Morshed: Guiding Behavioral Decision-Makers towards Better Security Investment in Interdependent Systems
This work addresses security investment inefficiencies for decision-makers in interdependent systems, offering incremental improvements through learning-based guidance.
The paper tackles the problem of suboptimal security investment in interdependent systems due to behavioral biases in human decision-making, showing through a study with 145 participants that such biases lead to inefficient resource allocation compared to rational models, and proposes learning techniques that improve security outcomes against various attack models.
We model the behavioral biases of human decision-making in securing interdependent systems and show that such behavioral decision-making leads to a suboptimal pattern of resource allocation compared to non-behavioral (rational) decision-making. We provide empirical evidence for the existence of such behavioral bias model through a controlled subject study with 145 participants. We then propose three learning techniques for enhancing decision-making in multi-round setups. We illustrate the benefits of our decision-making model through multiple interdependent real-world systems and quantify the level of gain compared to the case in which the defenders are behavioral. We also show the benefit of our learning techniques against different attack models. We identify the effects of different system parameters on the degree of suboptimality of security outcomes due to behavioral decision-making.