Modeling of multi-defender collaboration in a cyber-security scenario

While evidence shows that cyber attackers are good at coordinating and collaborating in their attacks, network defenders are notoriously poor at sharing information and collaborating among themselves. To help promote cooperation among defenders, one requires models that can explain and make predictions of emergent cooperation decisions of each defender in a cyber security scenario. We propose a Multi-Agent Instance-Based Learning (MAIBL-PD) cognitive model based on Instance-based Learning (IBL) theory, and founded on the Prisoner's Dilemma (PD) of cooperation. MAIBL-PD aims at explaining how collaborations emerge to share information with other defenders in a group. MAIBL-PD was created to interact in a Multi-Defender-Game (MDG) that was used in an experimental study with human participants, intended to determine the effect of different levels of information sharing on collaboration. MAIBL-PD uses an extension of the utility function in IBL theory to capture the emergence of cooperation with higher levels of social information. Through simulations with MAIBL-PD we collect synthetic data to compare to the data set collected in human studies. Our results help explain the emergence of cooperation at increasing levels of information regarding others' actions. We demonstrate the ability of MAIBL-PD to predict human cooperation decisions in the MDG in situations in which players have only their own information and in situations in which they have information about the sharing behavior of the other players.