相互依赖企业网络系统性网络风险管理的动态契约设计
Dynamic Contract Design for Systemic Cyber Risk Management of Interdependent Enterprise Networks
摘要：
网络和物理系统以及物联网的互连性为企业系统管理人员带来了无处不在的网络威胁问题。通常，资产所有者和企业网络运营商需要与网络安全专业人员合作，通过为他们无法直接观察到的努力提供报酬来管理风险。在本文中，我们使用委托代理框架来捕捉双方之间的服务关系，即，资产所有者（委托人）和网络风险管理者（代理人）。具体来说，我们考虑了一个动态的系统性风险管理问题与信息不对称，主要只能观察网络风险的企业网络的结果，而不是直接的努力，管理人员花费在保护资源。在这种信息模式下，委托人通过设计一个动态契约，考虑经理人的激励和理性行为，指定报酬流和预期努力，以最大限度地减少系统性网络风险。在一类随机微分对策的框架内，我们提出了一个动态契约设计的双层机制设计问题。通过设计一个激励相容的代理人隐性努力的估计量，证明了委托人对系统风险具有理性的可控性。我们的最优解的特点，通过重新制定的问题作为一个随机的最优控制方案，可以解决使用动态规划。我们进一步研究了一个基准的情况下，完全信息和确定的条件下，产生零信息租金，并导致一个新的确定性等价原则的委托代理问题。最后，通过网络系统的案例研究来说明所得到的理论结果。
英文摘要：
The interconnectivity of cyber and physical systems and Internet of things has created ubiquitous concerns of cyber threats for enterprise system managers. It is common that the asset owners and enterprise network operators need to work with cybersecurity professionals to manage the risk by remunerating them for their efforts that are not directly observable. In this paper, we use a principal-agent framework to capture the service relationships between the two parties, i.e., the asset owner (principal) and the cyber risk manager (agent). Specifically, we consider a dynamic systemic risk management problem with asymmetric information where the principal can only observe cyber risk outcomes of the enterprise network rather than directly the efforts that the manager expends on protecting the resources. Under this information pattern, the principal aims to minimize the systemic cyber risks by designing a dynamic contract that specifies the compensation flows and the anticipated efforts of the manager by taking into account his incentives and rational behaviors. We formulate a bi-level mechanism design problem for dynamic contract design within the framework of a class of stochastic differential games. We show that the principal has rational controllability of the systemic risk by designing an incentive compatible estimator of the agent's hidden efforts. We characterize the optimal solution by reformulating the problem as a stochastic optimal control program which can be solved using dynamic programming. We further investigate a benchmark scenario with complete information and identify conditions that yield zero information rent and lead to a new certainty equivalence principle for principal-agent problems. Finally, case studies over networked systems are carried out to illustrate the theoretical results obtained.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
