Game Theory Case Study: Ransomware

Game theory is an excellent tool for analyzing complex, competitive situations. Cybersecurity is concerned with just such situations involving attackers, defenders, and others like regulating entities. Within game theory, “a particular game is defined when the choices open to the players in each situation, the situations defining the end of play, and the payoffs associated with each play-terminating situation have been specified.” This does not apply to a general cybersecurity situation. We use the term “infinite game” to describe something like a game such that: players may start or stop playing the game at any time; the end of play may never be defined; and the rules governing play may change at any time without all (or any) players knowing about the changes. While infinite games do not meet the strict definition of a game, both games and infinite games can be analyzed with the rigor and tools of game theory.