Deterrence, Backup, or Insurance: Game-Theoretic Modeling of Ransomware

Abstract

In this paper, we present a game-theoretic analysis of ransomware. To this end, we provide theoretical and empirical analysis of a two-player Attacker-Defender (A-D) game, as well as a Defender-Insurer (D-I) game; in the latter, the attacker is assumed to be a non-strategic third party. Our model assumes that the defender can invest in two types of protection against ransomware attacks: (1) general protection through a deterrence effort, making attacks less likely to succeed, and (2) a backup effort serving the purpose of recourse, allowing the defender to recover from successful attacks. The attacker then decides on a ransom amount in the event of a successful attack, with the defender choosing to pay ransom immediately, or to try to recover their data first while bearing a recovery cost for this recovery attempt. Note that recovery is not guaranteed to be successful, which may eventually lead to the defender paying the demanded ransom. Our analysis of the A-D game shows that the equilibrium falls into one of three scenarios: (1) the defender will pay the ransom immediately without having invested any effort in backup, (2) the defender will pay the ransom while leveraging backups as a credible threat to force a lower ransom demand, and (3) the defender will try to recover data, only paying the ransom when recovery fails. We observe that the backup effort will be entirely abandoned when recovery is too expensive, leading to the (worst-case) first scenario which rules out recovery. Furthermore, our analysis of the D-I game suggests that the introduction of insurance leads to moral hazard as expected, with the defender reducing their efforts; less obvious is the interesting observation that this reduction is mostly in their backup effort.

Mitigating Data Exfiltration Ransomware through Advanced Decoy File Strategies

“…Developing customizable, dynamic decoys indistinguishable from genuine data at scale is an open problem [28,58]. Moreover, data exfiltration prior to encryption leaves minimal time between decoy-based detection and actual data loss [59,16]. Hence decoys should focus on disrupting this initial exfiltration stage [60,52].…”

“…Early decoy-based defenses against ransomware involved basic "honeyfiles" -fake files left as bait across networks [49,50]. Access attempts would trigger alerts to indicate malicious activity [51].…”

A Comparative Analysis of VirLock and Bacteriophage ϕ6 through the Lens of Game Theory

“…The game-theoretic analysis of ransomware in this paper assumes that the defender can invest in two types of ransomware protection: (1) general protection due to deterrence effort, which reduces the probability of infection, and (2) a backup plan that enables the user to recover from the infection [74]. Based on the general consensus among security experts [71] that "96% of those whose data were encrypted obtained their data back in the most significant ransomware attack," and that "only 8% (of those who paid) obtained all their data back," we constructed a payoff matrix, as seen Figure 2.…”

Double-sided Information Asymmetry in Double Extortion Ransomware

“…We remark that our paper adds to a growing literature using game theory to analyse the ransomware decision process [4,5,9,13]. Prior game-theoretical studies have focused on the interaction of ransomware and victim's decision to invest in security measures like backups or insurance [2,32,36,38]. For instance, Laszka, Farhang and Grossklags [17] focused on modeling the ransomware ecosystem as a whole and how backup decisions affect the ransomware ecosystem.…”