Model for Selecting Cybersecurity Measures in Distributed Information Systems Based on Bayesian Game Theory

The article proposes an integrated model for selecting cybersecurity measures in distributed information systems based on Bayesian game theory. The integrated model is defined as a single construct combining a graph representation of the system, a finite Bayesian attacker–defender interaction, node-compromise assessment, multistage network loss propagation, and optimization-based selection of security controls. All losses and costs are normalized to a common dimensionless scale, while attacker strategies and types are treated as finite working sets that can be extended. A numerical experiment was conducted for a synthetic 50-node network and four attack scenarios. Compared with a fixed static configuration, the integrated model reduced normalized expected losses by 27.1–32.4%; the mean loss decreased from 0.688 to 0.480, corresponding to a 30.2% relative reduction. A separate quantitative reduction in defense costs was not evaluated and is therefore not claimed. The result provides a formal decision-support basis for selecting cybersecurity measures under uncertainty and network interdependence, while operational validation on real network data remains necessary.