A general defender‐attacker risk model for networks

Purpose - The purpose of this paper is to present a competitive defender‐attacker risk model that assumes a dual exponential relationship between defender (Ci) and attacker (Ai) resource allocation:vi(Ai,Ci)=e−αici−e−αiCi−γiAi. Design/methodology/approach - Network risk is defined in terms of degree sequence,g, node/link damage,d, and probability of failure,v: R=∑gividi. The paper finds the optimal allocation of resources (Ai,Ci) that minimizesRfrom the defender's point of view, and maximizesRfrom the attacker's point of view. Findings - The effectiveness of the optimal min‐max strategy is compared with three allocation strategies: random, non‐network, and network. It is shown that total network risk is minimized by the non‐network strategy, because this strategy considers damage values and ignores network topology in the definition of risk. Originality/value - The method is illustrated by applying it to critical infrastructure – a hypothetical water‐and‐power network.