Research on the evolution of tripartite data protection strategy based on game theory

Abstract

In recent years, data leakage incidents have been frequently exposed, and personal privacy protection has become a major issue. To explore the laws of data leakage and solve practical problems, the reasons for data leakage and the evolution of players’ strategy in the game are discussed. After sorting out the interest relationship of data leakage incidents, a three-party evolution model of invaders, operators, and regulators is established to analyze the evolution path from the perspective of a single party. The Lyapunov theory is used to analyze the stability of equilibrium points of the system and then verified by MATLAB simulation. The influence relationship of various parameters on the system is analyzed. Finally, the ideal state is defined and the system is attempted to be modified. The results demonstrate that under the current system, the evolution direction cannot be changed by the initial intention of players. The game result will eventually form a situation with a strong attack from invaders, advanced defense from operators, and extensive management from regulators. The attack level can be reduced by adjusting the controllable parameters, modifying the evolution path, and calculating the parameter range.

Introduction

With the advancement of social informatization, the demand for intelligence is constantly increasing in many industries, and user data is surging from “geometric level” to “exponential level.” People's awareness of information protection lags behind the development of big data, ¹ which is reflected in the random storage of enterprise data, lack of protection measures, and inadequate supervision of government departments, creating external invading conditions for hackers. As the illegal income from data leakage far exceeds the criminal cost, hackers have inherent motivation to invade. In recent years, data leakage has become a major social problem worldwide because of frequent exposure of incidents. ² It was reported that from illegal data theft at the upstream to data trading and fraud at the downstream, a complete black industrial chain has been formed, creating huge illegal profit space. A large amount of information is sold on the dark web. Data leakage makes information crimes be more accurate and seriously threatens personal, corporate and even national security. ³ As such, studying the process of data leakage has important practical significance for information management and control.

Due to the information asymmetry of all parties, data security protection is a game process in which all stakeholders make dynamic and irrational decisions. To this end, this paper mainly discusses the three-party game of data leakage, aiming to address the following key questions: Question 1, how does the existing three-party game system evolve? Question 2, how does operators adjust their strategies to maximize data protection at the lowest possible cost? Question 3, how does the supervisors adjust punishment measures to ensure the benign development of the industry?

The main contributions are as follows: (a) In data leakage cases, there is information asymmetry between operators and consumers, and consumers cannot participate in the game (in reality, few consumers defend their rights due to data leakage). As a result, on the basis of clarifying information leakage events, the uncertain value is quantified, and a new three-party evolutionary game model consisting of invaders, operators and regulators is constructed; (b) The system is analyzed and verified from two aspects: the evolution path analysis from the perspective of one party of the game and the stability analysis from the perspective of the whole; (c) The simulation is combined with the data leakage cost report and the general data protection regulations to complete data selection and verify the results that are close to reality; (d) The significance of modifying the evolutionary game path by changing the investment is that the optimal strategy of players, the value range of relevant parameters and the minimum investment of operators can be selected.

The rest chapters are as follows: Section 2 presents relevant research; Section 3 constructs the three-party game evolution model; Section 4 explores and analyzes the stable strategy and equilibrium point of the three-party; Section 5 implements simulation, validation, sensitivity analysis, and evolutionary path correction, and Section 6 presents the conclusion.

Related work

Information security has been a difficult problem for all governments around the world. As a main content of information security, information leakage has become a hotspot of scholars. In fact, the information leakage event is mainly a series of activities carried out by the four parties involved with invaders (hackers), operators (enterprises), regulators (local government, industry association, and more), and victims (consumers). Current research mainly focuses on the infringement mechanism of personal information and the game between the players of information leakage.

Invasion mechanism of personal information

The macro level includes the generation mechanism of personal information leakage,^2,3 transmission process, ⁴ and governance countermeasures.^5–9 Based on 650 cases of personal information infringement, Ye and Zhao ³ analyzed and explained the mechanism using an economic model and concluded that personal information infringement was characterized by high quantity, low risk, low cost, light punishment, high crime success rate, and high income. Based on the dissemination theory, Ma and Xu ⁴ improved the Rathwell model and thought that the communication included two sources of hackers and moles, two communication modes of platform leakage and individual trafficking, and five leakage consequences of promotion, illegal business competition, and criminal crimes. Van der Kleij et al. ⁵ analyzed the interaction of employee knowledge, opportunity, and motivation based on the data leakage prevention behaviors of 384 bank employees and proposed a framework to shape a corporate culture to prevent data leakage of employees. In view of the problem of accidental data leakage caused by mail, network, and more, Guri et al. ⁶ proposed a method to simulate the leakage scenario of real network topology. Eom and Huh ⁷ studied the problem of leaking users’ personal information by the internet of things system (IoTSyS) and proposed an anonymous scheme taking into account information protection and legitimate user confirmation to provide a solution for the privacy protection of IoTSyS. Alneyadi et al. ⁸ thought that traditional data protection measures such as firewall, VPN, and intrusion detection lack initiative. They defined a data leakage prevention system and implemented its deployment on the network to provide a solution for proactive data prevention. Schwarzbach et al. ⁹ studied information sharing and data sensitivity between supply chains and proposed privacy-preserving business process execution architecture. In terms of data protection, Stergiou et al. ¹⁰ proposed a new cloud computing system for privacy. This system integrates with IOT and establishes a network security-based architecture by installing a security “wall” between cloud servers and different users on the Internet, aiming at improving the security and privacy issues. Tewari and Gupta ¹¹ proposed a new ultra-lightweight IoT device tag mutual authentication protocol to protect RFID tags through encryption mechanisms and timestamps, to prevent adversary desynchronization behavior and overcome data security and privacy issues.

The game between information leakage subjects

The main content includes strategy selection of all parties, investment of defenders, protection of consumer rights, and punishment intensity of regulators. For specific practical problems, different subject behaviors are simulated, which can be divided into three categories according to the subjects involved:

Game between attack and defense. Based on the actual background of the conflict between two parties, Liu et al. ¹² built a game model and simulated the dynamic process of network attack and defense simulation parameters under different situations, aiming to provide a theoretical basis for the study of network information security conflict. However, there is no research on how to adjust the income function for effective control. Sun ¹³ analyzed the information security of cloud services through an established game model and improved the classical dynamic replication equations by incentive coefficients. To deal with the strategic choice in the case of Distributed Denial of Service (DDoS), Aydeger et al. ¹⁴ established a defense signal game model to obtain the best defense strategy by solving the game equilibrium, thereby effectively mitigating SLFA (Stealthy Link Flooding Attacks, a variant of DDoS). Abass et al. ¹⁵ thought that data centers and cloud storage were subjected to advanced persistent threats (APTs). They established a network attack and defense game model for optimal defense strategy choice under APTs attack, to deduce the ESS of APTs defense game and provide the conditions for each ESS. Kandoussi et al. ¹⁶ proposed an integrated defense method combining virtual machine migration with honeypot technology and used random game theory to determine potential attack paths under attack and defense conditions. Jakóbik ¹⁷ proposed a game decision-making model based on a cloud computing system and established two types of players: cloud computing providers and attackers. Moreover, an artificial neural network is also applied to obtain the utility function and simulate the optimal defense strategy. According to a Bayesian game-based DDoS Defense mechanism, Dahiya and Gupta ¹⁸ calculated the probability of malicious nodes by sharing information between users to fight against malicious users in the network and established a Bayesian pricing and auction mechanism to achieve Bayesian Nash equilibrium points in different scenarios. De Witte et al. ¹⁹ detailed a policy defense configuration model in which defenders share sensitive information in the network and invest to defend against cyberattacks. They also analyzed how the attack type of the opponent affects the investment of agents. The game model with attack and defense as the main body can effectively deal with the network confrontation, but it ignores the players such as user data leakage and government supervision who have limitations in the choice of game parties.

Two-sided game around information security subjects. Li ²⁰ studied the information security investment of information-sharing platforms through evolutionary games and analyzed the strategic evolution of the platforms and its influencing factors. Regrettably, only two companies were modeled. Li et al. ²¹ proposed an evolutionary game model for privacy protection between e-commerce enterprises and consumers and adjusted the initial intention, privacy protection cost, and commodity price to make the system develop in a win-win direction. Zou et al. ²² believed that the game subject of information security is operators and the regulators. They built a game model for operations and regulators and analyzed the influence of the strategy choice and punishment intensity, and found that heavy punishment intensity can accelerate the convergence speed. The two-sided game around the information security subject has been deeply studied, but the composition of the game players is not comprehensive enough.

Game between consumers, operators, and regulators. Combined with the actual situation, Qu and Hou (2020) constructed an evolutionary game model for users and governments. The influence of subjects’ intention on user right protection, user information platform disclosure, and government punishment was analyzed. In the face of a large number of data leakage, users are rarely able to protect their personal rights. Generally, data leakage events can be simplified into invaders’ attack, operators’ defenses, consumer information leakage, and regulators’ management. In fact, even if data leakage is reported, the public does not know the details of the leaked information. On the other hand, when consumers suffer from telecom fraud, it is impossible for them to accurately know which operator leaked their privacy. Obviously, there is asymmetric information between operators and consumers. Among the numerous data leakage incidents, there are few cases where the protection of consumers’ personal rights can be realized.

Industry application of game theory

In recent years, game theory has been widely used in various industries. Zheng et al. ²³ applied the incomplete information dynamic game to the recycling supply chain of construction and demolition waste (CDW), revealing the impact of information sharing on the recycler market. Ma et al. ²⁴ built a duopoly game model between green and traditional developers and applied it to the building carbon emissions to study the pricing decisions, profits of green developers and carbon emission reduction of green housing. Yu and Rehman et al. ²⁵ applied the evolutionary game model to the financing decision-making of agricultural product suppliers and studied the evolution of green agricultural product supply chain financing system. Hosseini et al. ²⁶ proposed a profit plus distribution (PSD) mechanism for supply chain coordination using evolutionary game theory and explored how the long-term behavior of supply chains (SCs) members would affect coordinated decision-making. Li et al. ²⁷ introduced enterprise leadership into the evolutionary game model and studied the optimal decision-making of the recovery supply chain of CDW under different conditions. To explore the influence of group behavior for the spread of misinformation, Xianyong Li et al. (2022) constructed a tripartite evolutionary game model for the spread of misinformation and effectively analyzed the influence of network media, government, and Internet users’ decisions on the spread of misinformation. ²⁸

In this way, the three-party game that leads to a data leakage event includes invaders, operators, and regulators. Throughout the research on the information security evolutionary game, the players mainly focus on the attackers and defenders, operators and regulators, or regulators, operators, and consumers. The first two types of research are not comprehensive enough. The third is less reasonable in the selection of players, leading to an unclear game mechanism and limited practical significance. Few scholars combine the game situation of invaders, operators, and regulators. On the basis of redefining the game subject, this paper constructs a three-party evolutionary game model, aiming to select the optimal strategy of players and calculate the relevant parameter range of operators. According to a large number of data leakage cases in reality and the practical significance introduced in Table 1, adopting the evolutionary game method is a good measure.

Table 1.

Role information of data leakage in the three-party game.

The game party	Group	The practical significance
Invaders	Individuals or organizations that launch attacks on enterprise systems	Hackers, hacker groups
Operators	Enterprises and institutions that take various measures to prevent hacker intrusion	Cloud service providers, IT and Internet companies, universities, and hospitals
Regulators	Departments that supervise citizens and organizations	Network monitoring center, network security emergency response center, and critical network system disaster recovery center

The main originalities of this paper are as follows: (a) In view of the uncertainty of the degree of data leakage after intrusion, the profit and loss coefficients of attack and defense are set to quantify the leakage degree; (b) The interests of players are analyzed and a new three-party game model is established; (c) The data in the “A cost of Data Breach Report” and “General Data Protection Regulation” are selected for actual verification; (d) The simulation experiments find that changing the initial choice will not break the relationship of interests, and eventually lead to invaders’ strong attacks, operators’ advanced defense, and regulators’ extensive supervision. Increasing the investment of operators can significantly improve this situation, whereas the investment cannot be too high, which has a critical value.

Main steps of the three-party evolutionary game model

The main methods are as follows: (a) Define the game players of information leakage; (b) Analyze the interest relationship of the game players (invaders, operators, and regulatory departments) and find out the key influencing factors; (c) Put forward the preconditions and assumptions of the model and complete the analysis and quantification of cost-benefit indicators; (d) Build an evolutionary game model, including constructing a payoff matrix, calculating the expected return, average return and replicating the dynamic equations of the strategy; (e) Model analysis and simulation.

The application of the Lyapunov stability criterion is as follows: a three-dimensional replication dynamic system equation is established by simultaneous replication dynamic equations, and the Jacobian determinant $J=(J_{ij}{)}_{3\times 3}$ is calculated. If ${\lambda }_i<0(i=1,\dots ,n)$ , the system is asymptotically stable at x, and $\mathrm{\exists }{\lambda }_i>0(i=1,\dots ,n)$ is unstable.

Game model hypothesis and construction

Problem description

The development of data leakage can be summarized, as shown in Figure 1. To obtain the hidden value of the data (e.g. data analysis, peddling in the dark web), the invader attacks the system through certain technical to obtain system permissions and steal user data.^27,29 Because of different security principles, ³⁰ technology, and tools, invaders have different invasion abilities. ³¹ To prevent data from intrusion, operators take certain measures (such as installing external security devices, updating technologies, and optimizing management) to achieve information systems for data security protection, and different defense capabilities are affected by the investment of enterprises.^32–34 During the attack and defense process, according to the development plan, regulators adopt different management methods (extensive management, and fine management) to invest corresponding manpower, material, and financial resources to manage citizens and enterprises and protect the rights of economic subjects. This measure can ensure the security of enterprise information and promote the benign operation of society for positive and orderly development.^35,36

Figure 1.

Logic diagram of three-party game.

When information leakage occurs, regulators shall take some measures such as investigation, interview, and rectification to impose penalties on both sides according to the actual situation.

Model assumptions

Game subjects (player)

The game subjects include three players: invaders, operators, and regulators. An invader represents an individual or organization that attacks a network system; an operator represents an enterprise and institution that takes measures to prevent intrusion, and a regulator represents the department that supervises citizens and organizations. The practical significance ²² of game parties is shown in Table 1.^37–40

Economic man hypothesis

The main purpose of the game subjects is to maximize their own interests. First, invaders are trying to gain access under limited conditions to achieve more data for profit. Then, to reduce security costs as much as possible, operators protect their data resources and business positions to avoid punishment by regulators. Finally, to guide enterprises to standardize the development of information security, regulators supervise citizens and enterprises to achieve the highest management efficiency.

Bounded rationality hypothesis

The players (invaders, operators, regulators) are bounded rational. Due to the complexity of information security supervision, network attacks, data leakage, and the cognitive differences among the three-party of the game, each player has to find the most favorable strategy through constant trial and error.

Game strategy

The strategy selection space of invaders, operators, and regulators is {strong attack, general attack}, {advanced defense, basic defense}, and {extensive management, fine management}, respectively. The practical significance of specific strategies is shown in Table 2.

Table 2.

Strategy space of players and its significance.

Players	Strategy selection space	Strategic significance
Invaders	{strong attack, general attack}	"Strong attack” is organized, large-scale, and multi-type malicious attacks.
		"General attack” is a conventional attack that the invader uses consensus.
Operators	{Advanced defense, basic defense}	Advanced defense means that the system can resist strong attacks, detect, identify, and record intrusions, and quickly recover the system.
		Basic defense refers to using the original system software so that the system can resist general attacks, detect attacks, and restore main functions.
Regulators	{extensive management, fine management}	"Extensive management” refers to the hope for rapid development of the industry, pay attention to the basic requirements of information security.
		"Fine management” refers to the industry has formed a scale based on more stringent requirements.

Parameter settings

Proportion of strategy selection

The proportion of invaders choosing strong attack strategy is x and that of a general attack strategy is $1-x$ ; the proportion of operators choosing advanced defense is y and that of basic defense is $1\text{-}y$ ; the proportion of fine management selected by regulators is z and that of extensive management is $1-z$ .

Invaders parameters

The cost for invaders to choose a strong attack is $C_1$ and that for a general attack is $C_2$ ( $C_1>C_2>0$ ). The profit and loss of the invasion depend on the strategies of both parties, as shown in Table 3. $\alpha$ and $\beta$ represent the probabilities of successful invasion under different conditions ( $\beta >\alpha >0$ ).

Table 3.

Attack and defense profit and loss coefficient table.

	Advanced defense of operators	Basic defense of operators
Invaders strong attack	$\alpha$	$\beta$
Invaders basic attack	×	$\alpha$

Operator parameters

The investment required by an operator to choose advanced defense is ${\mathrm{C}}_3$ . The basic defense means that enterprises do not add external facilities and only rely on defense measures, such as scanning software provided by the system without other costs.^41,42 The data asset of an enterprise is A, and the fixed income it can bring to the enterprise is E. When an enterprise is invaded, the public opinion will be affected and the public relations costs e will be needed to compensate for the reputational loss.

Parameters of regulators

The fine management cost required by regulators is $C_4$ , and the extensive management cost is negligible. When data leakage occurs, the hack must be found and the enterprise will be investigated with careful management. Under the extensive management, there is a probability of $\lambda \in (0,1)$ to detect the hacking behavior and inspect enterprises, where enterprises will be punished if there are no security measures. The fines for hackers and enterprises are $P_1$ and $P_2$ respectively. Regardless of whether hackers are successful or not, once they are caught, they are punished. The profit and loss of administrative performance obtained by the regulator is R (if the data is safe, the performance gains will be obtained; otherwise, the performance losses will be obtained). The symbols and meanings of the three-party parameters in the game are shown in Table 4.

Table 4.

Parameter symbols and meanings of the three-party in the game.

Game party	Symbol	Meaning
Invaders	$x$	Probability that the invaders choose a “strong attack” strategy
	$C_1$	The cost of knowledge and capability required by a strong attack
	$C_2$	The cost of knowledge and capability required for a general attack
	$\alpha \beta$	The profit and loss coefficient of hacking under different strategies
Operators	$y$	Probability that operators choose advanced defense
	$E$	Fixed income of owned assets
	$A$	Value of owned assets
	$C_3$	The invest cost of advanced defense
	$e$	Public relations costs in case of data leakage and reputational damage
Regulators	$z$	Probability of regulators choosing “fine management"
	$P_1$	Penalty for invaders when an intrusion is detected
	$P_2$	Penalty for operators when data leakage is found and the enterprise has no protective measures
	$C_4$	Invest cost of fine management
	$\lambda$	Probability of finding hacking when widely managed
	$R$	Potential performance gains and losses for governments

According to the above assumptions, the mixed strategy game matrix among invaders, operators, and regulators can be obtained, as shown in Table 5, where the benefit values represent invaders, operators, and regulators in turn.

Table 5.

Benefit statement in the three-party game.

Regulators		Fine management $z$		Extensive management $1-z$
Operators		Advanced defense $y$	Basic defense $1-y$	Advanced defense $y$	Basic defense $1-y$
Invaders	Strong attack $x$	$\alpha A-C_1-P_1$	$\beta A-C_1-P_1$	$\alpha A-C_1-\lambda P_1$	$\beta A-C_1-\lambda P_1$
		$\begin{array}{c}E-C_3-\alpha A\\ -e-P_2\end{array}$	$E-\beta A-e-P_2$	$\begin{array}{c}E-C_3-\alpha A\\ -e-\lambda P_2\end{array}$	$E-\beta A-e-\lambda P_2$
		$P_1+P_2-C_4-R$	$P_1+P_2-C_4-R$	$\lambda P_1+\lambda P_2-R$	$\lambda P_1+\lambda P_2-R$
	General attack $1-x$	$-C_2-P_1$	$\alpha A-C_2-P_1$	$-C_2-\lambda P_1$	$\alpha A-C_2-\lambda P_1$
		$E-C_3$	$E-\alpha A-e-P_2$	$E-C_3$	$E-\alpha A-e-\lambda P_2$
		$P_1-C_4+R$	$P_1+P_2-C_4-R$	$\lambda P_1+R$	$\lambda P_1+\lambda P_2-R$

Solution and analysis of the model

Game model solution

Replication dynamics equations of invaders

The expected benefits of invaders choosing a strong attack are as follows:

$$\begin{array}{rl}{U}_{x1}=& yz(\alpha A-C_1-P_1)+z(1-y)(\beta A-C_1-P_1)\\ & +y(1-z)(aA-C_1-\lambda P_1)\\ & +(1-y)(1-z)(\beta A-C_1-\lambda P_1)=(\lambda -1)P_{1}z\\ & +(\alpha A-\beta A)y-\lambda P_1-C_1+\beta A\end{array}$$

(1)

The expected benefits of invaders choosing a general attack are as follows:

$$\begin{array}{rl}{U}_{x2}=& yz(C_2-P_1)+z(1-y)(\alpha \mathrm{A}-C_2-P_1)\\ & +y(1-z)(-C_2-\lambda P_1)\\ & +(1-y)(1-z)(\alpha \mathrm{A}-C_2-\lambda P_1)=(\lambda -1)P_{1}z\\ & -\alpha Ay-\lambda P_1-C_2+\alpha A\end{array}$$

(2)

The average expected benefits of invaders is as follows:

$${\overline{U}}_x=x{U}_{x1}+(1-x)U_{x2}$$

(3)

Then, it can be concluded that the replication dynamic equation for an invader choosing a strong attack strategy is:

$$\begin{array}{rl}& f(x)=dx/dt=x(U_{x1}-\overline{U_x})=x(1-x)(U_{x1}-U_{x2})\\ & =x(1-x)((2\alpha A-\beta A)y+A(\beta -\alpha )+C_2-C_1)\end{array}$$

(4)

Replication dynamics equations of operators

The expected benefits of operators choosing advanced defense are as follows:

$$\begin{array}{rll}& U_{y1}=xz(E-C_3-\alpha A-e-P_2)+z(1-x)(E-C_3)& +x(1-z)(E-C_3-\alpha A-e-\lambda P_2)\\ & +(1-x)(1-z)(E-C_3)=(\lambda -1)P_{2}xz\\ & +(-\lambda P_2-e-\alpha A)x-C_3+E\end{array}$$

(5)

The expected benefits of operators choosing basic defense are as follows:

$$\begin{array}{rl}{U}_{y2}=& xz(E-\beta A-e-P_2)+z(1-x)(E-\alpha A-e-P_2)\\ & +x(1-z)(E-\beta A-e-\lambda P_2)\\ & +(1-x)(1-z)(E-\alpha A-\mathrm{e}-\lambda P_2)=(\lambda -1)P_{2}z\\ & +(\alpha A-\beta A)x-\lambda P_2-e-\alpha A+E\end{array}$$

(6)

The average expected revenue of operators is:

$$\overline{U_y}=y{U}_{y1}+(1-y)U_{y2}$$

(7)

Then, it can be concluded that the replication dynamic equations for operators choosing advanced defense strategies is:

$$\begin{array}{rl}& f(y)=\mathrm{d}y/dt=y(U_{y1}-\overline{U_y})=y(1-y)((1-x)\\ & ((1-\lambda )P_{2}z+\lambda P_2+e)+A((\beta -2\alpha )x+\alpha )-C_3)\end{array}$$

(8)

Replication dynamic equations of regulators

The expected benefits of regulators choosing fine management are as follows:

$$\begin{array}{rl}{U}_{z1}=& xy(P_1+P_2-C_4-R)+x(1-y)(P_1\\ & +P_2-C_4-R)+y(1-x)(P_1-C_4+R)\\ & +(1-x)(1-y)(P_1+P_2-C_4-R)& =((P_2-2R)x-P_2+2R)y+P_2-C_4-R+P_1\end{array}$$

(9)

The expected benefits of regulators choosing extensive management are as follows:

$$\begin{array}{rl}{U}_{z2}=& xy(\lambda P_1+\lambda P_2-R)+x(1-y)(\lambda P_1+\lambda P_2-R)\\ & +y(1-x)(\lambda P_1+R)+(1-x)(1-y)\\ & (\lambda P_1+\lambda P_2-R)=((\lambda P_2-2R)x-\lambda P_2+2R)y\\ & +\lambda P_2+\lambda P_1-R\end{array}$$

(10)

The average expected return of regulators is:

$$\overline{U_z}=z{U}_{z1}+(1-z)U_{z2}$$

(11)

Then, it can be concluded that the replication dynamic equation for regulators choosing fine management strategy is:

$$\begin{array}{rl}f(z)=& \mathrm{d}z/dt=z(1-z)(U_{z1}-U_{z2})=z(1-z)\\ & ((1-\lambda )P_{2}x+(\lambda -1)P_2)y+(1-\lambda )P_2\\ & -P_{1}d-C_4+P_1=z(1-z)((1-\lambda )\\ & (P_1+P_2-P_2(1-x)y)-C_4)\end{array}$$

(12)

Tripartite evolutionary path analysis based on unilateral perspective

Evolutionary path analysis of invaders

The zero case of $\mathrm{d}x/dt$ is discussed as follows: when $y=(C_1-C_2+A(\alpha -\beta ))/A(2\alpha -\beta )$ is satisfied, $\mathrm{d}x/dt\equiv 0$ , which is stable strategy regardless of x; when $y\ne (C_1-C_2+A(\alpha -\beta ))/A(2\alpha -\beta )$ , $x=0\mathrm{or}1$ is two stable points, the classification discussion of $df(x)/dt=(1-2x)((2\alpha A-\beta A)y+A(\beta -\alpha )+C_2-C_1)$ is shown in Table 6.

Table 6.

Distribution of stable points of invaders’ evolution under different conditions.

Discussion of $df(x)/dt$	$2\alpha -\beta >0$		Evolutionary stability point	$2\alpha -\beta <0$		Evolutionary stability point
	$x=0$	$x=1$		$x=0$	$x=1$
$y>(C_1-C_2+A(\alpha -\beta ))/A(2\alpha -\beta )$	+	−	$x=1$ I	−	+	$x=0$ III
$y<(C_1-C_2+A(\alpha -\beta ))/A(2\alpha -\beta )$	−	+	$x=0$ II	+	−	$x=1$ IV

When the operator's strategy and profit and loss coefficient meet I $y>(C_1-C_2+A(\alpha -\beta ))/A(2\alpha -\beta )$ , $2\alpha -\beta >0$ or IV $y<(C_1-C_2+A(\alpha -\beta ))/A(2\alpha -\beta )$ , $2\alpha -\beta <0$ , $x=1$ is the direction of the final evolutionary path, which means that when the operator's investment reaches a certain level, the success rate of the invader choosing a strong attack is higher and the income is greater. When the operator's strategy and profit and loss coefficient meet II $y<(C_1-C_2+A(\alpha -\beta ))/A(2\alpha -\beta )$ , $2\alpha -\beta >0$ or III $y>(C_1-C_2+A(\alpha -\beta ))/A(2\alpha -\beta )$ , $2\alpha -\beta <0$ , $x=0$ is the direction of the final evolutionary path, which means that when the operators’ investment is reduced to a certain extent, the cost of strong attacks is relatively higher, and the benefits of general attacks are greater.

Evolutionary path analysis of operators

The zero case of $\mathrm{d}y/dt$ is discussed as follows: when $x=(A((\beta -2\alpha )x+\alpha )-C_3)/((1-\lambda )P_{2}z+\lambda P_2+e))+1$ is satisfied, $\mathrm{d}y/dt\equiv 0$ , which means there will be stable strategies regardless of y. When $x\ne (A((\beta -2\alpha )x+\alpha )-C_3)/((1-\lambda )P_{2}z+\lambda P_2+e))+1$ , $y=0\mathrm{or}1$ is two stable points, the classification of $df(y)/dt=(1-2y)((1-x)((1-\lambda )P_{2}z+\lambda P_2+e)+A((\beta -2\alpha )x+\alpha )-C_3)$ is shown in Table 7.

Table 7.

Stable point distribution of operator evolution under different conditions.

Discussion of $df(y)/dt$	$y=0$	$y=1$	Evolutionary stability point
$A((\beta -2\alpha )x+\alpha )>C_3-((1-\lambda )P_{2}z+\lambda P_2+e)(1-x)$	+	−	$y=1$ V
$A((\beta -2\alpha )x+\alpha )<C_3-((1-\lambda )P_{2}z+\lambda P_2+e)(1-x)$	−	+	$y=0$ VI

When $A((\beta -2\alpha )x+\alpha )>C_3-((1-\lambda )P_{2}z+\lambda P_2+e)(1-x)$ is satisfied, $y=1$ is the direction of the final evolutionary path, which means that when the attack intensity and supervision degree of invaders reach a certain level, the advanced defense can effectively protect the data to minimize the loss. When $A((\beta -2\alpha )x+\alpha )<C_3-((1-\lambda )P_{2}z+\lambda P_2+e)(1-x)$ is satisfied, $y=0$ is the direction of the final evolutionary path, which means that when the attack intensity and supervision degree of hackers are reduced to a certain extent, it is not worthwhile to choose a more advanced defense, and the basic defense is effective.

Evolutionary path analysis of regulators

The zero case of $\mathrm{d}z/dt$ is discussed as follows: when $y=(P_1+P_2-C_4/(1-\lambda ))/P_2(1-x)$ is satisfied, $dz/dt\equiv 0$ , there will be stable strategies regardless of z; when $y\ne (P_1+P_2-C_4/(1-\lambda ))/P_2(1-x)$ , $z=0\mathrm{o}r1$ is two stable points. The classification of $df(z)/dt=(1-2y)((1-\lambda )(P_1+P_2-P_2(1-x)y)-C_4)$ is shown in Table 8.

Table 8.

Distribution of regulatory evolution stability points under different conditions.

Discussion on the situation of $df(z)/dt$	$z=0$	$z=1$	Evolutionary stability point
$y<(P_1+P_2-C_4/(1-\lambda ))/P_2(1-x)$	+	−	$z=1$ VII
$y>(P_1+P_2-C_4/(1-\lambda ))/P_2(1-x)$	−	+	$z=0$ VIII

When $y<(P_1+P_2-C_4/(1-\lambda ))/P_2(1-x)$ is satisfied, $z=1$ is the direction of the final evolutionary path, which means that when the attack intensity of hackers and the investment of operators reached a certain level, fine management brings more benefits and better conducive to the virtuous cycle of the industry. This strategy is adopted when the industry has reached a certain level and needs standardization. When $y>(P_1+P_2-C_4/(1-\lambda ))/P_2(1-x)$ is satisfied, $z=0$ is the direction of the final evolutionary path, which means that when the attack intensity of hackers and the investment of operators are reduced to a certain extent, extensive management will bring more benefits. This strategy is adopted in the early stage of the industry, because there are almost no network attacks and enterprises need to be in a savage growth stage.

Stability analysis of equilibrium points in the three-party evolutionary game system

Combining the replication dynamic equations of invaders, operators, and regulators, a three-dimensional replication dynamic system is obtained in the evolutionary game process of three players.

$$\{\begin{array}{c}f(x)=x(1-x)((2\alpha A-\beta A)y+A(\beta -\alpha )+C_2-C_1)=0\\ f(y)=y(1-y)((1-x)((1-\lambda )P_{2}z+\lambda P_2+e)+A((\beta -2\alpha )x+\alpha )-C_3)=0\\ f(z)=z(1-z)((1-\lambda )(P_1+P_2-P_2(1-x)y)-C_4)=0\end{array}$$

(13)

Nine equilibrium points of the three-dimensional replicative dynamical system can be obtained by solving these equations: $E_1(0,0,0)$ , $E_2(0,0,1)$ , $E_3(0,1,0)$ , $E_4(1,0,0)$ , $E_5(1,1,0)$ , $E_6(1,0,1)$ , $E_7(0,1,1)$ , $E_8(1,1,1)$ and $E_9(x^{*},y^{*},z^{*})$ . It is worth noting that the solution of Eq. (14) is $(x^{*},y^{*},z^{*})$ .

$$\{\begin{array}{c}(2\alpha A-\beta A)y+A(\beta -\alpha )+C_2-C_1=0\\ (1-x)((1-\lambda )P_{2}z+\lambda P_2+e)+A((\beta -2\alpha )x+\alpha )-C_3=0\\ (1-\lambda )(P_1+P_2-P_2(1-x)y)-C_4=0\end{array}$$

(14)

Jacobian is constructed as follows:

$$J=\left[\begin{array}{ccc}{J}_{11}& J_{12}& J_{13}\\ J_{21}& J_{22}& J_{23}\\ J_{31}& J_{32}& J_{33}\end{array}\right],\mathrm{then}\{\begin{array}{c}{J}_{11}=\mathrm{\partial }f(x)/\mathrm{\partial }x=(1-2x)((2\alpha A-\beta A)y+A(\beta -\alpha )+C_2-C_1)\\ J_{12}=\mathrm{\partial }f(x)/\mathrm{\partial }y=x(1-x)\mathrm{A}(2\alpha -\beta )\\ J_{13}=\mathrm{\partial }f(x)/\mathrm{\partial }z=0\\ J_{21}=\mathrm{\partial }f(y)/\mathrm{\partial }x=y(1-y)(-(1-\lambda )P_{2}z-\lambda P_2-e+\beta A-2\alpha A)\\ J_{22}=\mathrm{\partial }f(y)/\mathrm{\partial }y=(1-2y)f(y)/y(1-y)\begin{array}{cccc}& & & \begin{array}{cccc}& & & \end{array}\end{array}\\ J_{23}=\mathrm{\partial }f(y)/\mathrm{\partial }z=y(1-y)(1-x)(1-\lambda )P_2\\ J_{31}=\mathrm{\partial }f(z)/\mathrm{\partial }x=z(1-z)(1-\lambda )P_2\\ J_{32}=\mathrm{\partial }f(z)/\mathrm{\partial }y=z(1-z)((1-\lambda )P_2(x-1)\\ J_{33}=\mathrm{\partial }f(z)/\mathrm{\partial }z=(1-2z)((1-\lambda )(P_1+P_2-P_2(1-x)y)-C_4)\end{array}$$

(15)

The nine equilibrium points are substituted into the Jacobian determinant to obtain the eigenvalue expressions of each equilibrium point, to facilitate the subsequent judgment of the stability of equilibrium points. Taking $E_1(0,0,0)$ as an example, the expression of the replicated dynamic system can be obtained by substituting the Jacobian determinant:

$$\left[\begin{array}{ccc}A(\beta -\alpha )+C_2-C_1& 0& 0\\ 0& \lambda P_2+e-C_3+\alpha A& 0\\ 0& 0& (P_1+P_2)(1-\lambda )-C_4\end{array}\right]$$

Obviously, the eigenvalue of the matrix is ${\lambda }_1=A(\beta -\alpha )+C_2-C_1$ , ${\lambda }_2=\lambda P_2+e-C_3+\alpha A$ , ${\lambda }_3=(P_1+P_2)(1-\lambda )-C_4$ , Similarly, eigenvalues of other equilibrium points can be calculated, as shown in Table 9:

Table 9.

Eigenvalue matrix of the three dimensional replicative dynamical system.

Equilibrium	The eigenvalue ${\lambda }_1$	The eigenvalue ${\lambda }_2$	The eigenvalue ${\lambda }_3$
${\mathrm{E}}_1(0,0,0)$	$A(\beta -\alpha )+C_2-C_1$	$\lambda P_2+e-C_3+\alpha A$	$(P_1+P_2)(1-\lambda )-C_4$
${\mathrm{E}}_2(0,0,1)$	$A(\beta -\alpha )+C_2-C_1$	$P_2+e-C_3+\alpha A$	$-((P_1+P_2)(1-\lambda )-C_4)$
${\mathrm{E}}_3(0,1,0)$	$\alpha A+C_2-C_1$	$-(\lambda P_2+e-C_3+\alpha A)$	$P_1(1-\lambda )-C_4$
${\mathrm{E}}_4(1,0,0)$	$-(A(\beta -\alpha )+C_2-C_1)$	$A(\beta -\alpha )-C_3$	$(P_1+P_2)(1-\lambda )-C_4$
${\mathrm{E}}_5(1,1,0)$	$-(\alpha A+C_2-C_1)$	$-(A(\beta -\alpha )-C_3)$	$(P_1+P_2)(1-\lambda )-C_4$
${\mathrm{E}}_6(1,0,1)$	$-(A(\beta -\alpha )+C_2-C_1)$	$A(\beta -\alpha )-C_3$	$-((P_1+P_2)(1-\lambda )-C_4)$
${\mathrm{E}}_7(0,1,1)$	$\alpha A+C_2-C_1$	$P_2+e-C_3+\alpha A$	$-(P_1(1-\lambda )-C_4)$
${\mathrm{E}}_8(1,1,1)$	$-(\alpha A+C_2-C_1)$	$-(A(\beta -\alpha )-C_3)$	$-((P_1+P_2)(1-\lambda )-C_4)$
${\mathrm{E}}_9(x^{*},y^{*},z^{*})$	Eigenvalue of the center point is complicated to be solved and analyzed in the simulation stage

For asymmetric games, if the equilibrium of an evolutionary game is asymptotically stable, the result must satisfy that the equilibrium is a strict Nash equilibrium, which is pure strategy equilibrium. ⁴³ To analyze the asymptotic stability of equilibrium points of the replication dynamic equation, we only need to discuss the asymptotic stability of the equilibrium point in the replication dynamic equations involving pure strategies, and the equilibrium points that satisfy the conditions include ${\mathrm{E}}_1\text{-}{\mathrm{E}}_8$ eight points. The classification discussion is as follows: In the case of actual data leakage, the illegal incomes of hackers are far greater than the costs. Therefore, according to Table 10 and the value range of each parameter, ${\lambda }_1({\mathrm{E}}_1,{\mathrm{E}}_2,{\mathrm{E}}_3,{\mathrm{E}}_7)>0$ , and ${\mathrm{E}}_1,{\mathrm{E}}_2,{\mathrm{E}}_3,{\mathrm{E}}_7$ is not a stable point. When ${\lambda }_2,{\lambda }_3$ of ${\mathrm{E}}_4,{\mathrm{E}}_5,{\mathrm{E}}_6,{\mathrm{E}}_8$ are analyzed, the positive and negative values of $A(\beta -\alpha )-C_3$ , $(P_1+P_2)(1-\lambda )-C_4$ cannot be determined and different cases are discussed. Obviously, ${\lambda }_2,{\lambda }_3$ do not affect each other. When $(P_1+P_2)(1-\lambda )-C_4>0$ and $A(\beta -\alpha )-C_3>0$ , ${\lambda }_2({\mathrm{E}}_4,{\mathrm{E}}_6)>0$ and ${\lambda }_3({\mathrm{E}}_4,{\mathrm{E}}_5)>0$ , the three equilibrium points ${\mathrm{E}}_4,{\mathrm{E}}_5,{\mathrm{E}}_6$ are excluded. In the same way, the stable point results are shown in Table 10.

Table 10.

Three-party evolutionary stability points under different conditions.

	$(P_1+P_2)(1-\lambda )-C_4>0$	$(P_1+P_2)(1-\lambda )-C_4<0$
$A(\beta -\alpha )-C_3>0$	${\mathrm{E}}_8(1,1,1)$	${\mathrm{E}}_5(1,1,0)$
$A(\beta -\alpha )-C_3<0$	${\mathrm{E}}_6(1,0,1)$	${\mathrm{E}}_4(1,0,0)$

Simulation analysis and evolution correction

The evolutionary game process of the behavior of the three players is simulated using MATLAB 2015 software and the evolutionary stability is verified.

Selection of initial simulation data

According to the Global Data Breach Cost Report released by IBM in 2020, the average total cost of data leakage events is 3.86 million dollars in 2020. As such, $3.5-$4 million is a reasonable range of average total cost. Since catastrophic large-scale data leakage is not universal and persuasive, the average total cost in this report is no more than 100,000 records of data leakage events as the research target. This paper continues to use the data volume of 100,000 copies (Ponemon Institute). ⁴⁴ According to the General Data Protection Regulation implemented by the European Union, Internet companies that illegally collect personal information can be fined up to 20 million Euros, which is equivalent to about 17 million dollars at the exchange rate of USD and Euro 0.85. Thereby 15–20 million yuan is the reasonable range of punishment. Suppose the time and energy cost of a strong attack of an invader is $2 million, and the time and energy cost of the general attack is $500,000. The value of own assets is $150 per piece; the fixed income of data resources is $300 per piece, and the individual penalty is $P_1$ = 0.25 $P_2$ (5 million dollars). Fine management investment and management profit and loss of regulators are 20 million. To ensure the evolutional universality, assuming the initial intention of the game player's strategy choice is neutral (the following paper proves that the initial intention cannot change the strategy evolution), the mixed strategy set is (0.5, 0.5, 0.5).

According to the report, the average leakage cost caused by malicious attacks that destroy data with destructive/wiper attacks is $4.52 million, and the cost of hacking is much less than the cost of operators $C_3$ . Thereby the cost of hacking between 0.1 and 0.2 is reasonable. The calculation of operator cost includes four categories: (a) Cost of detection, investigation, evidence collection, assessment, and audit activities; (b) Damaged reputation, reduced goodwill, and loss of customers; (c) Activity costs of contacting external experts, and data protection supervisory authorities; (d) Cost of post analysis response.

Based on the above analysis, the initial parameters that are in line with the actual situation are finally determined, as shown in Table 11. Except for coefficients, all parameters are in units of millions ( $\beta$ > $\alpha$ satisfies the preconditions).

Table 11.

Initial simulation parameters.

symbol	$C_1$	$C_2$	$\alpha$	$\beta$	$E$	$A$	$C_3$	$e$	$P_1$	$P_2$	$C_4$	$\lambda$	$R$	$x$	$y$	$z$
The numerical	0.2	0.05	0.5	0.8	3	1.5	0.38	0.1	0.5	2	2	0.5	5	0.5	0.5	0.5

Influence factors and evolution path of game

To explore the impact of initial intention on the system, the values in [0, 1] are uniformly selected to observe the change of strategy choice. Specifically, according to observing Eq. (13) of the three-dimensional replication dynamic system and comparing the parameter settings of the three-party in Table 4, it can be seen that the game evolution of the three-party has nothing to do with the fixed profit value of the operator and the political profit and loss value of the government. The choice of invaders’ behavior strategy is related to the profit and loss coefficient, the data assets of operators, and the cost of different intrusions. The choice of operators’ behavior strategy is related to the punishment of regulators, the investment of defense measures, the investment of public relations, and the profit and loss coefficient. The choice of regulator's behavior strategy is related to the punishment and management investment. In addition, the choice of the three-party behavioral strategy is affected by the choice of other players in the derivate Eq. (13).

According to Table 11, the dynamic evolution process of the game under this state is simulated as shown in Figure 2. In Figure 2(a), the horizontal axis represents the evolution time and the vertical axis represents the proportion of strategy selection. Figure 2(b) shows the trend of the three-party strategy over time. The results show that when the initial condition of the three-party is (0.5, 0.5, 0.5), they will fall into the dilemma of “strong attack by invaders, advanced defense by operators and extensive management by regulators” to maximize their own interests. Taking $x,y,z$ as the independent variables, the parameters are taken into the three-party evolutionary path for analysis, as shown in Section 4.2. $x,y,z\in [0,1]$ always satisfy I, V, VIII, and the final result is (1, 1, 0).

Figure 2.

Probability diagram of strategy selection (a) and change trend of the three-party strategy over time (b).

Analysis of central equilibrium point

Substituting the simulation parameter set into Eq. (14) in Section 4.3, the solution is $x^{*}=-2.75$ , $y^{*}=-1$ and $z^{*}=-77/75$ . $x^{*},y^{*},z^{*}$ are less than 0, indicating that the central equilibrium point is not within the solution interval $x,y,z\in [0,1]$ . As such, there is no impure Nash equilibrium point strategy in the current three-party game system. In other words, no matter whether the three-party chooses a pure strategy or a mixed strategy, there is no equilibrium point strategy belonging to any strategy to balance the interests and achieve a stable state in the current system.

Under the above assumptions, there is no stable central equilibrium in the current three-party game system, and the evolutionary game results can only be pure Nash equilibrium strategy.

Influence of players’ initial intention on the system evolution path

Due to $x,y\in [0,1]$ ，the value is taken uniformly. Let other variables be constant and x be 0.2, 0.4, 0.6 and 0.8 respectively, the game evolution results can be obtained through the simulation system. Similarly, y and z are also 0.2, 0.4, 0.6, and 0.8 respectively, and the game evolution results are obtained as shown in Figure 3. Figure 3(a) to (c) represents the strategy selection probabilities of invaders, operators, and regulators, respectively. The horizontal axis in the figure represents the evolution time, and the vertical axis represents the proportion of strategy selection (similarly hereinafter).

Figure 3.

Influence of the initial intention of the three-party game players on the system evolution path.

For invaders, when x is 0.2, 0.4, 0.6, and 0.8, respectively, the evolutionary game is stable at $x=1$ . t = 10 means that the initial intention can adjust the evolutionary rate of invaders, but cannot change the evolution direction. The reasons are as follows: taking any value in $x\in [0,1]$ , the stability condition belongs to condition I, that is, it is most conducive to the invader to launch a strong attack, thereby the evolution direction has always been the direction of invaders to launch a strong attack. Similarly, for operators and regulators, the final direction of the evolutionary game is not affected when y and z is set to 0.2, 0.4, 0.6, and 0.8 respectively. The reason is that if the value is set to any value in $y,z\in [0,1]$ , the stability conditions are V and VIII, respectively, indicating that operators choose advanced defense and regulators choose extensive management.

Based on the above analysis, it is concluded that under the current system, the initial intention of the three-party in the game changes the convergence speed without changing the evolution direction, which means that the information leakage is serious. Regardless of the percentage of initial intention, the result will translate into powerful attacks by invaders and widespread government-managed chaos. This means that the current situation is not optimistic and individual intentions cannot control the final result. Due to the interest tendency of all parties, an unfavorable situation will eventually be formed: Invaders choose strong attacks to bring greater benefits; operators choose advanced defense to mitigate property losses, and regulators choose extensive management to greatly save management costs.

Influence of controllable parameters on the system evolution

In the three-party game, each game can adjust some parameters according to the needs. For example, the invader can adjust the profit and loss coefficient $\alpha$ and $\beta$ to control the degree of data leakage. Operators can adjust the investment of information security protection $C_3$ according to the data level, and regulators can adjust the punishment $P_1$ and $P_2$ for the other two parties according to market conditions. Therefore, the controllable parameters can be adjusted to change the direction of the game, and the simulation analysis can be performed with different parameters.

For the influence of the controllable parameters $\alpha$ and $\beta$ of invaders on the evolution of the system, four groups of parameter values are selected, which are respectively two groups of parameter values satisfying the conditions of evolution path I and two groups of parameter values satisfying the conditions of evolution path II. In addition, the two groups of parameter values also show their influence on the results through numerical differences. Similarly, the parameters of cost ${\mathrm{C}}_3$ , penalties $P_1$ and $P_2$ are also selected on the same basis.

Influence of invaders controllable parameters $\alpha$ and $\beta$ on the system evolution

Let other conditions be unchanged, two groups of data satisfying condition I: $\alpha =0.5$ , $\beta =0.9$ and $\alpha =0.3$ , $\beta =0.7$ and two groups of data satisfying condition III: $\alpha =0.08$ , $\beta =0.16$ and $\alpha =0.06$ , $\beta =0.12$ are selection. The evolution of invaders’ strategy selection under different conditions is simulated, and the results are shown in Figure 4.

Figure 4.

Influence of invaders’ controllable parameters $\alpha$ and $\beta$ on the system evolution.

The four curves represent the changes of invader strategy selection over time under different conditions. The simulation results are consistent with the game analysis of conditions I and III, which eventually evolve to $x=1$ and $x=0$ , respectively. Comparing the two curves of $\alpha =0.5$ , $\beta =0.9$ and $\alpha =0.3$ , $\beta =0.7$ , when condition I is met, increasing the profit and loss coefficient will accelerate the evolution rate. Comparing the two curves of $\alpha =0.08$ $\beta =0.16$ and $\alpha =0.06$ , $\beta =0.12$ , it can be found that increasing the profit and loss coefficient will slow down the evolution of condition III. Obviously, $x=0$ means a full-scale attack by invaders, which help operators to grow. $\alpha =0.08$ , $\beta =0.16$ and $\alpha =0.06$ , $\beta =0.12$ indicate that the invaders do not voluntarily reduce the profit and loss to maximize the profits. If operators want to reduce the attack level, they should rely on improved defense measures to reduce the probability of invaders damaging the system and passively accept the low profit and loss coefficient.

Influence of operators’ controllable parameters $C_3$ on the system evolution

Similarly, other control conditions remain unchanged, and four sets of data satisfying conditions V and VI are taken respectively as $C_3=0.2$ , $C_3=0.38$ , $C_3=1.5$ , and $C_3=2$ . The evolution of operators’ policy choice under different conditions is simulated as shown in Figure 5.

Figure 5.

Influence of operators controllable parameters $C_3$ on the system evolution.

The four curves represent the changes of operator strategy choice over time under different conditions. The simulation results are in line with the game analysis of conditions V and VI and finally evolve to $y=1$ and $y=0$ , respectively. The curve shows that changing the investment can change the evolution path, but the evolution rate does not change significantly.

Influence of regulators controllable parameters $P_1$ and $P_2$ on the system evolution

Other conditions remain unchanged, and two sets of data satisfying condition VII are taken, respectively, as $P_1=0.5$ , $P_2=2$ and $P_1=1$ , $P_2=3$ . Two sets of data satisfying condition VIII are taken as $P_1=1.5$ , $P_2=4$ and $P_1=2$ , $P_2=4$ , respectively, the evolution of regulators’ strategy choice under different conditions is simulated, and the results are shown in Figure 6.

Figure 6.

Influence of regulators controllable parameters $P_1$ and $P_2$ of on the system evolution.

The four curves represent the changes of regulators strategy choice over time under different conditions. The simulation results are consistent with the game analysis of VII and VIII, and eventually evolve to $z=0$ and $z=1$ , respectively. Comparing the curves of ( $P_1=0.5$ , $P_2=2$ ) and ( $P_1=1$ , $P_2=3$ ), under condition VII, increasing the punishment will slow down the evolution rate. Comparing the curves of ( $P_1=1.5$ , $P_2=4$ ) and ( $P_1=2$ , $P_2=4$ ), increasing punishment will accelerate the evolution in condition VIII.

In the three-party game, based on the unilateral perspective (only changing the controllable parameters of one party), each game can adjust the parameter by changing its own technical means and measures to affect the evolution direction of the game, so that the game can evolve in its own favorable direction. This means that the gradual increase of investment by operators and the increase of punishment by regulators can effectively suppress intrusion. In addition, when the regulators change from extensive management to refined management, the increase of regulatory intensity will be strengthened to improve the probability of detecting invaders.

Ideal state definition and evolution path modification

According to the behaviors of the three-party game strategy, combined with the practical significance (social development needs), the evolution path that managers hope is that invaders’ strategy is a general attack; the operators’ strategy is advanced defense, and the regulators’ strategy is fine management to improve the low level of operators’ defense and regulatory management. Accordingly, (0, 1, 1) is the most ideal state.

Through the above analysis and simulation, the correctness of the model can be verified and the evolution results of some game systems can be obtained: the game status of the current system is (1, 1, 0), where invaders launch strong attacks, operators have advanced defenses and regulators have extensive management. However, this is far from the ideal state. To achieve the ideal state, the controllable parameters need to be adjusted to form a new evolutionary game system. Taking the controllable parameters as variables and restricting the evolutionary conditions to conditions II, V, VII or III, V, VII, Eq. (16) is obtained by simultaneously replicating the kinetic equations.

$$\{\begin{array}{c}\{\begin{array}{c}y<(C_1-C_2+A(\alpha -\beta ))/A(2\alpha -\beta )\\ 2\alpha -\beta >0\end{array}\mathrm{or}\{\begin{array}{c}y>(C_1-C_2+A(\alpha -\beta ))/A(2\alpha -\beta )\\ 2\alpha -\beta <0\end{array}\\ \begin{array}{c}A((\beta -2\alpha )x+\alpha )>C_3-((1-\lambda )P_{2}z+\lambda P_2+e)(1-x)\\ y<(P_1+P_2-C_4/(1\text{-}\lambda ))/P_2(1\text{-}x)\end{array}\end{array}$$

(16)

Substituting the simulated data into Eq. (16) and the following solution is obtained:

$$\{\begin{array}{c}2\alpha -\beta \ne 0\\ \alpha <\beta <0.2\\ 1.5\beta +0.75P_2+0.1>2C_3\\ P_1+0.75P_2>4\end{array}$$

(17)

Consequently, $2\alpha -\beta \ne 0$ and $\alpha <\beta <0.2$ represent that only when the profit and loss coefficient decreases to a certain extent, the invaders can give up a strong strategic attack. $1.5\beta +0.75P_2+0.1>2C_3$ indicates that when the investment is lower than a certain value, the operator can satisfy the maximum benefit and evolve to advanced defense. Since the profit and loss coefficient of the invader is related to the defense of the operator, the investment of invaders should be as large as possible within a reasonable range.. $P_1+0.75P_2>4$ indicates that the punishment of regulators should be higher than a certain value to balance the benefits of punishment and investment, and eventually evolve to refined management.

The new parameters $\alpha =0.05,\beta =0.12,C_3=1.6,P_1=1.2,P_2=4$ satisfying Eq. (17) are taken for simulation analysis. The simulation game change results of the new system are shown in Figure 7, which are consistent with the above analysis and the new system evolutionary game can be realized.

Figure 7.

Strategy selection probability (a); Change trend of the three-party strategy over time (b).

As shown in Figure 7, the game result can be realized as (01,1) under the new system with modified parameters, where invaders evolve into general attacks, operators evolve into advanced defenses, and regulators evolve into fine management.

Scheme comparison

To prove the advantages of this model, the comparison between this model and other models is shown in Table 12. This model has advantages in the selection of game players, game theory analysis, and system correction and has greater practical significance.

Table 12.

Comparison of models and methods.

Model	Subject	Precondition	Solution	Applications	Evaluation	Value
Aydeger et al. (2021) 14	Network attack and defense	Complete rationality	Stealthy Link Flooding Attack situational Cybersecurity	Realize network system defense and security defense	The best defense strategy can be obtained, but the conditions for complete rationality are harsh and the players are single, which has limited practical significance	Low
Dahiya and Gupta (2021) 18	Multiple users, opponents	Complete rationality	DDoSNetwork system security in the context of DDoS attack	Security defense of multiple network nodes	Combined with Bayesian probability optimization node information, the best defense strategy can be obtained; the conditions of complete rationality are harsh, and the probability quantification of malicious nodes is not easy to achieve	Medium
Li et al. (2018) 21	E-commerce enterprises and consumers	Bonded rationality	Information security in E-commerce	E-commerce information security	No evolutionary path analysis was conducted, and the game players are not rich enough	Low
Li (2022)	Between multiple enterprises	Bonded rationality	Information security investment of sharing platform	Security of platform information sharing	Only considering the game between two enterprises	Medium
Qu and Hou (2020) 20	Platform, users and government	Bonded rationality	Platform information security governance	Platform information security	In practice, users cannot participate in the game, and the determination of the game subject is not rigorous	High
This paper	Invaders, operators and regulators	Bonded rationality	Data leakage of operators	Data leakage of operators	Considering that users do not participate in the game, the game system is updated, making the players more complete and the model more perfecto solve the best strategy and optimize the system	Higher

Conclusion

This article discusses how to reduce hacker attack level and reduce the investment of regulators and operators to achieve maximum protection of data security and development of information security. Based on the three-party evolutionary game model, a three-dimensional replication dynamic system is constructed, and the system stability is analyzed from the perspective of individual and the whole entity. Finally, the analysis results are verified by parameter simulation, and the evolution path is modified.

Under the assumptions of the model, that is economic man hypothesis, bounded rationality hypothesis, behavioral strategy hypothesis, and interest relationship hypothesis, the following conclusions are drawn:

(a) The profit and loss coefficients of attack and defense are set according to the uncertainty of the damage of intrusion system and data leakage to quantify the degree of leakage; (b) The evolution of the three-party game is not related to the fixed profit of operators and the profit and loss of government performance. There is no stable central equilibrium point in the game system, which means there is no mixed strategy to balance the interests of the three-party (the evolutionary game result will be a pure Nash equilibrium strategy); (c) In the current system, the initial intention of the three-party in the game will not change the evolution direction. Changing the original intention cannot break the interest relationship, and the profit drive and evolution direction are unchanged, the game results will eventually form the stability of invaders’ strong attack, operators’ advanced defense, and regulators’ extensive management; (d) From the perspective of unilateral (only changing the controllable parameter of one party), the stolen data of invaders, the investment of data protection, and the punishment intensity of regulators can be adjusted to make the game evolve in its favorable direction; (e) From the perspective of the whole system, the game result (01,1) can be achieved in the new system after parameter modification, that is, invaders evolve into general attack, operators evolve into advanced defense, and regulators evolve into refined management. At the same time, the evolution should satisfy the following four conditions: $2\alpha -\beta \ne 0$ , $\alpha <\beta <0.2$ , $1.5\beta +0.75P_2+0.1>2C_3$ and $P_1+0.75P_2>4$ .

According to research, some management enlightenment for operators and regulators is obtained as follows:

For operators, the choice of operators’ behavior strategy is related to the punishment $P_2$ of regulators, the input $C_3$ of defense measures, the input e of public relations, and the profit and loss coefficient $\alpha$ and $\beta$ . The impact curve of operators’ cost $C_3$ shows that cost changes can change the evolutionary path, but the evolutionary rate changes little when the costs are increased again. To this end, operators should strive to adjust $C_3$ and control the cost $C_3$ as much as possible within the scope of meeting the cost value, to meet the information security, save costs and maximize the benefits. On the other hand, the impact of parameters $\alpha$ and $\beta$ on the system shows that low profit and loss coefficients $\alpha$ and $\beta$ can effectively inhibit the intrusion behavior. Operators should adopt new technologies and methods to improve system security, reduce profit and loss coefficients $\alpha$ and $\beta$ , and thus reduce losses.

For regulators, the choice of regulators’ behavior strategies is related to the punishment $P_1$ and $P_2$ and the management input $C_4$ . Under the extensive management strategy, the probability of finding hacker behavior is $\lambda$ , and the cost is 0. Under the condition of fine management, the probability of finding hacker behavior is 1, and the cost is $C_4$ . In the process of transforming from extensive management strategy to fine management strategy, regulatory authorities should take more stringent punishment measures on the one hand, and on the other hand, control costs, enhance regulatory intensity and improve the probability of discovering hacker behavior.

The limitations of this paper are as follows: (a) In terms of evolutionary process, players’ strategic orientation is profitable, and in reality, they will give up the strategy when the benefits fail to reach the expectation; (b) The range of punishment $P_1$ and $P_2$ of regulators is calculated according to the theory. The actual regulatory department may be a non-profit organization, and there may be deviation in the profit-oriented strategy; (c) This paper conducts a game study on the main three-party involved in the data leakage incidents, but other interest groups may be involved in the practice, such as data trafficking intermediaries. Therefore, other parties should be included in the subsequent study to make the game system more complete and the research results more in line with reality.