Penetration testing is regarded as the gold-standard for understanding how well an organization can withstand sophisticated cyber-attacks. However, the recent prevalence of markets specializing in zero-day exploits on the darknet make exploits widely available to potential attackers. The cost associated with these sophisticated kits generally precludes penetration testers from simply obtaining such exploits – so an alternative approach is needed to understand what exploits an attacker will most likely purchase and how to defend against them. In this paper, we introduce a data-driven security game framework to model an attacker and provide policy recommendations to the defender. In addition to providing a formal framework and algorithms to develop strategies, we present experimental results from applying our framework, for various system configurations, on real-world exploit market data actively mined from the darknet.

We develop a unique model for household preferences in a three good market of television content (cable), internet content (Netflix), and income spent on any other good or activity. Utility is a function of the time spent viewing television content, time spent viewing internet content, and income spent otherwise. Preferences are determined by the complementarity (or substitutability) of television and internet content, the complementarity of viewing content and spending income otherwise, and individual preference for income. Consumers maximize utility subject to time of viewership and budget constraints. We analyze the comparative statics of the model by varying the complementarity between television and internet content and the complementarity between viewing content and spending income otherwise. We develop a model of firms, in which there are two firms offering one product each who compete on price. They charge a flat-fee for their product (either television or internet content) and have a fixed cost. Their revenue is determined by the number of consumers who choose to purchase their product multiplied by the price they charge. We find a collusive outcome for the firms. We analyze the Nash Equilibrium of the model. We only found symmetric Mixed Action Nash Equilibria (MANE), with the following interesting feature: Bertrand Competition causes firms to choose low prices very often, but firms price significantly higher should the price drop too low. Thus, the MANE places high probability mass on the lowest and highest prices of each firm but has little mass elsewhere.

Since Abdulkadiroglu and Sonmez’s influential paper in 2003 that
merges school choice and mechanism design, research in the rapidly
growing school choice literature has been mainly focused on the
design of mechanisms with desirable properties or more realistic
assumptions. However, lab experiments often show that subjects do
not report preferences according to the experimenters’ expectation,
and the experiments rarely provide an in-depth analysis of why the
subjects behave in such confounding ways. My thesis formulates
preference reporting in school choice as a game by incorporating a
payoff schedule and proposes mixed strategy Nash equilibrium as a
way to predict preference reporting.

One of the salient challenges of sustainability is the Tragedy of the Commons, where individuals acting independently and rationally deplete a common resource despite their understanding that it is not in the group's long term best interest to do so. Hardin presents this dilemma as nearly intractable and solvable only by drastic, government-mandated social reforms, while Ostrom's empirical work demonstrates that community-scale collaboration can circumvent tragedy without any elaborate outside intervention. Though more optimistic, Ostrom's work provides scant insight into larger-scale dilemmas such as climate change. Consequently, it remains unclear if the sustainable management of global resources is possible without significant government mediation. To investigate, we conducted two game theoretic experiments that challenged students in different countries to collaborate digitally and manage a hypothetical common resource. One experiment involved students attending Arizona State University and the Rochester Institute of Technology in the US and Mountains of the Moon University in Uganda, while the other included students at Arizona State and the Management Development Institute in India. In both experiments, students were randomly assigned to one of three production roles: Luxury, Intermediate, and Subsistence. Students then made individual decisions about how many units of goods they wished to produce up to a set maximum per production class. Luxury players gain the most profit (i.e. grade points) per unit produced, but they also emit the most externalities, or social costs, which directly subtract from the profit of everybody else in the game; Intermediate players produce a medium amount of profit and externalities per unit, and Subsistence players produce a low amount of profit and externalities per unit. Variables influencing and/or inhibiting collaboration were studied using pre- and post-game surveys. This research sought to answer three questions: 1) Are international groups capable of self-organizing in a way that promotes sustainable resource management?, 2) What are the key factors that inhibit or foster collective action among international groups?, and 3) How well do Hardin's theories and Ostrom's empirical models predict the observed behavior of students in the game? The results of gameplay suggest that international cooperation is possible, though likely sub-optimal. Statistical analysis of survey data revealed that heterogeneity and levels of trust significantly influenced game behavior. Specific traits of heterogeneity among students found to be significant were income, education, assigned production role, number of people in one's household, college class, college major, and military service. Additionally, it was found that Ostrom's collective action framework was a better predictor of game outcome than Hardin's theories. Overall, this research lends credence to the plausibility of international cooperation in tragedy of the commons scenarios such as climate change, though much work remains to be done.

This paper uses network theory to simulate Nash equilibria for selfish travel within a traffic network. Specifically, it examines the phenomenon of Braess's Paradox, the counterintuitive occurrence in which adding capacity to a traffic network increases the social costs paid by travelers in a new Nash equilibrium. It also employs the measure of the price of anarchy, a ratio between the social cost of the Nash equilibrium flow through a network and the socially optimal cost of travel. These concepts are the basis of the theory behind undesirable selfish routing to identify problematic links and roads in existing metropolitan traffic networks (Youn et al., 2008), suggesting applicative potential behind the theoretical questions this paper attempts to answer. New topologies of networks which generate Braess's Paradox are found. In addition, the relationship between the number of nodes in a network and the number of occurrences of Braess's Paradox, and the relationship between the number of nodes in a network and a network's price of anarchy distribution are studied.

In order to understand if and how strategic resource allocation can constrain the structure of pair-wise competition outcomes in competitive human competitions we introduce a new multiplayer resource allocation game, the Multiplayer Lotto Games. This new games allows agents to allocate their resources across a continuum of possible specializations. In order to explore the behavior of strategic agents of the Multiplayer Lotto game, we implement an agent-based model with replicator dynamics. The model simulation showed agent behavior different than what the Population Lotto Game would predict, and we propose the “small wave” hypothesis as the explanation. Namely, that “small battles” along the domain are beneficial to agents with lesser resources such that they perform better against richer agents than otherwise expected.

Game theory, the mathematical study of mathematical models and simulations that often play out like a game, is applicable to a plethora of disciplines, one of which is infrastructure security. This is a rather new and niche subject area, and our aim is to perform a bibliographic analysis to analyze the thematic makeup of a selected body of publications in this area, as well as analyze trends in paper publication, journal contributions, country contributions, and trends in the authorship of the publications.