{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,23]],"date-time":"2026-04-23T02:04:46Z","timestamp":1776909886975,"version":"3.51.2"},"reference-count":36,"publisher":"Oxford University Press (OUP)","issue":"1","license":[{"start":{"date-parts":[[2021,3,17]],"date-time":"2021-03-17T00:00:00Z","timestamp":1615939200000},"content-version":"vor","delay-in-days":75,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2021,2,16]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:p>Strategic game models of defense against stealthy, targeted attacks that cannot be prevented but only mitigated are the subject of a significant body of recent research, often in the context of advanced persistent threats (APTs). In these game models, the timing of attack and defense moves plays a central role. A common assumption, in this literature, is that players are indifferent between costs and gains now and those in the distant future, which conflicts with the widely accepted treatment of intertemporal choice across economic contexts. This article investigates the significance of this assumption by studying changes in optimal player behavior when introducing time discounting. Specifically, we adapt a popular model in the games of timing literature, the FlipIt model, by allowing for exponential discounting of gains and costs over time. We investigate changes of best responses and the location of Nash equilibria through analysis of two well-known classes of player strategies: those where the time between players\u2019 moves is constant, and a second class where the time between players\u2019 moves is stochastic and exponentially distributed. By introducing time discounting in the framework of games of timing, we increase its level of realism as well as applicability to organizational security management, which is in dire need of sound theoretic work to respond to sophisticated, stealthy attack vectors.<\/jats:p>","DOI":"10.1093\/cybsec\/tyaa008","type":"journal-article","created":{"date-parts":[[2021,3,17]],"date-time":"2021-03-17T06:30:25Z","timestamp":1615962625000},"source":"Crossref","is-referenced-by-count":7,"title":["Exponential discounting in security games of timing"],"prefix":"10.1093","volume":"7","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5919-731X","authenticated-orcid":false,"given":"Jonathan","family":"Merlevede","sequence":"first","affiliation":[{"name":"imec-DistriNet, KU Leuven, 3000 Leuven, Belgium"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8832-9457","authenticated-orcid":false,"given":"Benjamin","family":"Johnson","sequence":"additional","affiliation":[{"name":"Department of Informatics, Technical University of Munich, 85748 Garching, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1093-1282","authenticated-orcid":false,"given":"Jens","family":"Grossklags","sequence":"additional","affiliation":[{"name":"Department of Informatics, Technical University of Munich, 85748 Garching, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1304-3467","authenticated-orcid":false,"given":"Tom","family":"Holvoet","sequence":"additional","affiliation":[{"name":"imec-DistriNet, KU Leuven, 3000 Leuven, Belgium"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"286","published-online":{"date-parts":[[2021,3,17]]},"reference":[{"key":"2021032912460703500_tyaa008-B1","doi-asserted-by":"crossref","first-page":"48","DOI":"10.1109\/MSPEC.2013.6471059","article-title":"The real story of Stuxnet","volume":"50","author":"Kushner","year":"2013","journal-title":"IEEE Spectrum"},{"key":"2021032912460703500_tyaa008-B2","article-title":"U.S. suspects hackers in China breached about 4 million people\u2019s records, officials say","author":"Barrett","journal-title":"The Wall Street Journal"},{"key":"2021032912460703500_tyaa008-B3","author":"Perez"},{"key":"2021032912460703500_tyaa008-B4","author":"Hirschfeld Davis"},{"key":"2021032912460703500_tyaa008-B5","author":"Gallagher","year":"2020"},{"key":"2021032912460703500_tyaa008-B6","author":"Price","year":"2020"},{"key":"2021032912460703500_tyaa008-B7","author":"Reuters"},{"key":"2021032912460703500_tyaa008-B8","author":"Farhang","year":"2017"},{"key":"2021032912460703500_tyaa008-B9","volume-title":"Advanced Persistent Threat: Understanding the Danger and How to Protect Your Organization","author":"Cole E","year":"2013"},{"key":"2021032912460703500_tyaa008-B10","author":"Nadela","year":"2015"},{"key":"2021032912460703500_tyaa008-B11","author":"Radzik","year":"1996"},{"key":"2021032912460703500_tyaa008-B12","doi-asserted-by":"crossref","first-page":"655","DOI":"10.1007\/s00145-012-9134-5","article-title":"FlipIt: the game of \u2018Stealthy Takeover\u2019","volume":"26","author":"van Dijk","year":"2012","journal-title":"J Cryptology"},{"key":"2021032912460703500_tyaa008-B13","doi-asserted-by":"crossref","first-page":"236","DOI":"10.1017\/S0266462300105094","article-title":"The practice of discounting in economic evaluations of healthcare interventions","volume":"17","author":"Smith","year":"2001","journal-title":"Int J Technol Assess Health Care"},{"key":"2021032912460703500_tyaa008-B14","doi-asserted-by":"crossref","first-page":"351","DOI":"10.1257\/jel.40.2.351","article-title":"Time discounting and time preference: a critical review","volume":"40","author":"Frederick","year":"2002","journal-title":"J Econ Literature"},{"key":"2021032912460703500_tyaa008-B15","article-title":"Discounting in health care decision-making: time for a change?","volume":"14","author":"Sheldon","year":"1992","journal-title":"J Public Health"},{"key":"2021032912460703500_tyaa008-B16","doi-asserted-by":"crossref","first-page":"112","DOI":"10.1037\/a0017685","article-title":"Discounting behavior and environmental decisions","volume":"2","author":"Carson","year":"2009","journal-title":"J Neurosci Psychol Economics"},{"key":"2021032912460703500_tyaa008-B17","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2480741.2480742","article-title":"Game theory meets network security and privacy","volume":"45","author":"Manshaei","year":"2013","journal-title":"ACM Computing Surveys (CSUR)"},{"key":"2021032912460703500_tyaa008-B18","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2635673","article-title":"A survey of interdependent security games","volume":"47","author":"Laszka","year":"2015","journal-title":"ACM Computing Surveys (CSUR)"},{"key":"2021032912460703500_tyaa008-B19","volume-title":"Decision and Game Theory for Security","author":"Bowers","year":"2012"},{"key":"2021032912460703500_tyaa008-B20","author":"Laszka","year":"2013"},{"key":"2021032912460703500_tyaa008-B21","author":"Laszka","year":"2013"},{"key":"2021032912460703500_tyaa008-B22","author":"Feng","year":"2015"},{"key":"2021032912460703500_tyaa008-B23","author":"Hu","year":"2015"},{"key":"2021032912460703500_tyaa008-B24","author":"Farhang","year":"2016"},{"key":"2021032912460703500_tyaa008-B25","author":"Zhang","year":"2015"},{"key":"2021032912460703500_tyaa008-B26","volume-title":"Decision and Game Theory for Security","author":"Johnson","year":"2015"},{"key":"2021032912460703500_tyaa008-B27","author":"Pham","year":"2012"},{"key":"2021032912460703500_tyaa008-B28","author":"Laszka","year":"2014"},{"key":"2021032912460703500_tyaa008-B29","author":"Leslie","year":"2015"},{"key":"2021032912460703500_tyaa008-B30","doi-asserted-by":"crossref","first-page":"e0168675","DOI":"10.1371\/journal.pone.0168675","article-title":"Defending against advanced persistent threats using game-theory","volume":"12","author":"Rass","year":"2017","journal-title":"PLOS one"},{"key":"2021032912460703500_tyaa008-B31","author":"Pawlick","year":"2015"},{"key":"2021032912460703500_tyaa008-B32","author":"Reitter","year":"2013"},{"key":"2021032912460703500_tyaa008-B33","author":"Nochenson","year":"2013"},{"key":"2021032912460703500_tyaa008-B34","author":"Grossklags","year":"2014"},{"key":"2021032912460703500_tyaa008-B35","doi-asserted-by":"crossref","first-page":"49","DOI":"10.3390\/g10040049","article-title":"The positive impact of task familiarity, risk propensity, and need for cognition on observed timing decisions in a security game","volume":"10","author":"Reitter","year":"2019","journal-title":"Games"},{"key":"2021032912460703500_tyaa008-B36","volume-title":"A General Theory of Equilibrium Selection in Games","author":"Harsanyi","year":"1988"}],"container-title":["Journal of Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/academic.oup.com\/cybersecurity\/article-pdf\/7\/1\/tyaa008\/36786593\/tyaa008.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"http:\/\/academic.oup.com\/cybersecurity\/article-pdf\/7\/1\/tyaa008\/36786593\/tyaa008.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,3,29]],"date-time":"2021-03-29T12:46:23Z","timestamp":1617021983000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article\/doi\/10.1093\/cybsec\/tyaa008\/6174417"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,1,1]]},"references-count":36,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2021,2,16]]}},"URL":"https:\/\/doi.org\/10.1093\/cybsec\/tyaa008","relation":{},"ISSN":["2057-2085","2057-2093"],"issn-type":[{"value":"2057-2085","type":"print"},{"value":"2057-2093","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2021,1,1]]},"published":{"date-parts":[[2021,1,1]]},"article-number":"tyaa008"}}