strategy for all spaces. These defense strategy spaces are chosen such that it can help in illustrating our theoretical results of our quantal response analysis. 1 We consider the sequential game with a behavioral defender and a non-behavioral attacker. We let the probability of successful attack on sites 1 and 2 be given by p 1 ( r ) = e -r and p 2 ( r ) = e -( R -r ) , respectively, where r is the investment on site 1 . For the defender, the first site has a unit loss while second site has a loss of A when compromised. We let the total defense budget for defending the two sites be R = 10 . Thus, r 3 is the optimal strategy for each of the spaces hence p 1 ( r 3 ) = Ap 2 ( R -r 3 ) . We consider spaces A and B such that, except for the optimal strategy r 3 , the condition p 1 ( r i ) &gt; Ap 2 ( R -r i ) holds in space A, while in space B, p 1 ( r i ) &lt; Ap 2 ( R -r i ) . Finally, defense strategy space C includes investment strategies satisfying conditions from both spaces A and B, with one optimal strategy emerging when loss A = 1 .

1 Note that all our theoretical results consider the set X of security investment strategies that have all possible feasible allocations.

TABLE I: Three defense strategy spaces in our sequential game setup in Figure 1. Note that A is the loss of site 2.

|          | Space-A      | Space-A    | Space-B      | Space-B    | Space-C   | Space-C   |
|----------|--------------|------------|--------------|------------|-----------|-----------|
| Strategy | Site 1       | Site 2     | Site 1       | Site 2     | Site 1    | Site 2    |
| r 1      | 4            | 6          | 7            | 3          | 10        | 0         |
| r 2      | 2            | 8          | 5.4          | 4.6        | 5.35      | 4.65      |
| r 3      | 10 - log A 2 | 10+log A 2 | 10 - log A 2 | 10+log A 2 | 5         | 5         |
| r 4      | 3.5          | 6.5        | 6.5          | 3.5        | 4.8       | 5.2       |
| r 5      | 0            | 10         | 10           | 0          | 0         | 10        |

## B. Effect of Behavioral Level (Quantal Bias Parameter)

Figure 3 shows the effect of behavioral level λ d = λ on the QRE probability of choosing optimal defense strategy r 3 from the defense strategy space C of Table I. Figure 3 shows that with the increase of λ the QRE probability of the optimal defense strategy also increases which corresponds to our analysis (Proposition 3) in Section IV-A. This shows that a defender tends to choose better defense strategy as her quantal behavioral bias decreases (i.e., λ increases). Also, it is evident from Figure 3 that the QRE probability of choosing strategy r 3 approaches to one for higher λ for symmetrical losses of two sites ( A = 1 ), i.e., approaching the PNE.

## C. Effect of Loss Values of Sites

Figure 4 illustrates the effect of increasing losses ∀ A &gt; 0 . We plot the left and right subplots of Figure 4 using the defense strategy spaces A and B (from Table I), respectively. The left subplot of Figure 4 shows that for the same behavioral level (same λ ) the QRE probability of choosing the optimal strategy is decreasing when increasing the loss A . This result corresponds to the case-i of Proposition 4. The right subplot of Figure 4 illustrates the different relationship between loss and QRE probability of choosing the optimal strategy where the QRE probability is higher for higher loss A . This result of right subplot of Figure 4 is also consistent with the case-ii of Proposition 4.

## D. Inefficiency of Quantal Response (PoQA)

Figure 5 shows the logarithm of the value of the PoQA metric (given by (7)) to measure the inefficiency due to behavioral defender with quantal errors, compared to the investments of a rational defender. Here, we vary λ for the defender from 10 (highly behavioral) to 10,000 (almost rational) for different loss values of site 2 ( A = 0 5 . , A = 1 , and A = 1 5 . ). Figure 5 shows that the inefficiency due to behavioral decision making become worst when A = 0 5 . . This is consistent with our finding in Proposition 5 (recall the term max { A, 1 A } in the upper bound). This term is highest for A = 0 5 . among all three illustrated loss values. This considerable increase in the PoQA indicates that the behavioral defender's investments are beneficial to the attacker, especially under loss asymmetries (i.e., one site is more valuable to the defender). This will lead eventually to higher expected loss to the defender when attacked.

## VII. CONCLUSION

In this paper, we analyzed a sequential defender-attacker game dynamics through a quantal response analysis, where

Fig. 3: Effect of behavioral level λ on the defender's QRE probability of choosing the optimal strategy. In this case, we use defense strategy space C where the loss A = 1 .

![image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00964v1-figure-0086c29a-27d9-4b6f-b0f0-09d52f67e1fd.jpg)

Fig. 4: QRE probabilities of defender's optimal strategy under different losses and strategy spaces. Left and right subplots use defense strategy spaces A and B, respectively.

![image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00964v1-figure-2d3c0273-e877-4ba1-adb0-ee34db959c87.jpg)

the defender exhibits quantal behavioral bias in investment decision. We demonstrated that as the defender's quantal behavioral bias increases, the probability of choosing the most efficient investment decreases, resulting in higher expected losses for defender and consequently higher expected gain for attacker. We showed how the sites' loss values influence the defender's choice of optimal defense investment under quantal bias. We quantified the inefficiency from quantal decision-making via introducing a metric, named the Price of Quantal Anarchy, to capture this inefficiency. We provided bounds for that metric. Our theoretical findings were confirmed through numerical simulations. Future work could extend this framework to scenarios with more sites and investigate the dynamics between non-behavioral defenders and behavioral attackers.

## REFERENCES

- [1] A. Humayed, J. Lin, F. Li, and B. Luo, 'Cyber-physical systems security - a survey,' IEEE Internet of Things Journal , vol. 4, no. 6, pp. 1802-1831, 2017.
- [2] A. Laszka, M. Felegyhazi, and L. Buttyan, 'A survey of interdependent information security games,' ACM Computing Surveys (CSUR) , vol. 47, no. 2, p. 23, 2015.
- [3] T. Alpcan and T. Bas ¸ar, Network security: A decision and game-theoretic approach . Cambridge University Press, 2010.

![image](https://ac.marcodsn.me/arxiv-markdown-images/2408.00964v1-figure-11cce24b-a760-47d7-aaae-5c137d70c945.jpg)

Loss for Site 2

Fig. 5: The inefficiency (PoQA) of behavioral defender with different behavioral levels and different losses. We show the log( PoQA ) for better readability.

- [4] S. Farrow, 'The economics of homeland security expenditures: Foundational expected cost-effectiveness approaches,' Contemporary Economic Policy , vol. 25, no. 1, pp. 14-26, 2007.
- [5] P. Guan, M. He, J. Zhuang, and S. C. Hora, 'Modeling a multitarget attacker-defender game with budget constraints,' Decision Analysis , vol. 14, no. 2, pp. 87-107, 2017.
- [6] R. Powell, 'Allocating defensive resources with private information about vulnerability,' American Political Science Review , vol. 101, no. 4, pp. 799-809, 2007.
- [7] S. Dhami, The foundations of behavioral economic analysis . Oxford University Press, 2016.
- [8] S. P. Anderson, J. K. Goeree, and C. A. Holt, 'Noisy directional learning and the logit equilibrium,' The Scandinavian Journal of Economics , vol. 106, no. 3, pp. 581-602, 2004.
- [9] Q. Zhuang, Z. Di, and J. Wu, 'Stability of mixed-strategy-based iterative logit quantal response dynamics in game theory,' PLoS One , vol. 9, no. 8, p. e105391, 2014.
- [10] B. J. Morgan, Analysis of quantal response data . CRC Press, 1992.
- [11] R. Anderson and T. Moore, 'Information security economics-and beyond,' in Annual International Cryptology Conference . Springer, 2007, pp. 68-91.
- [12] E. M. Redmiles, M. L. Mazurek, and J. P. Dickerson, 'Dancing pigs or externalities?: Measuring the rationality of security decisions,' in Proceedings of the 2018 ACM Conference on Economics and Computation . ACM, 2018, pp. 215-232.
- [13] M. Baddeley, 'Information security: Lessons from behavioural economics,' in Workshop on the Economics of Information Security , 2011.
- [14] M. Abdallah, P. Naghizadeh, A. R. Hota, T. Cason, S. Bagchi, and S. Sundaram, 'The impacts of behavioral probability weighting on security investments in interdependent systems,' in 2019 American Control Conference (ACC) , July 2019, pp. 5260-5265.
- [15] M. Abdallah, P. Naghizadeh, T. Cason, S. Bagchi, and S. Sundaram, 'Protecting assets with heterogeneous valuations under behavioral probability weighting,' in 2019 IEEE 58th Conference on Decision and Control (CDC) , 2019, pp. 5374-5379.
- [16] A. Sanjab, W. Saad, and T. Bas ¸ar, 'Prospect theory for enhanced cyber-physical security of drone delivery systems: A network interdiction game,' in Communications (ICC), 2017 IEEE International Conference on . IEEE, 2017, pp. 1-6.
- [17] M. Abdallah, T. Cason, S. Bagchi, and S. Sundaram, 'The effect of behavioral probability weighting in a sequential defender-attacker game,' in 2020 59th IEEE Conference on Decision and Control (CDC) . IEEE, 2020, pp. 3255-3260.
- [18] --, 'The effect of behavioral probability weighting in a simultaneous multi-target attacker-defender game,' in 2021 European Control Conference (ECC) , 2021, pp. 933-938.
- [19] J. K. Goeree, C. A. Holt, and T. R. Palfrey, 'Regular quantal response equilibrium,' Experimental economics , vol. 8, pp. 347-367, 2005.
- [20] R. D. McKelvey and T. R. Palfrey, 'Quantal response equilibria for normal form games,' Games and economic behavior , vol. 10, no. 1, pp. 6-38, 1995.
- [21] T. Roughgarden, 'The price of anarchy is independent of the network topology,' Journal of Computer and System Sciences , vol. 67, no. 2, pp. 341-364, 2003.
Md Reya Shad Azim Mustafa Abdallah
A Quantal Response Analysis of Defender-Attacker Sequential Security Games
We explore a scenario involving two sites and a sequential game between a
defender and an attacker, where the defender is responsible for securing the
sites while the attacker aims to attack them. Each site holds a loss value for
the defender when compromised, along with a probability of successful attack.
The defender can reduce these probabilities through security investments at
each site. The attacker's objective is to target the site that maximizes the
expected loss for the defender, taking into account the defender's security
investments. While previous studies have examined security investments in such
scenarios, our work investigates the impact of bounded rationality exhibited by
the defender, as identified in behavioral economics. Specifically, we consider
quantal behavioral bias, where humans make errors in selecting efficient (pure)
strategies. We demonstrate the existence of a quantal response equilibrium in
our sequential game and analyze how this bias affects the defender's choice of
optimal security investments. Additionally, we quantify the inefficiency of
equilibrium investments under quantal decision-making compared to an optimal
solution devoid of behavioral biases. We provide numerical simulations to
validate our main findings.