|Abhishek Roy||University of California, Davis, USA|
|Prasant Mohapatra||University of California, Davis, USA|
|Charles A Kamhoua||US Army Research Laboratory & Network Science Division, USA|
Recent observations have shown that most of the attacks are fruits of collaboration among attackers. In this work we have developed a coalition formation game to model the collusive behavior among attackers. The novelty of this work is that we are the first to investigate the coalition formation dynamics among attackers with different efficiency. Most of the related works have modeled the attacker as a single entity. We define a new parameter called friction to represent the unwillingness of an attacker to collude. We have shown that the proportion of attackers in the Maximum Average Payoff Coalition (MAPC) decreases with efficiency. We have also shown that as the friction increases, size and heterogeneity of MAPC decrease. We show, using text analysis on a hacker web forum chat data, that the hacker collaboration network shows a strong small-world characteristics. We identify the leaders in these coalitions. The cluster compositions of the hacker collaboration network agree with our model. We also develop method to estimate the friction parameters for the attackers to decide optimal coalition to join. As this model provides insight into coalition formation among attackers, e.g., leaders, composition, and homogeneity, this model will be helpful to develop better defender strategies.