Interdependent Strategic Security Risk Management with Bounded Rationality in the Internet of Things

Juntao Chen, Quanyan Zhu

Research output: Contribution to journalArticlepeer-review


With the increasing connectivity enabled by the Internet of Things (IoT), security becomes a critical concern, and users should invest to secure their IoT applications. Due to the massive devices in the IoT network, users cannot be aware of the security policies taken by all its connected neighbors. Instead, a user makes security decisions based on the cyber risks that he perceives by observing a selected number of nodes. To this end, we propose a model which incorporates the limited attention or bounded rationality nature of players in the IoT. Specifically, each individual builds a sparse cognitive network of nodes to respond to. Based on this simplified cognitive network representation, each user then determines his security management policy by minimizing his own real-world security cost. The bounded rational decision-makings of players and their cognitive network formations are interdependent and thus should be addressed in a holistic manner. We establish a games-in-games framework and propose a Gestalt Nash equilibrium (GNE) solution concept to characterize the decisions of agents and quantify their risk of bounded perception due to the limited attention. In addition, we design a proximal-based iterative algorithm to compute the GNE. With case studies of smart communities, the designed algorithm can successfully identify the critical users whose decisions need to be taken into account by the other users during the security management.

Original languageEnglish (US)
Article number8691466
Pages (from-to)2958-2971
Number of pages14
JournalIEEE Transactions on Information Forensics and Security
Issue number11
StatePublished - Nov 2019


  • Internet of Things
  • Risk management
  • bounded rationality
  • cognitive networks
  • smart community

ASJC Scopus subject areas

  • Safety, Risk, Reliability and Quality
  • Computer Networks and Communications


Dive into the research topics of 'Interdependent Strategic Security Risk Management with Bounded Rationality in the Internet of Things'. Together they form a unique fingerprint.

Cite this