4.2.1. Predator–Prey Model
A model of the evolution of cyberspace is captured in the Systemigram (
Figure 5), but many details about the surrounding ecosystem have been omitted to introduce it in its entirety. Most of these simplifying omissions do not alter the understanding of the model. One additional detail that is essential to a full understanding of the ecosystem, however, is the rest of the population. There are more classes than just the attackers and defenders—there are also “innocent” bystanders that fall into neither class or that may be “recruited” to become one or the other. Through this recruitment the bystanders become attackers or defenders, wittingly or unwittingly. Traditional predator–prey studies and models tend to focus on the two-species model. This ecosystem does not exactly fit that model as there are three “species” to consider (defender, attacker, and uninterested). The predator–prey model can be extended [
25] to give some insight into the dynamics of the ecosystem. Understanding the predator–prey model will illustrate where it can be extended for this ecosystem.
A predator is an organism that eats another organism; the prey is the organism being consumed by the predator. These terms are almost exclusively used to describe animals, but the same concept can be applied to plants when resources are considered, such as nutrients and water. The prey is part of the predator’s environment and is necessary for the health of the predator. The predator will evolve to ensure the prey can be caught—speed, camouflage, stealth, heightened senses, etc. As can be imagined, “arms races” can ensue. Predation is the oldest ecological model and perhaps the most studied. The Italian mathematician Volterra formalized his observations about fish using the same equations Lotka used in his theory of autocatalytic chemical reactions. The model has become known as the Lotka–Volterra model and expresses the relationships of the predator (
x) and the prey (
y) in these two differential equations:
This model makes a few simplifying assumptions:
Prey has no food restriction, so that death is either natural or at the hand (or teeth) of the predator;
The food supply of the predator is solely the prey (only two species);
The environment does not favor one species over the other;
The rate of population change is proportional to its size;
Predators have a limitless appetite.
The use of differential equations allows for the overlapping of the two populations, where the rate of change of the prey (dx/dt) is its growth rate (α) minus the rate of predation (β), and the rate of change of the predator (dy/dt) is its growth rate (δ), which is related to, but not the same as, the rate of predation, minus the death rate (γ). The solutions to these equations are periodic, where a decrease in one population enables an increase in the other until some point at which the tables turn.
It can be easily seen that this model does not apply to the situation in cyberspace. The simplifying assumptions do not translate, and the model does not allow for a reversal of roles where the prey simply becomes a predator, and vice versa. This reversal, as seen in the Cyber Warfare Systemigram (
Figure 5), is an integral part of the model. Other models have been used to describe predator–prey relationships that do not account for the essential parts of the digital ecosystem being described, such as competition for prey [
26,
27], predator harvesting [
28], three species predation chains, or coupling [
29] where the harvest rate of the prey is considered.
The traditional predator–prey model is a two-species model and, as such, cannot adequately be used to describe the population of cyberspace, which is (minimally) a three-species model. Work has been done to extend the Lotka–Volterra model to more than two species [
25]:
where
xi represents the
ith species and
Aij represents the effect that species
j has on
i.
This extension of the Lotka–Volterra model exhibits stable, periodic, or chaotic behavior, depending on the interaction matrix of the species. Experiments with this model have indicated that agent-based modeling may be superior in the description of higher order populations where each individual, or individual archetype, can be represented explicitly.
Closer to the realm of cyberspace attacks with the notion of infection and transmission, the Lotka–Volterra model extension for the description of infectious disease was first described by Kermack and McKendrick [
22]. The Kermack–McKendrick model describes the relationship between susceptibles (
S), infectives (
I), and the recovered/removed (
R), and it was first applied to epidemics and then to endemics. Initially the model included structuring the population of susceptibles based on age, but when the transmission rate is held constant for all ages, a generalized model (SIR) could be described:
The SIR model can be solved for various cases, with or without demographics (birth and death rates) [
30]. It has been extended to include the concepts of a carrier (C) and an exposed (E) segment of the population. Additional models have been shown to include immunity, both temporary and inherited. These models are used to describe the spread of infectious disease and the effect of vaccination in populations [
31].
The concept of recruitment has been examined in the context of marine life, where the populations are demographically open and the rate of population growth is dependent on both the birth rate and the recruitment rate [
32]. The recruitment rate has been experimentally observed to be independent of the spawn or birth rate [
33]. This indicates that a new parameter must be introduced to properly describe an increase in a population based on recruitment.
This recruitment parameter is essential to the cyber warfare ecosystem, as uninvolved members of the population will be available for recruitment by both defenders and attackers. The remaining parameter required to adequately describe the cyberspace population is one to represent conversion, where an attacker becomes a defender and vice versa. Conversion is foundational to the understanding of the ecosystem model. Converting prey into predator and vice versa is not a concept that is dealt with in biological population dynamics as it is outside the “normal” realm of ecology.
4.2.2. Zombie Model
The SIR model has been extended to include a conversion of prey into predator through a consideration of zombies [
34]. The modified SIR, or SZR model, is composed of three basic classes:
Susceptibles (S);
Zombie (Z);
Removed (R).
In this basic model, the removed individuals are those who have died through attack or natural causes. The parameter for the case of deceased resurrecting into a zombie is ζ; for a normal death, the parameter is δ. Susceptibles become zombies through transmission (parameter β) and zombies can be destroyed (parameter α) by clever susceptibles, which adds them to the removed class. Susceptibles, in the basic model, can only be produced through the birth rate (there is no cure). The birth rate (parameter Π) is held to be constant.
Given these conditions, the SZR model is expressed by the following differential equations:
If the timescale is taken to be short, the birth and death rates can both be ignored (
Π =
δ = 0). This simplification allows for the determination of the equilibrium points. In Munz’s treatment, it is shown that human–zombie coexistence is impossible, and the disease-free equilibrium is always unstable. If the model is revised to consider latency in the infection—transformation to a zombie takes some time—then an additional class of individual is introduced to the population, the infected. The transformation is captured by the parameter
ρ. This creates a different model, the SIZR model, which reflects the case where an infected individual (
I) can either die naturally or become a zombie.
The disease-free equilibrium of this model is also unstable, and it is only a matter of time for the population to be overtaken by zombies. The researchers pressed on to discover a model that might introduce some desirable stable equilibrium by introducing quarantine (
Q), where infected individuals and zombies are removed from the population (parameters
κ and
σ, respectively). Quarantined individuals cannot infect others while they remain quarantined. The possibility of escape exists, but escapees would be killed (parameter
γ), putting them in the removed class.
The solution of this model is complex, requiring the introduction of a reproductive ratio. The two equilibria can be shown to be stable if the quarantine rates are high enough to ensure that the reproductive rate is less than one. The second equilibrium shows that eradication depends critically on the quarantine of those in the primary infection, as zombies can infect humans faster than humans can kill them.
The final model of interest includes the concept of a cure (parameter ς). This removes the quarantine class as it is no longer needed. An assumption is made that the cured individual returns to the susceptible population and that no immunity is inferred by the cure. The resulting model is as follows:
These models can be applied to the population in the cyberspace domain. Not surprisingly, many of the considerations for the spread of a zombie outbreak transfer to the world of the cyber warrior.
4.2.3. Cyberspace ODU Model
The terms “attacker” and “defender” are overloaded and carry heavy contextual connotations of good and bad. For this reason, the active participants in the cyberspace model will be referred to by the position they are currently occupying—uninterested, offense, or defense. This cyberspace model (
Figure 6) is then composed of three basic classes:
Uninterested (U);
Defense (D);
Offense (O).
In the basic model, the uninterested are the class of individuals who are not actively on offense or defense. The total population of cyberspace, N, is taken to be the sum of the three classes of individuals. The birth rate (parameter Π) is held to be constant; for death, parameter δ is independent of the class of individual to whom it is being applied. Offense can be recruited from the uninterested (parameter β) or they can be converted from defenders (parameter γ). Defenders can likewise be recruited from the uninterested (parameter α) or they can be converted attackers (parameter ε). A distinction is made between the conversions between offense to defense and of the recruitment from the uninterested to either role. Each of these population-adjusting actions is given a different rate parameter since they would not be equivalent. It is assumed that neither class of individuals willingly converts to the uninterested.
Given these conditions, the UDO model is expressed by the following differential equations:
The first-order differentials, describing the population change over time, satisfies the condition
The total population in cyberspace is growing, and so it can be shown that
over a sufficiently long period (barring population-destroying catastrophic events). A limit will be reached due to resource limitations, but it is suspected that the equation at hand will reach equilibrium long before that limit is reached, so
U does not approach infinity. By reducing the period of interest, we can hold the birth and death rates to be equal,
, resulting in
Setting the resulting individual equations equal to zero gives the following:
These models highlight the fact that the population of U will be depleted: everyone will become involved in cyberwar. The equilibrium, if one exists, will be between the populations of offense and defense. The illegal nature of cyber-attacks makes it necessary to consider that there is a portion of an attacker (offensive) population (ρ) that would return to the uninterested state forcibly via arrest (the “cure” from the zombie model above). The addition of this parameter for arrest, or incarceration, indicates that unless this rate is extremely high, the population of the uninterested will still be depleted.
The URDO model shown in
Figure 7 has two possible outcomes for the recruited where Munz’s zombie model only has the single outcome of becoming a zombie. Dual outcomes significantly complicate the determination of the equilibria of the model. A simplification is introduced here so that the rate of recruitment (passing from R to either O or D) is the same (
α =
β). This model assumes that the individual decides at the point of conversion to change their class and does not change their mind during the recruitment time interval. In this case, the rates determining the increase of recruits (
γ and
ε) become the critical factors for equilibrium.
The equations become
where
Retaining the term
ψ, the Jacobian [
U,
R,
D,
O] for this model is
The total population,
N, is simply the sum of all classes of individuals. The first equilibrium then is at [
N, 0, 0, 0], the point where all individuals are uninterested.
The eigenvalues are λ = 0, −β, −γ, and −ρ. Since all the eigenvectors are non-positive, the equilibrium where all individuals are uninterested is stable. All other equilibriums possible with this model are unstable.
This model does not consider delays that would occur for recruitment, retooling, and rehabilitation, as would be expected with conversions between various populations. The conversion of an attacker to a defender (and vice versa) in reality is not instantaneous and requires a period of retooling. This “learning” period is also required for the recruitment of the previously uninterested, and in this fashion, resembles the latency of Munz’s SIZR model. These additional factors are considered in the agent-based representation of the model.
4.2.4. Cyberspace QURDO Model
The basic URDO model was extended to include quarantine (
Q) and to separate all the rates of conversion, eliminating the simplifying assumptions made in the URDO model. To represent the perceived time delays that happen because of recruitment and quarantine (arrest), the QURDO model (
Figure 8) was constructed. As in previous models, birth (
Π) and death (
δ) rates are held to be constant and omitted from the equations.
In this model, an individual in an offensive role (
O) can be arrested and converted to a quarantined, or incarcerated, role (
Q). The rate for this conversion is given as
ρO. Quarantined individuals (
Q) can be converted to uninterested (
U), defense (
D), or return to offense (
O). The rates for these conversions are unequal:
χQ represents conversion to uninterested;
ωQ represents conversion to defense; and
φQ represents a return to offense. A delay is included in the model to represent the length of incarceration. An assumption is made in the model that only those in an offensive role will be subject to incarceration (quarantine). The change in the quarantined population over time is then
The uninterested, or uninvolved, (
U) can be recruited to either the offensive (
Ro) or the defensive (
Rd) at the rates of
ψU and
κU, respectively.
To accommodate for the possibility that a recruit might change their orientation, two additional rates are added:
λRd for recruits moving from defense to offense, and
τRo for those moving offense to defense. A recruitment time for each type of recruit (
Ro or
Rd) is included in the model. This parameter is meant to represent the time it would take for an individual to become skilled at either offense or defense. If the skill level of the individual is considered, additional divisions of the population become necessary. An additional parameter set could also be added to reflect unwitting recruitment. Such granulation of the population only serves to complicate the model and does not contribute to the generalities being drawn here. Consideration of the resources that could influence the rates of flow between roles is similarly omitted in this model. The conversion from uninterested to defender (represented by rates
κU and
αR) occurs at a different rate than that of conversion to attacker (represented by rates
ψU and
βR).
To allow for the oscillation of an individual between the offense and defense roles, two paths are available. An individual not previously trained in the destination role will require “retooling” and is therefore passed through the recruit role with the rates of
γD (defense to offense recruit) and
εO (offense to defense recruit). If an individual is previously trained in the destination role, a “retooling” period will not be necessary, and the conversion is captured by the rates
ηO (offense to defense) and
σD (defense to offense).
4.2.5. NetLogo QURDO Model
The complexity of this QURDO model is such that a mathematical solution is unreachable. An agent-based model was developed that enabled experimentation of the interdependencies of the model parameters. Each of the rates shown in
Figure 8 is included as a parameter that can be adjusted by the user through a slider control on the interface. The model variables that can be controlled include:
Total population;
Percent population offense;
Percent population defense;
Conversion rate of offense to defense;
Conversion rate of defense to offence;
Time to recruit offense to defense;
Time to recruit defense to offense;
Time to recruit uninterested to defense;
Time to recruit uninterested to offense;
Arrest rate;
Incarceration time;
Percent incarcerated rehabilitated to defense;
Percent incarcerated rehabilitated to uninterested.
The percentage of incarcerated rehabilitated to offense is calculated automatically as the remainder of the balance of the incarcerated after the specified rehabilitation has been applied.
Initial runs of the model were done with the (arbitrary) default settings (see
Table 1). These initial rates were set as estimates of the anticipated behavior of the actors in cyberspace and reflect the researcher’s assumptions made about cyberspace with respect to recruitment.
The population begins with the ratio of defense to offense set at 50:10. (The population of uninterested is computed as the remainder of the total population.) It is assumed that it takes more time to recruit someone to an offensive role, and that the recruitment rate of uninterested to defensive is the same as that of recruitment to offense. An arrest rate is represented in the model very simply. It is assumed that only people on the offense will be arrested and become quarantined (incarcerated).
ask off-team [ if ( random-float 100 < arrest-rate ) [ become-qua ] ]
A distinction is made between the defense recruits and the offense recruits to insert a delay for “retooling”—the learning required to become a member of the offense or defense—and additionally allow for different rates of successful conversion. (There is no provision in the model for failure to convert once recruited.) Recruits are developed based on the recruitment rates uni-to-offense-rate and uni-to-defense-rate:
ask uni-team [ ifelse (random-float 100 < uni-to-offense-rate ) [ become-rec-O ] [ if ( random-float 100 < uni-to-defense-rate ) [ become-rec-D ] ] ]
Output graphs of the initial population sensitivity studies are shown in
Figure 9,
Figure 10 and
Figure 11, where
Figure 9 shows a population of 100,
Figure 10 a population of 250, and
Figure 11 a population of 500. Each was run for approximately 500 ticks (time increments in the simulation). The population size does not appear to affect the behavior of the variables with respect to one another. This is expected as no assignment to a population group relies on the contact (or collision) of two individuals, rather, it is calculated as a percentage of the current population. A smaller population is expected to converge more quickly, which is what was observed. The runs of the simulation for each population size showed a similar pattern of progression. The defensive population (shown by the green line) decreases initially and then gains slowly. The uninterested (gray) population decreases sharply in all the simulation runs. The population of attackers (blue) initially increases with the shape of the curve consistent regardless of the population size. The incarcerated (red) initially rise steadily, as do the two populations of recruits—recruited to offense (purple) and recruited to defense (teal).
Runs with the default settings were conducted for longer times. The longest run (66,513 ticks) is shown in
Figure 12. The model demonstrates that a stable but oscillating population occurs after the uninterested have been recruited. The proportion of the population that is incarcerated oscillates: the magnitude, frequency, and periodicity are observed to be dependent on the
arrest-rate and
incarceration-time variables.
The default values for the recruitment rates result in a small percentage of the population ever being in a recruited state.
Figure 12 also illustrates what appears to be an increase in defense resulting from a decrease in the incarcerated (quarantined). This is expected based on the
reahab-to-def rate used, which is more than three times that of the
rehab-to-off rate. Moreover, the increase in the incarcerated is reflected in the decrease in the offensive population, as that is the only population against whom the
arrest-rate is applied.