{'fraction_non_alphanumeric': 0.041445593184367704, 'fraction_numerical': 0.010702483097353182, 'mean_word_length': 4.55192728496886, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 10, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 9, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Defense for Advanced Persistent Threat with Inadvertent or Malicious Insider Threats

In this paper, we propose a game-theoretical framework to investigate advanced persistent threat problems with two types of insider threats: malicious and inadvertent. Within this framework, a unified three-player game is established and Nash equilibria are obtained in response to different insiders. By analyzing Nash equilibria, we provide quantitative solutions to the advanced persistent threat problems with insider threats. Furthermore, optimal defense strategy and defender's cost comparisons between two insider threats have been performed. The findings suggest that the defender should employ more active defense strategies against inadvertent insider threats than against malicious insider threats, despite the fact that malicious insider threats cost the defender more. Our theoretical analysis is validated by numerical results, including an additional examination of the conditions of the risky strategies adopted by different insiders. This may help the defender in determining monitoring intensities and defensive strategies.


I. INTRODUCTION
A Dvanced Persistent Threat (APT) as a new type of cyber attack has posed a severe threat to nation-states and enterprise networks [1], [2]. The APT is executed by a well-resourced and well-organized entity in order to steal sensitive data covertly and on a long-term basis from the target organization. Since "Stuxnet" attacked Iran's nuclear power plants [3], APTs, such as Ocean Lotus, Duqu, and Flame have attracted much attention [4]. Currently, one practical approach for mitigating the majority of APTs is the game-theoretical method [5]- [10], which provides insights on feasible defense decision-making through mutual strategic behavior analysis. Traditional APT problems centered on defending against external attacks with ignoring the presence of insiders.
However, statistics showed that the damage caused by insiders is even more serious than outsider attackers [11], because the insider has privileged access to sensitive resources and system accounts. Hence, both academia and industry have paid increasing attention to insider threats in recent years [12]- [14]. To deal with insider threats, several approaches have been proposed, including system dynamic approaches [15], machine learning based approaches [16] and game-theoretic approaches [17]- [19]. Notably, the approaches presented above were primarily focused on a two-player game involving the defender and the insider.
It is worth mentioning that game-theoretic approaches to quantitatively analyzing the APT problem with insider threats (APT-I problem) are limited. Some of the reasons are as follows. On the one hand, the game model is more difficult to establish due to the interconnection among the defender, the attacker, and the insider than in two-player games of the defender and the insider. On the other hand, the coexistence of competition and cooperation makes the traditional zerosum game method given in [17] inapplicable. To address this issue, some efforts have been made in [20]- [23]. For example, [20] modeled the APT-I problem as a three-player timing game, in which the defender chooses appropriate time points for investing defense resources in order to minimize the APT-I impact at the lowest cost. Moreover, [21] further captured the APT's conspicuous features that the long period of completed attacks with a two-layer game. Specifically, based on a differential equation for the evolution of the fraction of the compromised organization, the defend-attack between the defender and the outside attacker, as well as information trading among insiders were modeled, respectively. However, the role and impact of the insider on the intrusion process of the attack on the system were not considered in most of existing results.
Actually, the three-player games mentioned in [20]- [23] only considered the so called "malicious insider" [14], who is motivated to collaborate with outside attackers for personal, financial, or revenge reasons. In fact, another type of insider is known as "inadvertent insiders" [24]- [26], who are individuals without malicious intent, but their actions or inactions can jeopardize the organization's assets and operations, causing harm or increasing the likelihood of future harm to the organization's confidentiality, integrity, and availability. For example, employees accidentally leak sensitive data on social media, lose work devices, and fall victim to phishing and other disguised malware attacks [14], [24], [25]. To our knowledge, no game-theoretic approaches to the APT-I problem have taken into account inadvertent insider threats. The inadvertent insider's strategies are hard to predict due to their inadvertent nature. However, the strategies of the inadvertent insider are strongly coupled with those of the defender and attacker, determining the distribution of Nash equilibria. As a result, analyzing the Nash equilibria of a three-player APT game with an inadvertent insider becomes more complicated.
The objective of this paper is to distinguish between two types of insider threats in the APT-I problem and establish a game framework to answer the following three questions: i) What is the optimal defense strategy for dealing with the APT-I problem with inadvertent insider threats or malicious threats? ii) What are the differences in optimal defense strategies and the defender's costs between the two previously mentioned insider threats? In addition, iii) What strategies should be used to achieve a feasible defense if the defender is uncertain about the types of insider threats? The contributions are summarized as follows.
• This is the first work to establish a game-theoretic framework for the APT problem, involved with two types of insiders, malicious and inadvertent. Within this framework, as the risk budget mechanism is introduced to provide an incentive for the inadvertent insider, the APT-I problem can be uniformly formulated as a three-player game played among a defender, an attacker, and an insider. Our formulation includes the two-player games in [17]- [19] and the model with only malicious insiders [20]- [23]. • To deal with the two types of insider threats, we obtain the feasible Nash equilibria of the corresponding APT-I game in order to provide a quantitative analysis under insider threats. It is worth noting that the optimal defense strategies for the defender when dealing with malicious insider threats are not always identical to those for inadvertent insider threats, due to an inherent difference between the two. Furthermore, the malicious insider causes more cost to the defender than the inadvertent, while the optimal defense strategies under the malicious threat are more worse than those under the inadvertent threat. • The Nash equilibria and the corresponding defender's costs are validated via numerical investigations. Furthermore, we examine the conditions of risky strategies taken by two types of insiders and find that an inadvertent insider is more likely to lead to a risky strategy. Hence, if insider threats are unknown, the defender can employ a relatively high level of monitoring and defense. The remainder of this paper is organized as follows. An APT-I problem and a three-player APT-I game are presented in Section II. Detailed Nash equilibrium analysis is presented in Section III. The discussion on optimal defense strategies and the defender's costs are summarized in Section IV. The result verification via extensive numerical is investigated in Section V. Finally, concluding remarks are given in Section VI.

II. PROBLEM FORMULATION
Consider an organization with facing joint threats from an attacker and an insider, as illustrated in Fig. 1. This organization is made up of a resource server, a defender, and an insider. The resource server is used to store sensitive data, and the defender and the insider are authorized to access it for business requirements. Insiders are classified as malicious or inadvertent. A malicious insider may sell information in order to provide an attacker with back-door access. An inadvertent insider has no incentive to cooperate with an outside attacker, whose unintentional risky behavior may result in information leakage. Once the attacker has obtained information from the malicious insider, he can evade detection systems (such as firewalls, authentication controls, and intrusion prevention systems) and rapidly invade the organization to perform malicious actions, such as monitoring sensitive operations, stealing private information, and injecting ransomware. To summarize, this paper is committed to solving the following problem.
APT-I Problem: Consider an APT-affected organization with insider threats. How should the defender's defense strategies be allocated to minimize the system's continuing losses in response to inadvertent or malicious insider threats? Remark 1. Defense strategies include user double identifications, network security monitors and employee training [2], [26]. In this sense, active defense strategies can be thought of as increasing the frequency of the preceding strategies. In fact, defense strategies in most organizations, such as companies, are constrained by limited computational resources. Hence, the APT-I problem is concerned with allocating finite defense strategies for mitigating the APT with insider threats.
To solve the APT-I problem, we develop a mathematical model that characterizes compromised resources. In the subsequent, we refer to each participant as a player and every feasible player's action as a strategy.

A. The evolution model of resource states
The organization's resources evolve dynamically as a result of the long-term persistence of the APT with insider threats. Total system resources are normalized to the value of 1. Define x(t) ∈ [0, 1] as the fraction of compromised resources at time t. Correspondingly, 1 − x(t) represents the percentage of resources under the defender's protection. The fraction of compromised resources is evolving bẏ where attack strategies are denoted by α ∈ (0, 1] and defense strategies are denoted by β ∈ (0, 1]. At time t, the term α(1−x(t)) represents the percentage of resources sized by the attacker. The term βx(t) refers to the percentage of resources recaptured by the defender. Because the resource state x(t) cannot be transmitted in real time to players, non-adaptive strategies are considered. In other words, strategies α, β and γ do not change over time and were pre-configured prior to the organization's deployment. Nonadaptive strategies can be thought of as programmed attacks, the defender's routine security examinations, and the insider's fixed amount of information leakage. They have been proved to be a pair of optimal response strategies in the periodic APT response problem [20].
Based on the evolution model (1), the resource state at time t satisfies which implies that organization's resources are fully under the defender's control at the beginning, i.e., x(0) = 0. As time goes to infinity, the resource state converges to α α+β at a rate of e −(α+β)t , indicating two facts: 1) Under a sustained attack launched by an attacker, the fraction of compromised resources grows. However, due to the defense strategies adopted by a defender, the organization's resources cannot be fully invaded.
2) A large β results in a small limit point α α+β , implying that a active defense strategy reduces the fraction of compromised resources significantly.

B. The APT-I game model
This subsection establishes a unified APT-I game framework. We start by characterizing each player's objective function in the APT-I problem.
Attacker: The outside attacker is dedicated to invading and occupying as many resources as possible over a long period of time at the lowest cost of attack. The attacker's cost function has three components: i) the risk of being detected by the defender, which is reduced by a factor of (1 − γ) 2 with the amount of purchased information γ ∈ [0, 1] from the malicious insider; ii) the cost of launching attacks, which is related to attack strategies α ∈ (0, 1]; and iii) the cost of paying for the malicious insider. We describe the attacker's average cost function in the time horizon [0, ∞) as follows, where p A ∈ (0, 1) is a unit risk coefficient of being detected and q A > 0 is a weight representing each attack cost. The attacker's average cost function (3) develops that in the twolayer game [21], in which the insider's effects p A (1 − γ) 2 (1 − x(t)) 2 and γ 2 (1 − x(t)) 2 are not taken into account.
Defender: The defender tries his best to minimize the damage caused by the outside attacker and the insider, whose cost function is composed of three components: i) the damage from compromised resources; ii) the operational cost of launching a defense, which is related to defense strategies β ∈ (0, 1]; and iii) the damage from insider threats. In the time horizon [0, ∞), the defender's average cost function is described as follows, where p D ∈ (0, 1) is the unit cost coefficient for compromised resources and q D > 0 is the weight standing for each defense cost. Note that the damage from compromised resources is reduced by a factor of (1 − γ) 2 because the cost caused by an inadvertent insider γ 2 x 2 (t) has been considered in the last term of the right hind side of (4).

Remark 2.
According to (4), there is a positive correlation between the fraction of compromised resources x(t) and the defender's average cost function J D . Hence, minimizing the system's average loss is equivalent to finding best response strategies β * to minimize J D .
Malicious Insider: The malicious insider seeks to maximize his profits, whose profit function consists of three parts: i) the benefit from secure resources; ii) the monetary gain from trading information; and iii) the risk of being caught by a defender. To be specific, the profit function in the time horizon [0, ∞) is described as follows, where p I ∈ (0, 1) represents the proportion of insiders in the organization and q I ≥ 0 represents the risk coefficient. (5) includes the risk term q I γ + 1 2 γ 2 in addition to the insider's profit function described in the three-player game [20]. This risk term configuration implies that the malicious insider can not abuse his privileges without incurring any cost.
Inadvertent Insider: The cost of inadvertent insider's risky strategies is borne by the organization rather than the inadvertent insider, so there is no incentive for the inadvertent insider to avoid risky behaviors and worry about any potential risk caused by his actions and strategies [24]- [26]. To encourage the inadvertent insider to self-manage his risks while discouraging him from his risky actions, we propose providing all employees, including the inadvertent insider, with a risky budget mechanism. This mechanism takes the same form as (5) and includes three components: i) If an employee behaves prudently, the organization can reward him, as shown by p I (1 − x(t)) 2 ; ii) If an employee engages in a risky strategy, he may face penalties, which is depicted by −(q I γ+ 1 2 γ 2 ); iii) Of course, his risky strategy may bring some benefits (obtaining entertainments or relieving pressures), as shown by γ 2 (1−x(t)) 2 . Under the risk budget mechanism, all employees evaluate their risk before choosing risky strategies, such as sending emails that violate data protection regulations or clicking on a malicious link in a received email [26]. Hence, this mechanism offers incentives to an inadvertent insider while shifting the cost of risk away from the organization.
Remark 3. Although the risk budget mechanism's form is intended to be the same as the malicious insider's profit function (5), the optimal strategies of all players are not the same because there is no cooperation between the inadvertent insider and the outside attacker.
The balance among all players' optimal strategies is equivalent to the following Nash equilibrium solution concept based on the above objective functions (3)-(5).
It is known that the Nash equilibrium provides a credible prediction of the attacker's and insider's moves, identifying the optimal countermeasures to the attacker's and insider's strategies.
The APT-I problem can be uniformly expressed as the unified three-player game shown below.
APT-I Game: Consider three players in the APT-I problem: the attacker with attack strategies α, the defender with defense strategies β, and the insider (inadvertent or the malicious insider) with strategies γ. The attacker's and the defender's goals are to minimize their costs J A and J D . The insider is devoted to maximizing his profit J I .
It should be noted that, in the worst-case scenario, the attacker may have known the exact form of J A (α, β, γ) through meticulous reconnaissances, and may try to minimize it. In this sense, the Nash equilibrium strategies β * are the organization's optimal defense strategies, at least in the worstcase scenario. As a result, if (α * , β * , γ * ) is a Nash equilibrium of the ATP-I game, β * is an acceptable solution to the ATP-I problem.

III. NASH EQUILIBRIUM ANALYSIS
To thoroughly solve the APT-I problem and compare optimal defense strategies under two types of insider threats, we compute Nash equilibria under the following four different scenarios: • Insider threats are known to the defender.
(A) There is a malicious insider in the organization; (B) There is an inadvertent insider in the organization. • Insider threats are unknown to the defender.
(C) There is a malicious insider in the organization; (D) There is an inadvertent insider in the organization. Scenarios A and B are intended to investigate the optimal defense strategies for dealing with known insider threats. Scenarios C and D provide additional optimal defense strategies for unknown threats.

A. Insider threats are known
In this case, the defender is aware of the types of insiders. Moreover, the defender has access to insiders' strategies because the insider acts based on his privileges and accesses, and the defender is aware of his accesses.
1) There is a malicious insider: In Scenario A, the APT-I game depicts the conflict between a defender and both an attacker and a malicious insider, as well as the cooperation between the attacker and the malicious insider. In terms of each player's objective functions (3)-(5), the best response strategies of each player in Scenario A are calculated in the next lemma, whose proof is in Appendix A. Lemma 1. Considering the APT-I game with a known malicious insider, the best response strategies of the defender, attacker and malicious insider are According to Lemma 1, all players' strategies influence each other's best response strategy in Scenario A. Particularly, arg min γ∈[0,1] J I (α, β, γ) ⊆ {0, 1} leads to γ * ∈ {0, 1}, which means that the malicious insider can only sell all of the APT detection information or none of it at all.
2) There is an inadvertent insider: In Scenario B, there is no cooperation between the attacker and the inadvertent insider because the inadvertent insider has no intention of providing the attacker with back-door access or useful information. Hence, the attacker's average cost function over the time horizon [0, ∞) is described as J A (α, β, 0). By the similar method used in Lemma 1, the best response strategies of the defender, attacker, and inadvertent insider in terms of J A (α, β, 0), (4), and (5) can be obtained by According to (9)-(11), the inadvertent insider's strategies influence the defender's best response strategies, which further influence the attacker's best response strategies.
In addition, the inadvertent insider prefers the risk-averse strategy γ * = 0 with a relatively large penalty coefficient q I > ( β α+β ) 2 − 1 2 on the basis of (11). It guides the defender to suppress risky behaviors of inadvertent insiders by setting a large q I .
Based on (6)-(11), we provide feasible Nash equilibria of the APT-I game with two types of known insiders in Theorem 1, whose proof is in Appendix B.
Theorem 1. The Nash equilibrium strategies β * j , j ∈ {A, B} related to γ * = 1 in Table I and those related to γ * = 0 in Table III are acceptable solutions to the APT-I problem with known insider threats. Table I, there are two kinds of Nash equilibria under various system configurations. The first kind belongs to a continuous set, whereas the second kind is a single point. Thus, different system configurations correspond to various Nash equilibria. On the other hand, the optimal defense strategies β * for the defender when dealing with malicious insider threats are not always identical to those for inadvertent insider threats, which implies an inherent difference between the two. From this perspective, using different defense strategies for different types of insider threats can improve the targeting and effectiveness of the APT-I defense while also conserving limited defense strategies.

B. Insider threats are unknown
In this case, the defender finds no insiders, so his average cost function over the time horizon [0, ∞) is denoted by J D (α, β, 0). It should be noted that even if the defender knows nothing about insiders, the optimal defense strategies for different types of insider threats are not always the same. The reason is that different types of insider threats have different effects on the attacker's optimal strategies, which in turn influence the defender's optimal defense strategies.
1) There is a malicious insider: In Scenario C, J D (α, β, 0), (3), and (5) determine the best response strategies of three players, which are calculated by using the similar method of Lemma 1 to obtain According to (12)- (14), the insider's strategies influence the attacker's best response strategies, which further influence the defender's best response strategies.
2) There is an inadvertent insider: In Scenario D, J D (α, β, 0), J A (α, β, 0), and (5) determine the best response strategies of three players, which are computed in the same way as Lemma 1 to obtain Observing from (15) and (16), the strategic interaction between the defender and the attacker is identical to that in the APT game. Hence, our formulation includes the results of the two-player APT game in [21].
Based on (12)- (17), feasible Nash equilibria of the APT-I game with two types of unknown insiders are provided in Theorem 2, whose proof is in Appendix B. For notation simplicity, some parameters are denoted as r A = p A q A , r D = p D q D , and ε = 1 Theorem 2. The Nash equilibrium strategies β * j , j ∈ {C, D} related to γ * = 1 in Table II and those related to γ * = 0 in Table III are acceptable solutions to the APT-I problem with unknown insider threats. Table II shows that β * C are not always identical to β * D . It demonstrates that even if the defender does not discover any insiders, the optimal defense strategies for different types of insider threats are different.
To summarize, the Nash equilibrium strategies β * j , j ∈ {A, B, C, D} in Tables I and II are recommended as acceptable solutions to the APT-I problem with the insider's risky strategy γ * = 1. Additionally, when the insider avoids risky strategies with γ * = 0, the strategic interaction between the defender and the attacker is simplified as a two-players APT game. In this case, the Nash equilibria are the same in all Scenarios A-D, and are summarized in Table III. Thus, the Nash equilibrium strategies β * in Tables III are recommended as acceptable solutions to the APT-I problem with γ * = 0, which coincide with the results of the APT problem in [21].
Remark 4. When γ * = 0, the Nash equilibrium strategies α * and β * are dependent on r A and r D . Specifically, when r A = r D ≤ 1, α * · β * = r A = r D . When r A < r D , the defender focuses on the cost of uncontrolled resources compared with that of the attacker. Hence, the defender reduces the compromised resources by improving his defense strategy. As its counterpart, when r D < r A , the attacker infiltrates additional secure resources by improving his attack strategy. When r D > 1 and r A > 1, both the defender and the attacker work at full stretch.
According to Table III, γ * is always zero when r D ≤ 1, r D < r A or r A > 1, r D > 1. In fact, under these conditions, we have α * = 1, which lowers the percentage of secure resources 1 − x(t) on the basis of (2). From (5), a small percentage of secure resources causes the profit term p I (1−x(t)) 2 +γ 2 (1−x(t)) 2 to be insufficient to offset the risk term q I γ + 1 2 γ 2 . Thus, under these conditions, the insider is no excuse for action, whose impact can be ignored by the defender. Furthermore, a large risk coefficient suppresses the risk behaviors of insiders. Based on the above analysis, regardless of the type of insider, the defender can take the following general measures to reduce his costs: i) Reduce the weight of defense action q D so that r D ≥ r A or r D > 1, allowing for large β * and small α * ; ii) Use active detection actions to increase q I so that γ * = 0.

System configurations
Nash equilibria

A. Discussions
Regarding two types of insiders in the APT-I game, we compare β * and the corresponding defender's costs. The results show that β * under the malicious threat is not larger than it is under the inadvertent, despite the fact that the malicious insider costs the defender more than the inadvertent.
Optimal defense strategies: Table IV lists the corresponding Nash equilibrium strategies of the APT-I game with two types of insiders for the eight system configurations presented in Tables I and II. In comparison, the malicious insider always increases α * while decreasing β * . Hence, β * with an inadvertent insider threat is never less than β * with a malicious insider threat. It suggests that the defender should employ more active defense strategies, such as a higher frequency of user double identifications, network security monitors, and employee training [2], [26], to address the APT-I problem with inadvertent insider threats rather than malicious threats.
Defender's average costs: We compare defender's average costs at Nash equilibria for two types of insider threats.
1) Insider threats are known: In regards to J D (α * , β * , γ * ), the average cost of the defender is calculated by since α * · β * = r D p D and γ * = 1 according to Table I. 2) Insider threats are unknown: The average cost of the defender is calculated by since α * · β * = r D according to Table II. Based on (18) and (19), the malicious insider threat causes more harm to the defender than the inadvertent insider threat, because the malicious insider always reduces β * , as shown in Table IV.

B. Suggestions
The Nash equilibrium strategies β * in Tables I-III are  recommended as acceptable solutions to the APT-I problem. Furthermore, the following suggestions can be used by the defender to achieve a much more feasible defense against the APT with two types of insider threats.
• In the APT-I problem, β * with an inadvertent insider threat is never less than β * with a malicious insider threat, which suggests that the defender should employ more

Configurations
Insiders active defense strategies for inadvertent insider threats than for malicious threats. Furthermore, if the defender knows noting about insider threats, he can employ a relatively high level of monitoring and defense.
can always ensure γ * = 0. As a result, the defender can increase the intensity of regulation and the frequency of monitoring to raise q I such that γ * = 0. For the inadvertent insider, the defender can increase employee training and risk communication, engender process discipline, and heighten punitive measures to stop the inadvertent insider's risky behaviors [26]. For the malicious insider, the defender can use deception techniques, such as Darknets, Honey nets, to increase the risk of being detected when the malicious insider copies and sells sensitive information [27]. • When r D ≤ 1, r D < r A or r D > 1, r A > 1, γ * is always zero. It implies that under those conditions, the defender can ignore the effect of insider threats and maintain the same defense strategy and monitoring intensity as in the APT game.

V. NUMERICAL EXPERIMENTS
In this section, we first check the Nash equilibria in Table I-III. Then we show the discussion presented in Section IV. Finally, by examining the conditions of risky strategies adopted by different insiders, we demonstrate that the inadvertent insider is more likely to lead to the risky strategy.

A. The Nash equilibrium verification
To validate the Nash equilibria, we investigate the minimums of the average cost functions of the defender and the attacker, as well as the maximums of the average profit functions of insiders.
Therefore, the minimum of J D , the minimum of J A , and the maximum of J I in Fig. 2 and Fig. 3, correspond to each Nash equilibrium in Table V.
2) Verification of Table III: Let p A = 0.95, p D = 0.9 and p I = 0.1. The rest of system configurations and Nash equilibria are set in Table VI. The verification of Nash equilibria is shown in Fig. 4, where the insider always benefits the most when γ * = 0.
B. Discussion examinations 1) Nash equilibrium strategies: The Nash equilibrium strategies of the APT-I game with two types of insiders are shown in Table VII under the system configurations in Table V.  Table I. In Fig. 2(a), the yellow lines show that the minimums of J D and J A , respectively, and the maximum of J I fall into the Nash equilibrium (0.26, 0.84, 1), and the purple lines show that those fall into (0.14, 1, 1). In Fig. 2(b), the blue lines show that the minimums of J D and J A , respectively, and the maximum of J I fall into the Nash equilibrium (0.25, 0.89, 1), and the red lines show that those fall into (0.13, 1, 1).  Table II. In Fig. 3(a), the yellow lines show that the minimums of J D and J A , respectively, and the maximum of J I fall into the Nash equilibrium (0.26, 0.76, 1) and the purple lines show that those fall into (0.15, 1, 1). In Fig. 3(b), the blue lines show that the minimums of J D and J A , respectively, and the maximum of J I fall into the Nash equilibrium (0.25, 0.8, 1) and the red lines show that those fall into (0.14, 1, 1).  It demonstrates that β * related to the malicious threat is never larger than β * related to the inadvertent threat.
2) Average costs of all players: In Fig. 5, we compare the defender's average costs with malicious insider threats to those with inadvertent insider threats. The results show that the malicious insider costs the defender more than the inadvertent insider. Similar comparisons for the attacker's average cost and the insider's average profit are shown in Fig. 6. According to the findings, the malicious insider always raises the attacker's cost, whose profit is lower than the inadvertent insider's profit.

C. The examination of risk coefficients
Different risk coefficients q I result in different Nash equilibrium strategies γ * for the insider. Hence, we set a series  of q k I = 0.1 + 0.01 * k, k = 0, · · · , 14 to examine the conditions of the risky strategy pursued by different insiders. Let p A = p D = 0.8, q A = 4 and p I = 0.1. The rest of the parameters and available Nash equilibria are listed in Table VIII. According to Fig. 7, the inadvertent insider is more likely than the malicious insider to maximize profit at γ * = 1, implying that the inadvertent insider is more likely to lead to a risky strategy. As a result, the defender must employ more monitoring efforts (a larger q I ) to avoid the risky behavior of the inadvertent insider compared with the malicious insider.

VI. CONCLUSION
This paper investigated the APT-I problem in the context of malicious insider threats or inadvertent insider threats. To address this problem, we developed a unified three-player APT-I game framework. To deal with the two types of insider threats, we obtained feasible Nash equilibria, in which the optimal defense strategies were recommended as acceptable solutions to the APT-I problem. Furthermore, the optimal defense strategies and the average cost of the defender have been compared between two types of insider threats. The results demonstrated the differences between two types of insider threats in the APT-I problem, and we further provided a list of effective suggestions for the defender.
In this case, (21) and (25) are required to be satisfied simultaneously. Thus, if r A ≤ 1, r A < r D and q I = ( 1 r A +1 ) 2 − 1 2 , then NE 8 = (r A , 1, γ * ) with γ * = 1 or 0. Case 8 is a special case of Cases 2 and 7, and thus, it can be included in both of them simultaneously.
Summarizing Cases 5 and 7 in the above subsections C-A and C-B, Table II and Theorem 2 can be obtained. Meanwhile, summarizing Cases 1-4 in Appendix B-A, we obtain Table III.