A heterogeneous botnet detection game

A unique feature of the botnet security threat is the highly distributed, decentralized network of victims whose compromised computers make up the botnet. These victims are not always the intended target of botnet attacks, yet they play a critical role in the functionality of the botnet. We examine a local mean field game between the operator of a botnet (bat master) and the decentralized, legitimate users of the compromised network (defenders). The more a bot master utilizes his botnet, the more likely it is he will be detected by the network of defenders. Thus he must balance stealth and aggression in his strategic utilization of the botnet. The defenders of the network must decide how vigilant they will be in trying to detect the presence of a botnet infection. Previous work established the existence of a unique, symmetric, pure Nash equilibrium in the game with homogeneous defenders. In this paper we extend the game to defenders which are heterogeneous in their cost functions. In contrast to the homogeneous game, it is observed that pure Nash equilibria often fail to exist with heterogeneous defenders. For this reason a Stackelberg solution concept is adopted, and sufficient conditions are given to guarantee such an equilibrium. Numerical examples are given in order to examine the effects of heterogeneity and network externalities on the Stackelberg equilibria.