A Two-Period Game Theoretic Model of Zero-Day Attacks with Stockpiling

Abstract

In a two-period game, Player 1 produces zero-day exploits for immediate deployment or stockpiles for future deployment. In Period 2, Player 1 produces zero-day exploits for immediate deployment, supplemented by stockpiled zero-day exploits from Period 1. Player 2 defends in both periods. The article illuminates how players strike balances between how to exert efforts in the two periods, depending on asset valuations, asset growth, time discounting, and contest intensities, and when it is worthwhile for Player 1 to stockpile. Eighteen parameter values are altered to illustrate sensitivity. Player 1 stockpiles when its unit effort cost of developing zero-day capabilities is lower in Period 1 than in Period 2, in which case it may accept negative expected utility in Period 1 and when its zero-day appreciation factor of stockpiled zero-day exploits from Period 1 to Period 2 increases above one. When the contest intensity in Period 2 increases, the players compete more fiercely with each other in both periods, but the players only compete more fiercely in Period 1 if the contest intensity in Period 1 increases.

Keywords

• game
• cybersecurity
• zero-days
• stockpiling
• production
• attack