A Survival Game Analysis to Personal Identity Protection Strategies

Throughout the years, authentication processes of individuals' identities have become essential parts of our modern daily life. These authentication processes also introduced the heavy use of Personally Identifiable Information (PII) in various applications. On the other hand, the continuous increase of using identifiable information -the unauthorized use of such PII-has created rich business opportunities for identity protection service providers. These services usually consist of a monitoring system that continuously searches through the Internet for incidents that supposedly indicates identity theft activities. However, these solutions are largely based on case studies and a quantified method is missing among different identity protection services. This research offers a tool that provides quantitative analysis among different identity protection services. By bringing together previous work in the field, namely the UT Center for Identity (CID) Identity Ecosystem (a Bayesian network mathematical representation of a person's identity), real world identity theft data, stochastic game theory, and Markov decision processes, we generate and evaluate the best strategy for defending against the theft of personal identity information. One of the research problems that this paper addresses is the computation complexity of quantitatively evaluating identity protection strategies with real world data. In a real world database like Identity Threat Assessment and Prediction (ITAP) project which the UT CID Identity Ecosystem is built on, the number of PII attributes in use are normally in the order of 10 ³ . We propose a reinforcement learning algorithm for solving the optimal strategy to protect the user's identity against a malicious and efficient attacker. We aim to understand how initial individual PII exposure evolves into crucial PII breaches over time in terms of the dynamic integrity of the Identity Ecosystem. Real world identity protection strategies are then translated into the system and we evaluate/simulate their effectiveness against a malicious attacker for quantitative comparison in our experiment. We present the survival analysis to these strategies and calculate the survival gap between these strategies against our active protection strategy as our experiment result. This study is aimed to understand the evolutionary process of identity under attack which may inspire a new direction for future identity protection strategies.