A Two-Period Game Theoretic Model of Zero-Day Attacks with Stockpiling

Round 1

Reviewer 1 Report

This paper introduces a two-period game theoretic model with two players; one has a role to attack and the other defends. However, it is very hard to follow the manuscripts due to poor English quality. It is too poor to understand the meaning of the expressions and figures for the readers. I recommend that this paper should be corrected entirely and resubmitted.

Author Response

Please see attachment.

Author Response File: Author Response.docx

Reviewer 2 Report

1. The paper addresses an interesting problem using a game theoretic model. It is potentially of interest to both the cyber security and game theory communities.
2. References to sections, figures, tables etc are either missing or not properly formatted. It seems that the authors have not gone through the paper before submission. 
   
   I did not check the formulations and especially solutions due to the above reasons. It is highly suggested that the authors go through the paper closely and re-submit. It makes reading extremely challenging without proper references to figures, tables, sections etc. 
   
   
3. More justifications on the model at period 2 are appreciated.
4. In abstract, I appreciate the authors trying to list the key take-aways. It would be good to deliver it in a more high-level way. There is not a lot of background given on what the type of game theoretical model is used, what is the zero-day appreciation factor. Most importantly, it would be great if key insights can be summarized on what key factors are affecting the decision making.
5. The discussion of existing literature is abundant. One recent reference that runs through my mind that is missing (it also studies vulnerability exploits in a game theoretic framework): Chen et al. "Disclose or Exploit? A Game-Theoretic Approach to Strategic Decision Making in Cyber-Warfare." IEEE Systems Journal (2020). Would be good to discuss the similarity/differences.

   Also, I suggest the authors categorize the literature instead of going over them one by one. This provides more insights on the current status of this line of research.

6. The two figures illustrating the pipeline of the game are good. Some of the texts are not properly formatted and appear broken. 

7. Strangely, there are two systems to denote the equations. On page 7, equation (1) is followed by equation (9)
   
   

8. Eq. (16) goes outside of the text

Author Response

Please see attachment.

Author Response File: Author Response.docx

Round 2

Reviewer 2 Report

The authors have addressed my comments and I think the paper is good to go.

Author Response

Please see attachment.

Author Response File: Author Response.docx