Inspection games for selfish network environments

1 Inspection Games for Selfish Network Environments Gabriele Gianini1 , Tobias R. Mayer2 , David Coquil2 , Harald Kosch2 and Lionel Brunie3 1 Dipartimento di Tecnologie dell’Informazione, Universita degli Studi di Milano, Italy [email protected] 2 Distributed Information Systems, University of Passau, Germany {tobias.mayer,david.coquil,harald.kosch}@uni-passau.de 3 Laboratoire LIRIS, INSA de Lyon, France [email protected] Technical Report, Number MIP-1203 Department of Informatics and Mathematics University of Passau, Germany May 2012 2 Inspection Games for Selfish Network Environments Gabriele Gianini1 , Tobias R. Mayer2 David Coquil2 , Harald Kosch2 and Lionel Brunie3 1 Dipartimento di Tecnologie dell’Informazione, Universita degli Studi di Milano, Italy [email protected] 2 Distributed Information Systems, University of Passau, Germany {tobias.mayer,david.coquil,harald.kosch}@uni-passau.de 3 Laboratoire LIRIS, INSA de Lyon, France [email protected] Abstract Current distributed information system consider only typical fault-tolerance techniques for reliability issues. Selfish peers, which deviate from the collaborative protocol to increase personal benefit, may also harmfully affect the goals of networked architectures. Securing the collaborative protocol would be an option, however, this may not be always possible or wanted. Then, a post-hoc assessment, deployed by the system designer, could monitor the correct behaviour of the participants without affecting the actual system’s functioning. Due to limited resources, a complete monitoring is not possible: typically monitoring is done by sampling by sampling so that misbehaviour in some case can go undetected. At the same time, a selfish peer’s decision to violate also depends also on the monitoring rate of the inspecting parties. This forms an interdependent interaction landscape, which corresponds to a class of games known as Inspection Games. In this paper, we discuss the practicability of Inspection Games for networked architectures for system analysis and design. To this end, develop generalized Inspection Game versions up to m inspectors and n inspectees, starting from a simple two-player game; we further provide solutions (i.e. Nash equilibria) for all games. Afterwards, these games and solutions are adapted towards an application to networked architectures. This is done by extending them to the possibility of false negatives (the performed inspection on a player’s behaviour does not detect a deviation from the protocol which has actually occurred, due to the intrinsic failability of the inspection technique). I. I NTRODUCTION A. Context Until recently, distributed systems were typically realized by means of an enactment of a collaborative protocol over networked nodes, being enriched – to some degree – by fault-tolerance mechanisms. In that approach, the protocol designer needs to find a balance in the trade-off between the degree of attainment of the network goals and the level of resource consumption as a whole. That approach is not adequate to face the challenges of today’s networks, among other reasons as a consequence of the fact that nodes are very likely to be operated by selfish parties, whose goals and interests are typically not aligned: selfish nodes could make use of their specific knowledge to perform undetected violations with regard to the protocol in order to follow personal interests. Such a selfishness in the collaborative interaction may affect the correct system functioning and can also be considered as an attack [1], [2]. Thus, modern systems should not only consider fault-tolerance issues but also selfishness as a possible relevant issue. Securing the system functioning against selfish behaviour could be realized by directly hardening the collaborative protocol. However, in order to take into account real world constraints, a modification of the protocol may not be possible or not wanted. Therefore, we assume the system designer’s has the possibility of deploying timely ex post monitoring with the collaboration of network participants. 3 Game Theory (GT) enables the modelling of such an interdependent decision landscape, where a system consists of selfish peers or players with non-aligned interests. GT is able to model systems of strategic player, choosing an operation strategy (e.g. violate or not violate) to attain their personal goal(s) considering that the other players will also do so. By means of GT, we are able to predict the player’s behaviour under specified circumstances and to calculate the solution of the game, i.e. the Nash equilibrium. This is a strategy profile (a collection of strategies, one for each player), from which no player has incentives to deviate since it would reduce the personal payoff. In this frame, the system designer is able to influence the equilibrium by assigning positive or negative incentives. Such incentives can move the game’s equilibria and may be purposefully specified to reach a desired strategy profile, i.e. towards a desirable overall system state. Ex-post monitoring can be mapped to a specific class of GT models: Inspection Games. In this type of games an inspector controls the correct behaviour of an inspectee, which takes place by an inspection, while a punishment may be induced by the inspector if a misbehaviour is detected during the inspection. This similarity to the monitoring approach makes it to a candidate to model the interdependent decision landscape for system analysis as well as design, i.e. to set appropriate parameters for desired Nash equilibria in the networked architecture. B. Example Scenarios Before going into the details of Inspection Games, we shortly motivate its application by outlining two related example scenarios. 1) Scenario 1 – Video Streaming Application: Imagine that a service as Youtube offers commercial rentals of videos, which is realized in a peer-to-peer (P2P) manner. The Youtube servers may act as data publisher, providing an initial transmission of a movie and the consumers participate in the dissemination by also transferring parts of the movie file to other consumers interested in watching it at the same time. This would, especially in peak times, lower the burden of the Youtube servers and generally reduce costly resources for the communication infrastructure (bandwidth, server etc.). P2P-based video streaming gained indeed much attention by the research community in the passed years and several approaches can be found in the research literature. In this frame, peers operated by egoistic users could be modified to spare own resources by not forwarding network packages, for example to receive the movie in an appropriate speed for watching during consumption peak times or to reserve the resources for other programs running in the background. 2) Scenario 2 – Distributed Social Communication: Diaspora1 is an alternative social communication platform realized – in contrary to common alternatives such as Facebook – as a distributed system. Indeed, it integrates other social networks (e.g. Facebook, Twitter, Tumblr) and may act therefore as hub for social media communication. Such a frame – if not sufficiently secured – can leave room to selfish behaviours. For example, egoistic peers could systematically alter relayed information for strategic reasons (imagine for example political elections or reports from crisis regions). In this scenario, the Inspection Game could serve as a mean to give collaboration incentives by the model inherent inspections and its corresponding punishment of a detected violation. Thanks, to the game mechanics, a game designer is able to calculate cost-optimal (in terms of used resources for performing inspections) system parameter to reach a targeted level of collaboration. C. Problem and Approach In this paper we consider the situation where a networked architecture is deployed over selfish peers, which may deviate from a collaborative protocol in order to obtain a personal benefit. Instead of securing the protocol itself we assume an ex-post added monitoring of the correct collaboration of all parties in the network with detected violations being punished to some degree. This set up corresponds to a class of GT models known as Inspection Games. Initially, it was introduced by Dresher [3] and formulated as two-player game in the context of arm control and non-proliferation, where an inspector verifies by means of inspections that an inspectee complies the rules of the game, 1 http://diasporaproject.org/ 4 whose he is interested to violate in order to gain additional benefit. The inspector has only limited resources and a complete surveillance of all inspectee’s actions is practically not possible. Therefore, inspections take place in form of a randomization schema optimal in a sense to the inspector, which is analogue to the sampling for the networked architecture. Similarly, the inspectee deviates to some degree from the protocol to follow a selfish goal. The strategies, which are optimal in a sense to both players, represents the Nash equilibrium – the solution of the game. However, this solution is not necessarily optimal in terms of the goal of the networked architecture. In the context of distributed systems as discussed in this paper, the monitoring (or the inspections) could be enacted by a (sub-)set of parties participating at the collaborative protocol or by trusted third parties. Here we assume the latter case, i.e. inspectors are placed on independent machines working on the systems administrator’s behalf. The system administrator is also assumed to hold the role of a game designer: he is able to tune the game parameters such as positive and negative incentives or further details of the inspection procedure so as to shift the equilibrium to a desired strategy profile. This paper intends to support the modelling of an ex-post added monitoring of the adherence of a network communication protocol based on relayed messages, forming a theoretical base to support an application to distributed communication infrastructures. To this end, we introduce at first a standard versions of the Inspection Game, then generalized to multiple inspectees and multiple inspectors and compute their Nash equilibria. In a next step, we adapt the games to communication infrastructures by adding the possibility of false negatives, i.e. non-detected violations during inspections. D. Paper Structure The remainder of this paper is structured as follows. The next Section II will at first provide some related work. In Section III we outline at first a basic two-player Inspection Game. Then, in Section IV, this game is generalized step by step to a game with m inspectors and n inspectees, and the corresponding Nash equilibria are provided. Section V discusses then the adaptation of abstract game towards games on communication architectures. In Section VI the games are extended with the possibility of false negatives. A short discussion, in Section VII, concludes the paper. II. R ELATED W ORK GT gained wide attention by researchers of computer science (e.g. [4], [5]). Since several years, research community targeted to apply GT to communication systems [7] and indeed, a multitude of works can be found in the GT literature (sse for instance [8], [9]). An overview to this broad field of applying GT to communication infrastructures can be found in several surveys or books such as [10], [11], [12], [13]. Very often, the given approaches consider the collaborative aspects in such systems, whereas the modelling can also be done from a non-collaborative point of view. Inspection Games fall in the latter category. Inspection Games have been introduced by Dresher [3], being characterized among others as a two-player zero-sum game, which has been attracted more research in the following years (e.g. [14], [15], [16], [17]). In a recent survey, Chung et al. [18] proposed a taxonomy putting into focus the three main components of the Inspection Game, which comes here under the name Searcher and Target game: the searcher player (inspector), the target player (inspectee) and the environment. The possible characterization of such games as defined by the taxonomy structured around these three entities are manifold, which is also valid for the terms denoting this type of game. Inspection Games come also – in addition to Searcher and Target – under several dramatic names such as Cop and Robber, Guard and Infiltration or Patrolling Games. Despite this diversified work, there is, to the best of our knowledge, no work available that provides appropriate theoretical foundations to support an application of Inspection Games to networked architectures by means of a players’ behaviour analysis in order to enable a collaboration enforcement. III. A BASIC T WO - PLAYER I NSPECTION G AME : D EFINITION AND E QUILIBRIA Game Theory (GT) is a branch of applied mathematics that models multi-person decision-making situations in order to account for interactions among strategies of rational decision makers. It is 5 principally aimed at determining the preferred combination of strategies that will be adopted by rational agents trying to maximize their payoffs. In this context, an Inspection Game represents a specific class of games that can be found in the GT literature. It consists of a set of players, and, for each player, a set of possible strategies and a player’s utility function – mapping any possible state of affairs in the game into a payoff for the player. A strategy for a player is a complete plan of actions in all possible situations throughout the game, the goal of every player consists in adopting the strategies maximizing his own payoff, by taking into account that they depend, through the state of affairs, also upon the other players’ chosen strategy. The Nash equilibrium is a solution that describes a steady state condition of the game; it corresponds to a combination of strategies (a strategy profile) such that no individual player would be better off by changing his own strategy unilaterally. Let us consider one of the simplest forms of the Inspection Game, the two-player simultaneous single-round Inspection Game. Here, the set of players consists in {Inspector , Inspectee}. Since the game is single-round, each player chooses only once a strategy for the game, which is done without the knowledge of the other player’s chosen strategy (simultaneous). The inspector can choose between inspecting or not inspecting, i.e. the set of inspector’s choices is {Inspect , Do not inspect}. Similarly, the inspectee can choose between violating or not violating, i.e. an operation of the set {V iolate , Do not violate}. This determines four possible states of affairs. Here, for the Inspection Game the individual preferences of a player’s choice between the two strategies is represented by probability values: an inspector chooses an inspection probability q and the inspectee an violation probability p. Each party’s strategy at equilibrium is also called indifference strategy, because it is such that the other party’s expected payoff will not change whatever mix of his own pure strategy is adopted. Suppose that the inspectee adopts the violation choice with probability p, and that the inspector adopts the inspection choice with probability q. Then, the solution of the game can be found by computing the pair (p, q) such that neither the inspectee can improve his expected payoff by deviating from p, nor the inspector can improve his expected payoff by deviating from q. In the remainder of this work, the indifference strategies will denoted by q ∗ and p∗ respectively, and thus, the solution of a game by ( p∗ , q ∗ ). The game rules make a player’s choice dependent from the other player’s strategy. At each time the game is played an inspectee has the choice between violating or not (the collaborative protocol of a networked architecture), an undetected violation will bring him a benefit. At each time the game is played also an inspector has the choice between performing or not an inspection: if he does and finds evidence of the violation then the inspectee receives some form of sanction. However, the inspection, whatever the inspection findings, has a cost. Hereafter, we will indicate the number of inspectees by n, the number of inspectors by m: an Inspection Game with n inspectees and m inspectors will be indicated by G(m, n). IV. F ROM A T WO -P LAYER G AME TO AN I NSPECTION G AMES WITH S EVERAL P LAYERS Now, we will detail the basic two-player simultaneous single-round Inspection Game G(1, 1) outlined in the section before more formally, generalize it up to a G(m, n) game and provide solutions for all game types. There are several works devoted to the case with one inspector and many inspectees. Already Avenhaus and Kilgour [19] have studied a three-person non-zero-sum game with one inspector and two inspectees in a setting richer than the one considered here. There, the probability of detecting the inspectee’s illegal action is a given function of inspection effort. The authors investigate how the equilibrium depends on the convexity or the concavity of this function. Hohzaki [14] provides a generalization to the case of n inspectees, to the complex case where they are characterized by different attributes and as such may belong to different categories (e.g. countries) and studies how to optimally partition the effort. In our simpler case the effort cannot be partitioned and the probability of detection is not function of detection. Due to these differences, in order to provide the results of our G(1, n), G(m, 1) and G(m, n) games, we present a straightforward re-derivation of the solutions. 6 Figure 1. Inspection Game G(1, 1) for one inspector and one inspectee in extensive form. A. Game G(1, 1) - One Inspector, One Inspectee 1) Game Setup: The game functioning of the basic two-player game is simple: both the inspector and inspectee choose the probability value representing their corresponding strategy, i.e. the inspection probability q and violation probability p respectively. This is done simultaneously without knowing the other one’s choice in the beginning of the game. Each player receives then a payoff depending on the other player’s chosen strategy. While the basic game originally introduced by Dresher [3] had been formulated as a zero-sum game we will – due to the targeted real-world application domain of communication infrastructures – introduce more realistic payoffs, in line with several other application oriented versions of the game. Exploiting the fact that utility functions are defined up to an additive constant we can assume for sake of simplicity the following: (i) The case without violation and without inspection does not bring any damage nor benefit to any player. (ii) Violation will bring the inspectee a positive benefit b if not detected, but, if detected, it will bring him also a loss −a with |a| > |b|. (iii) The inspection has a fixed cost −c for the inspector, but not detecting a violation would cost him a damage −d with |d| > |c|. Notice, incidentally, that the player’s preferences are determined by differences in payoffs; hence, the addition of a constant to the utility function does not influence the solution of the game. The cells of the following Table I represent the four possible states of affairs and the corresponding payoffs for the players: in each cell, the pair (x, y) means that from that state of affairs the first player (the inspectee) obtains a total payoff x, while the second player (the inspector) obtains a total payoff y. Table I T HE PAYOFF MATRIX FOR A TWO - PLAYER I NSPECTION G AME SHOWS POSSIBLE GAME STATES AND PAYOFFS . Inspectee Violate Do not viol. Inspector Inspect Do not insp. ( b − a , −c ) ( b , −d ) ( 0 , −c ) (0, 0) The table represents the Inspection Game in the so called Normal Form: the table rows correspond to the possible moves of the inspectee (the inspectee’s pure strategies), the columns correspond to the possible moves of the inspector (the inspector’s pure strategies). The structure of the game can also be represented in extensive form as shown in Fig. 1. Since b > 0 while 0 > (b − a) the inspectee will prefer to violate when the other does not inspect and will prefer not to violate when the other inspects. Conversely, since −c > −d, the inspector will prefer to inspect when the other violates and not to inspect when the other does not violate. 7 2) Game Solution: Due to this circular structure of the preferences, if the strategy choices have to be taken simultaneously (or equivalently if they do not they do not have any hint about the other party’s move before their own move), the parties cannot determine in advance which one is their own best pure strategy, and they will have to resort to a suitable randomization between the two choices, so as to maximize one’s own expected payoff, taking into account that the other will act accordingly. In other terms, each one will have to adopt a mixed strategy (defined by a probability distribution over the pure strategies). This mixed strategy will have to force the other party (who knows both players are rational) into adopting a strategy which he has no incentives in deviating from. This joint mixed strategy will represent the Nash equilibrium of the game. If the inspectee wants to induce the indifference in the inspector, he will have to set his own parameter p so as to equalize the expected inspector’s payoff for an inspection to the inspector’s payoff for lack of inspection. Similarly, if the inspector wants to induce the indifference in the inspectee, he will have to set his own parameter q so as to equalize the expected inspectee’s payoff for a violation to the inspectee’s payoff for lack of violation. Altogether (−c) q(b − a) + (1 − q)b = = p(−d) 0 from which we get the simple solution ( p∗ , q ∗ ) given by c d b q∗ = a Notice that, by construction, q ∗ is determined by the quantities defining the payoffs of the inspectee and that in the expression, as expected, the benefit b for an undetected violation, at the numerator, compete with the loss a for the detected one. Similarly, p∗ is determined by the quantities defining the payoffs of the inspector and the cost for an inspection plays the opposite role to the avoided damage d. It is worth to remark that the expression for q ∗ is a legal expression for a probability only if a ≥ b, as postulated in the definition of the game, i.e. only if the benefit b for the inspectee for an undetected violation is lower than his loss a for a detected violation. It is worth equally to remark that the expression for p∗ is a probability only if d ≥ c, which is granted by the definition of the game. p∗ = B. Game G(1, n) – One Inspector, n Inspectees 1) Game Setup: Let us consider an (n + 1)-player simultaneous single-round Inspection Game, with one inspector and n inspectees, with the same payoff assumptions as above: (i) No violation and no inspection does not bring any damage nor benefit to any player. (ii) A violation will bring the inspectee a positive benefit b if not detected, but, if detected, it will bring him also a loss −a with |a| > |b|. (iii) The inspection has a fixed cost −c for the inspector, but not detecting a violation would cost him a damage −d with |d| > |c|. We assume each violation causes a damage (to the inspector) so that there is a maximum damage of 2d. In the following, q indicates the probability that the inspector decides to perform the inspection. If he decides for the inspection, than the inspection will be performed on a single randomly chosen inspectee: given the inspection, each inspectee will have probability 21 to be inspected. The inspectees, from now on inspectee 1, · · · , inspectee n, have respectively probability p1 · · · pn of violating the rule. The solution of this game is represented by the values of q ∗ , p∗1 , · · · p∗n of the above (n + 1) parameters at the Nash equilibrium. The tree diagram in Fig. 2 shows the different game result possibilities for n = 2. 8 Figure 2. Inspection Game G(1, 2) in extensive form. 2) Game Solution: Notice that also this game does not have, in general, Nash equilibria in pure strategies. Indeed, the inspector prefers to inspect an inspectee when he violates the rule, whereas the inspectee prefers to violate when the inspector does not inspect. An important point is that there is no coupling between inspectees: the payoff of one inspectee does not depend on the other inspectee’s choices. The inspectees are indifferent to the strategies of one another. Since the players will have to find the equilibrium in mixed strategies, the inspectees will have to choose the strategy which induces indifference in the inspector, and the inspector will have to choose the strategy which induces indifference in the inspectees. The results can be derived through simple considerations. Here, a game designer may utilize an Inspection Game analysis yield to define game rules, or in other words system parameter, that results in a faire system state. This means providing incentives such that a not deviating from the collaborative protocol lies in the personal interest of the network participants. Inspector’s Indifference: For symmetry between the inspectees, one knows since the set up of the problem that their individual parameters will correspond to the same value, that we call p∗ = p∗1 = · · · = p∗n . If the inspectees want to induce the indifference in the inspector, they will have to set their own parameter p so as to equalize the expected inspector’s payoff for an inspection to the inspector’s payoff for lack of inspection. This means that p∗ will have to satisfy the simple equation equalizing • the impact (value times probability) on the inspector for undetected violations due to lack of inspection • with the balance between the impact of an unfruitful inspection and the one of a fully or partially successful inspection. The impact for no-inspection is given by the expected number of the violations of n inspectees times the damage d created by each one: i.e. by np × d. The impact for inspection is given by the constant cost c plus the impact of the violations which have gone undetected. Since in this case the inspector is securing with certainty only one inspectee, the impact of the undetected violations is given by the expected number of violations p of the remaining inspectees. Hence the following impact for the inspection c + (n − 1)pd. The resulting indifference equation is npd = c + d(n − 1)p hence c d Notice that the optimal p is the same as the one for a single inspectee: the presence of further inspectees does not change the best strategy of one inspectee. This is is a natural consequence of the lack of coupling between inspectees. p∗ = 9 Inspectee’s Indifference: At the same time, the inspector will have to make each inspectee indifferent; hence, he will have to equalize the expected payoff for inspectee violation and the expected payoff for non violation. Looking at the structure of the game one can observe that, since inspectees are not coupled to one another by the game’s payoffs, they consider the inspection to another inspectee as equivalent to no inspection at all. Hence, in order to make each inspectee indifferent, the inspector has to behave as if each of them were playing against him an effective two-player one-inspector-oneinspectee G(1, 1) game with rescaled parameters. We can describe this effective game by introducing an effective probability of inspection qef f = nq . The extensive form two player effective game is the same as the one shown in Fig. 2 except that the probability q is substituted by qef f = nq . The inspectee’s indifference is obtained equalizing the impact for non violation, which is null, to the impact of violation, given by the balance between the detected one and the undetected one. In case of violation there will always be a benefit for the inspectee, so the impact is given by b added to the impact of the loss (loss times probability of inspection qef f = nq ). The indifference equation is q b−a =0 n hence b q∗ = a n 1 n The factor results from the fact that one inspector is shared by two inspectees. The reason for no influence on p of the number n of inspectees is due to the lack of coupling among them, whereas the presence in q (resulting from the indifference condition on the inspectees) of a factor n is due to the fact that thanks to the presence of the other inspectees, each inspectee can see this inspection game as a two-player game with effective loss na . C. Game G(m,1) – m Inspectors, One Inspectee 1) Game Setup: Beside the assumptions (i)-(iii) already adopted so far, we are forced also to postulate some coupling between inspectors: they must share the damage of any occurring violation which goes undetected (i.e. detected by none). A detailed formulation is represented in Fig. 3 in extensive form for the exemplary case of m = 2 inspectors, n = 1 inspectee. 2) Game Solution: We can rule out since the beginning the Nash equilibria in pure strategies (corresponding to trivial values of q = 0 or q = 1), because (see for illustration Fig. 3) all the pure strategy profiles have at least one player which would benefit from switching strategy unilaterally: the inspectee would prefer to violate when not inspected, and each of inspectors would prefer to be inspecting when there is a violation. The solution has to be found in mixed strategies, by means of the indifference conditions. We will exploit the symmetry between the inspectors, since we know ∗ = q∗ . that at the equilibrium q1∗ = · · · = qm Inspectee’s Indifference: The equation for the inspectee’s indifference should equalize the impact for no violation, which is null, to the impact for violation. This in turn is given by the balance between the impact of detection and that of non detection: since the benefit for violation is always present, be the violation detected or not, the balance is obtained by subtracting from b the impact of loss only (probability times value of loss). The probability of detection by at least one of the inspectors is 1 − (1 − q)m , hence the overall indifference equation is b − a(1 − (1 − q)m ) = 0 which has solution for q ∗ such that (1 − q ∗ )m = 1 − or b a b 1 q ∗ = 1 − (1 − ) m a 10 Figure 3. Inspection Game G(2, 1) in extensive form. None of the eight possible strategy profiles can represent a pure strategy Nash equilibrium: in each of the above column at least one of the players could improved his payoff by unilaterally deviating from the pure strategy. Inspector’s Indifference: The inspector’s indifference equation should equalize the impact of inspection, which is given by a constant cost, to the impact of no inspection. The latter corresponds to the expected value of the number of violations by the only inspectee when no other inspector is inspecting. Hence, the indifference equation is c = dp(1 − q)m−1 which has solution for p∗ = (1 − c d q ∗ )m−1 1 or explicitly – taking into account that at the equilibrium value (1 − q ∗ ) = (1 − ab ) m – for p∗ = (1 − c d b m−1 m a) D. Game G(m,n) - m Inspectors, n Inspectees In the game with m uncoordinated inspectors and n (non interacting) inspectees, the presence of n inspectees reduces the probability of any inspector visiting the i-th inspectee from qi to qief f = qni . Hereafter, exploiting the symmetry among inspectors, we will use q in place of qi and exploiting the symmetry among inspectees, we will use p in place of pi . Inspectee’s Indifference: The indifference equation for each inspectee, which is used here to determine q, is q b − a(1 − (1 − )m ) = 0 n which has solution for b q∗ (1 − )m = 1 − n a or b 1
q ∗ = n 1 − (1 − ) m a It is as in the previous case, that of the game G(m, 1) except that q is replaced by the effective qef f = nq . 11 Inspector’s Indifference: The inspectors’ indifference equation which is used here to determine p, should equalize • the impact of no inspection: this corresponds to d times the expected value of the number n of inspectees’ violations going undetected by the other (m-1) inspectors. • the impact of inspection (on a single inspector): this is given by a constant cost plus the individual damage times the expected value of the number (n-1) of inspectees’ violations going undetected by the other (m-1) inspectors. In both cases, the answer depends on the expected number of undetected violations when each inspectees violates the rule with probability p and each inspector performs an inspection with probability q – a quantity which we can call u(n, p, m, q). The indifference equation will equate the following two impacts d u(m − 1, q, n, p) = c + d u((m − 1), q, (n − 1), p) which can be rearranged so that c = u(n, p, (m − 1), q) − u((n − 1), p, (m − 1), q) d The difference at the second member represents the expected number of extra undetected violations, which occur when an inspector does not inspect. The missing inspection does not produce any extra undetected violations if the peer, which would be inspected, does not violate the rule, or if that peer is already inspected by at least one of the other inspectors. In other words, the missing inspection leaves one extra inspectee violating the rule undetected only when that inspectee does perform the violation and the other (m − 1) inspectors do not detect it: the former event happens with probability p and the latter with probability (1 − nq )m−1 (since each inspector has probability nq of falling over that inspectee). Hence the indifference equation reads q c = p(1 − )m−1 d n and has solution for c d p∗ = q m−1 (1 − n ) Overall, substituting q ∗ , we have p∗ = (1 − c d b m−1 m a) The results are summarized in Table II. Notice that the p∗ of the various G(., n) is equal to that of the corresponding G(., 1): adding or removing inspectees does not change the p∗ because there is no coupling between inspectees. On the contrary, the q ∗ of the various G(., n) is n times larger than that of the corresponding G(., 1): multiplying the inspectees’ number by n does change q ∗ because it requires a proportional increase in the inspectors’ effort. Notice as well that both p∗ and q ∗ of the G(m, .) are reduced with respect to the corresponding G(1, .): this is coherent with an increased and joint inspectors’ pressure. V. F ROM A BSTRACT G AMES T O G AMES O N C OMMUNICATION A RCHITECTURES In communication architectures, nodes are expected to spend their own resources so as to relay other nodes’ messages. However any selfish node would typically prefer to drop other nodes’ messages so as to spare its own resources. This creates a potential problem to any collaborative protocol. In P2P networks, this issue is well known and typically faced by exploiting the symmetry of the system, i.e. the fact that every relaying peer for a message can be also a source peer (or a destination peer) for another message and as such is interested in the message to be safely relayed from source to destination. Exploiting this symmetry, P2P protocol designers introduce directly into the communication protocol (where the decision about accepting or not the message of another peer is taken) some form of direct or delayed reciprocity mechanism (such as trust mechanisms), so 12 Table II S UMMARY OF THE RESULTS FOR THE I NSPECTION G AMES . G(m, n) INDICATES AN I NSPECTION G AME WITH m INSPECTORS AND n INSPECTEES ; p∗ INDICATES THE EQUILIBRIUM VIOLATION PROBABILITY FOR THE INSPECTEE , q ∗ INDICATES THE EQUILIBRIUM INSPECTION PROBABILITY OF THE INSPECTOR . p∗ G(1, 1) G(1, n) G(m, 1) G(m, n) q∗ c d Q ≡ ab nQ m−1 1 − (1 − Q) m P ≡ P P (1−Q) m P m−1 (1−Q) m 1 1 n 1 − (1 − Q) m
as to prevent free riding. In more specialized (i.e. less symmetrical) network architectures, where reciprocity cannot be implemented, other solutions can be adopted: one such solution is based on the post-hoc analysis of the nodes’ behaviour. A. Architectural Outline and Notation Here, since this paper addresses general networked environments and for sake of clarity, we introduce a basic notation for the different roles of the active network participants. A general distributed communication architecture consists of a publisher node (a node generating or initially sending network message), a consumer node (the receiver of a network message) and an intermediate node or in short mediator node. A network message is then sent from on producer node, over one or multiple mediator nodes to one or multiple receiver nodes. A node automatically holds the role of a mediator after receiving a message and if it needs to be forwarded again. Furthermore, in order to give an illustrative scenario, we consider in the following the selfish goal of reducing the own resource usage as described in example scenario 1 (see Section I B), i.e. a node only pretends to collaborate but drops the message to spare own resources. Please note that this (as well as the prior notation) is only done for sake of descriptive reasons, the Inspection Game model itself keeps abstract enough to cover any selfish goal. Thus, we do not detail the inspection procedure or other aspects such as securing the message transfer of a mediator. As we anticipated, we propose an approach to this problem, which uses post-hoc inspections so as to check whether a node has fulfilled its duty. The proof of the correct behaviour can be produced and checked in different ways. For sake of generality, we do not precise such techniques here since we are interested in the mechanics of the node’s decision about deviating or not from the protocol and on the mechanics of the inspector’s decision about performing or not the inspection. B. Inspecting the Mediator Node in Games for Communication Architectures For the given illustrative scenario of message drops, the weak element of the architecture, i.e. the one interested in defecting from the protocol, is the mediator. If the protocol designer uses the mechanism of post-hoc inspections for each mediator node, some other node will have to take the burden of realizing inspections, so as to check that the messages delivered to the mediator have been correctly forwarded to destination. The network protocol designer could either choose to put the burden of the inspection on the content publishers, which are interested in the correct delivery of their own messages, or choose to deploy inspection capabilities on independent nodes: • If the publisher uses the services of a single mediator, which serves only this publisher, the setting would correspond to a two player game, G(1, 1) according to the conventions of the previous sections. The publisher would take the role of the only inspector of its own mediator, which would take the role of the only inspectee. • If one publisher uses the services of several mediators, which have only that one as a publisher, the game would be a game analogous to a G(1, n) game. 13 Figure 4. Inspection Game, extended by false negatives, in extensive form with payoffs for inspector and inspectee. If all the publishers get their services from a single mediator, the game would be analogous to a G(1, n) game. • In a more realistic situation, publishers will share the mediator and mediators will share the publishers, this is similar to the m to n game illustrated beforehand. However, it lacks the permutation symmetry among inspectors. Indeed, normally a publisher is more interested in the loss of its own messages rather than to the loss of other publishers’. In the limit, where for a publisher the loss of the messages of the other publishers is irrelevant, the game is equivalent to a collection of m independent G(1, n) games. • Potential for global resource saving, coming from scale economies, can be obtained if the resources for inspections are assigned to a set of additional independent nodes (neither publisher nor mediator) with the specialized role of inspectors, endowed with suitable incentives. This changes the game into a G(m, n) game similar to the one discussed in the previous section. For this reason, and also for sake of simplicity, hereafter we will assume always that inspections on mediators are performed by independent nodes which are neither publishers nor consumers. The network will therefore consist of a given number of publisher nodes, a given number of mediator nodes, a given number of consumer nodes and a given number of inspector nodes, an addition to the original architecture, whose number and compensation will have to be established by the network designer. It is assumed, that the inspector nodes are fully under the control of the system designer and work on his behalf; thus, he can take them into consideration during game design. Among the mentioned nodes, only the mediator nodes and the inspector nodes will participate into an Inspection Game, the former with the role of inspectees, the latter with the obvious role of inspectors. • VI. I NSPECTION G AMES WITH FALSE N EGATIVES Notice that this procedure, e.g. due to the limited memory of the system, opens the possibility that a violation, which has occurred, is not detected because a time too long has passed between the violation and the inspection. In order to accommodate this feature, the games need to be enriched by a finite probability of non-detection, i.e. by false negatives, which makes the picture slightly more complex. False positives, still, are not allowed: when an inspection detects a violation, there is no doubt that the violation has actually occurred. The enriched version of the game, including the possibility of false negatives, in the case of one inspectee and one inspector G(1, 1) is shown in Fig. 4. Similar extensions can be devised for the other G(1, n), G(m, 1) and G(m, n): we will indicate the corresponding games with false negatives by Γ(·, ·). Their Nash equilibria can be found by straightforward considerations. Let us indicate by γ the probability that an inspection does detect a violation which has actually occurred. A first key observation for the development of the more general cases G(·, ·) concerns the inspectee’s indifference equation used to determine q ∗ : whenever an inspector sets the probability of inspection to the value q, the inspectee, due to false negatives (which corresponds to an inefficiency), perceives an effective probability γq; notice that due to this fact, wherever there was a q in the equations for the G(·, ·) there is a γq in the equations for the Γ(·, ·). Therefore, the equilibrium 14 values q ∗ for the inspectors in em all the games G(·, ·) will be rescaled by a factor 1/γ. For this reason we have to discuss in detail only the inspector’s indifference equation in the following cases. A. Game Γ(1, 1) – One Inspector, One Inspectee The equilibrium equation for the inspector in Γ(1, 1) changes slightly with respect to G(1, 1): the payoff for the inspection is not simply (−c), but is decremented by the term (−d)(1 − γ)p, due to possible inspection failure. The overall indifference equation is thus −c + (−d)(1 − γ)p = (−d)p, or c = pdγ, which has the following solution c . p∗ = γd valid for γd ≥ c. As anticipated above the solution value for q is instead q∗ = b . γa Notice that the two solution values p∗ and q ∗ are equal to the solution values for G(1, 1) rescaled by a factor 1/γ, which represents an increased violation rate and a correspondingly increased inspection rate. B. Game Γ(1, n) – One Inspector, n Inspectees In the indifference equation for the inspector, used to determine p∗ , in the game Γ(1, n) we have the non-inspection side npd of the equality, representing the expected value of the damage from a set of n independent inspectee choosing to violate with probability p, and the inspection side, consisting on the terms also present in G(1, n), i.e. c + d(n − 1)p, plus the failed inspection term (1 − γ)pd, hence pd = c + (1 − γ)pd which is equivalent to γpd = c and gives the solution c p∗ = γd As anticipated above the solution value for q is instead q∗ = n b . γa Again the two solution values p∗ and q ∗ are equal to the solution values for G(1, n) rescaled by a factor 1/γ. C. Game Γ(m, 1) – m Inspectors, One Inspectee As anticipated above the solution value for q is such that b a and its explicit form can be found in Table III. As for p, the inspector’s indifference equation should equalize the impact of inspection, to the impact of no inspection. The latter term corresponds to the expected impact of the violation (probability times impact) by the only inspectee, when no other inspector perform as successful inspection, i.e. is (−d)p(1 − γq)m−1 , the successful inspection has probability γq. The former term is given by the constant cost (−c) plus the inspection failure expected impact: in case of inspection there is a damage (−d) only if the inspectee has performed the violation (which happens with probability p) and this inspection fails (which happens with probability 1 − γ) while at (1 − γq ∗ )m = 1 − 15 the same time no other inspector has performed a successful inspection (probability (1 − γq)m−1 ). Hence, the indifference equation is c + dp(1 − γ)(1 − γq)m−1 = dp(1 − γq)(m−1) with solution p∗ = c γd(1 − γq)(m−1) In terms of the solution q ∗ p∗ = c γd(1 − b (m−1)/m a) Again the two solution values p and q are equal to the solution values for G(m, 1) rescaled by a factor 1/γ. ∗ ∗ D. Game Γ(m, n) – m Inspectors, n Inspectees As before, the solution for q yielded by the inspectee indifference equation is such that  m q∗ b 1−γ =1− n a i.e. as in the case Γ(m, 1) but with q replaced by q/n, the explicit form is shown in Table III. The inspectors’ indifference equation to determine p, should equalize the expected impact (on a single inspector) of no inspection (this corresponds to d, times the expected value of the number n of inspectees’ violations going undetected by the other (m-1) inspectors) with the expected impact (on a single inspector) of inspection. Following (but not retracing) the derivation used in the game G(m, n) we observe that after some manipulations, one will have to equate the value (−c) of the certain cost for an inspection to the expected impact of the extra detected violation (damage (−d) times the violation probability p times successful detection probability γ of a violation undetected by the other inspectors). Hence the equation q c = d p γ (1 − γ )m−1 n or c q = p (1 − γ )m−1 γd n and has solution for p∗ = (1 − Overall, substituting q ∗ , we have p∗ = (1 c γd γ nq )m−1 c γd m−1 − ab ) m Again, the solution values p∗ and q ∗ are equal to those of G(m, 1) rescaled by a factor 1/γ. The results for the games Γ(·, ·) are summarized in Table III, they are equal to the solution values for the corresponding G(·, ·) rescaled by a factor 1/γ, which represents an increased violation rate and a correspondingly increased inspection rate. 16 Table III S UMMARY OF THE RESULTS FOR THE I NSPECTION G AMES Γ(·, ·), I . E . G(·, ·) ENRICHED BY FALSE NEGATIVES . N OTICE THAT SOLUTIONS OF Γ(·, ·) ARE EQUAL TO THOSE OF G(·, ·) DIVIDED BY A FACTOR γ. γ p∗ Γ(1, 1) Γ(1, n) Γ(m, 1) Γ(m, n) γ q∗ c d Q ≡ ab nQ m−1 1 − (1 − Q) m P ≡ P P (1−Q) m P m−1 (1−Q) m 1 1 n 1 − (1 − Q) m
VII. C ONCLUSION In this paper, we introduced theoretical foundations of Inspection Games in the context of an applications to networked architectures. To this end, we started with a two-player Inspection Game G(1, 1) and developed the generalized versions G(1, n), G(m, 1) and G(m, n) as well as their solutions (Nash equilibria). In a next step, we approximated all versions of the basic Inspection Game to the needs of communication architectures by means of adapted versions Γ(·, ·), which takes false negatives into account, i.e. not detecting a violation during an inspection. As done for the basic games G(·, ·), we provided also solutions for these adapted versions Γ(·, ·). The game versions presented in this paper intend to serve as a general theoretic base towards the application of Inspection Games to distributed communication systems, therefore, they are independent from specific network architectures or personal interests of selfish parties. However, thanks to the similarities in the interaction style, the introduced Inspection Games in this paper are directly related to a concrete purpose in communication systems: the verification of adhering a collaborative protocol by means of monitoring, taking place by sampling (inspections). In this context, this paper supports a game designer to model the interdependent decision landscape between inspector and inspectee in order to analyse the players’ behaviour and to calculate system parameters to shift the Nash equilibria to a desired strategy profile. This finally allows the game designer to deploy a communication system over selfish peers, being able to maintain the system’s goals at the same time. R EFERENCES [1] S. Nielson, S. Crosby, and D. Wallach, “A taxonomy of rational attacks,” in Proceedings of the 4th International Workshop on Peer-to-Peer Systems (IPTPS’05), 2005, pp. 36–46. [2] T. Mayer, L. Brunie, D. Coquil, and H. Kosch, “Evaluating the robustness of publish/subscribe systems,” in Proceedings of the Sixth International Conference on P2P, Parallel, Grid, Cloud and Internet Computing (3PGCIC’11), 2011. [3] M. Dresher, “A sampling inspection problem in arms control agreements: A game theoretical analysis,” Memorandum No. RM-2972-ARPA, The RAND Corporation, 1962. [4] K. Apt and E. Grädel, Lectures in Game Theory for Computer Scientists. Cambridge University Press, 2011. [5] N. Nisan, T. Roughgarden, E. Tardos, and V. Vazirani, Algorithmic Game Theory. Cambridge University Press, 2007. [6] S. Chin, “On application of game theory for understanding trust in networks,” in International Symposium on Collaborative Technologies and Systems (CTS’09)., may 2009, pp. 106 –110. [7] R. Dash, N. Jennings, and D. Parkes, “Computational-mechanism design: A call to arms,” IEEE Intelligent Systems, vol. 18, pp. 40–47, November 2003. [8] S. Bohacek, J. Hespanha, J. Lee, C. Lim, and K. Obraczka, “Game theoretic stochastic routing for fault tolerance and security in computer networks,” IEEE Transactions on Parallel and Distributed Systems, vol. 18, no. 9, pp. 1227 –1240, september 2007. [9] M. Felegyhazi, J. Hubaux, and L. Buttyan, “Nash equilibria of packet forwarding strategies in wireless ad hoc networks,” EEE Transactions on Mobile Computing, vol. 5, no. 5, pp. 463 – 476, may 2006. [10] K. Akkarajitsakul, E. Hossain, D. Niyato, and D. Kim, “Game theoretic approaches for multiple access in wireless networks: A survey,” IEEE Communications Surveys Tutorials, vol. 13, no. 3, pp. 372–395, quarter 2011. [11] Z. Han, D. Niyato, W. Saad, T. Baar, and A. Hjørungnes, Game Theory in Wireless and Communication Networks: Theory, Models, and Applications. Cambridge University Press, 2011. [12] F. Pavlidou and G. Koltsidas, “Game theory for routing modeling in communication networks - a survey,” Journal of Communications and Networks, vol. 10, pp. 268–286, 2008. [13] R. Machado and S. Tekinay, “A survey of game-theoretic approaches in wireless sensor networks,” Computer Networks, vol. 52, no. 16, pp. 3047 – 3061, 2008. [14] R. Hohzaki, “An inspection game with multiple inspectees,” European Journal of Operational Research, vol. 178, no. 3, pp. 894 – 906, 2007. 17 [15] T. Ferguson and C. Melolidakis, “On the inspection game,” Naval Research Logistics (NRL), vol. 45, no. 3, pp. 327–334, 1998. [16] V. Baston and F. Bostock, “A generalized inspection game,” Naval Research Logistics (NRL), vol. 38, no. 2, pp. 171–182, 1991. [17] A. Goldman and M. Pearl, “The dependence of inspection-system performance on levels of penalties and inspection resources,” Journal of Research of the National Bureau of Standards, vol. 80B (Issue 2), pp. 189–236, 1976. [18] T. Chung, G. Hollinger, and V. Isler, “Search and pursuit-evasion in mobile robotics,” Autonomous Robots, pp. 1–18, 2011. [19] R. Avenhaus and D. Kilgour, “Efficient distributions of arms-control inspection effort,” Naval Research Logistics (NRL), vol. 51, no. 1, pp. 1–27, 2004.