2.1 Vulnerability disclosure behavior

Many scholars have investigated the reasons for the participants’ engagement in vulnerability disclosure behavior from three aspects: participants’ motivation, participants’ characteristics, and trust relationship. First, the participants’ motivation for vulnerability disclosure behavior encompasses both internal and external factors. According to self-determination theory, internal motivation refers to the drive resulting from the participants’ psychological needs, including the need for autonomy, competence, and relatedness [4]. The need for autonomy is manifested by a desire to engage in vulnerability disclosure based on personal interests and beliefs, with interests being a primary driver [5, 6]. The need for competence is expressed as seeking affirmation of one’s abilities during the disclosure process; participants’ enthusiasm increases when they recognize their capability to discover vulnerabilities or contribute to patch management [7]. The need for relatedness involves establishing safe and enjoyable connections with others, such as software vendors forming a “Fixers’ Alliance” or security researchers making connections on cybersecurity forums [8, 9]. External motivation refers to drives from external influences, such as obtaining rewards(money, gifts) [10, 11], or gaining reputations(hall of fame, industry prestige) [5, 7]. It has been shown that participants weigh the expected utility against the expected cost (time, effort), and when the utility is greater than the cost, motivation to participate in vulnerability disclosure is higher [2, 12]. Second, Second, regarding the participants’ characteristics, many scholars have sorted out the characteristics of vulnerability disclosure behavior from the vulnerability life-cycle perspective, i.e. vulnerability discovery, exploitation, and patching respectively. Most of the research findings are focused on vulnerability discovery. For instance, Zhao et al. [8, 13] found that few security researchers can disclose all the vulnerabilities, and the number of vulnerability discoveries they may handle follows a power-law distribution. Votipka et al. [14] demonstrated that experience and knowledge are essential factors influencing participants’ vulnerability disclosure behavior by comparing the vulnerability discovery methods. Maillart et al. [2] argued that the vulnerability disclosure capabilities of the participants decrease exponentially with an increase in the number of vulnerabilities discovered, which means there is a significant productivity gap among the participants, and few of them may discover the vulnerabilities efficiently [15]. In terms of vulnerability exploitation, Canann [16] found that the higher the attack level, the greater the ability of the exploiter, and the greater the spread of the attack. In terms of vulnerability patching, Sen et al. [17] pointed out that vulnerability patchers’ ability, including the time and number of vulnerability patches, is positively correlated with the vulnerability patching rate. Ruohonen et al. [18] argued that most products have vulnerabilities in their early stages of development due to the economics of the software industry, which directly impacts the effectiveness of security researchers’ vulnerability disclosure behavior. Third, trust relationship among participants is a prerequisite for vulnerability disclosure [9]. Zhao et al. [5] found that due to the information asymmetry in the software market, the public faces to uncertain risks of vulnerability disclosure, and security commitments from enterprises to the public incentivize them to engage in vulnerability disclosure. Meanwhile, the transparent and accurate information from enterprises to security researchers helps enhance their trust relationships [19], which makes it possible to institutionalize the ethical hacker culture [20].

As vulnerability disclosure behavior is intricate with diverse strategies adopted by relevant participants, appropriate regulatory mechanisms should be investigated to constrain their behaviors, which has been focused on two main topics: legal boundary and legal risk. Legal boundary is a prerequisite for clarifying the legality of vulnerability disclosure behavior. There is a legal gray area for vulnerability disclosure, where enterprises find it difficult to distinguish the intentions of security researchers. Malicious researchers create risks by exploiting undiscovered vulnerabilities in applications, networks and services [21, 22]. Even ethical researchers could be considered illegal if they accessed or controlled software and hardware without authorization during the process of reporting vulnerabilities [23]. Therefore, a clear legal framework is developed to define security researchers’ behavioral boundaries. The other research hotspot is legal risk, which is a key factor hindering security researchers from engaging in vulnerability disclosure. It showed that legal restrictions are cited as a reason for non-cooperative vulnerability disclosure by 60 percent of security researchers outside the enterprises [3]. Akgul et al. [24] argued that if security researchers’ rights cannot be guaranteed, even though they report vulnerabilities ethically, enterprises may transfer the responsibility of discovering vulnerabilities to them to avoid bearing the costs and liabilities, which causes responsibility dumping. If the rights and responsibilities of vulnerability disclosure are clarified, then security researchers are willing to engage in vulnerability disclosure because it shields them from the risk of legal litigation [25]. However, excessive restrictions or inconsistent legislation might result in a “chilling effect”, decreasing security researchers’ willingness to disclose vulnerabilities [26], which adversely affects the vulnerability disclosure ecosystem [13].

2.2 Security crowd-testing

Although regulation of vulnerability disclosure behavior among hackers has been studied for many years, the emergence of new technologies and service models necessitates the collective participation of multiple stakeholders such as enterprises and service companies in collaborative disclosure. Especially, With the increasing prominence of security issues in fields of industry, healthcare, and the Internet of Things (IoT) [27–30], hackers exploiting vulnerabilities in artificial intelligence [31], blockchain [32], and intrusion detection systems [33] to launch large-scale targeted attacks have become norm. The demand for efficient data analysis and processing [34, 35], network security protection [27], and privacy data protection [32] is steadily increasing for enterprises. Security crowd-testing services like Bug Bounty Programs, Vulnerability Reward Programs (VRPs), and Crowdsourcing Software Testing have become crucial means for discovering vulnerabilities in these emerging technologies and ensuring their effective operation.

Some scholars have delved into the effectiveness of disclosing vulnerabilities through security crowd-testing platforms in safeguarding cybersecurity [36–38]. Pascariu et al. [39] argued that security crowd-testing complements enterprises’ cybersecurity management. By offering bounty rewards to vulnerability discoverers and encouraging them to compete with malicious researchers, it is possible to reduce the risk of initial attacks and the probability of vulnerabilities being exploited.

The motivation of security researchers in security crowd-testing has been extensively studied [1, 13]. The findings indicated that money is a significant incentive to discover and disclose vulnerabilities [15, 40, 41]. Finifter et al. [42] found that in Google’s VRP and Mozilla’s Firefox VRP, variable rewards and incentive mechanisms are more attractive to white-hat hackers. Additionally, some security researchers are driven by intrinsic motivation, such as enjoyment and a desire for learning [43]. Meanwhile, due to the heterogeneity among security researchers, social status improvement, knowledge acquisition, or altruism, etc. may become their primary motivations [14]. On the contrary, the mismatch between the abilities of security researchers and the necessary vulnerability discovery skills diminishes their willingness to participate [44], so as the unclear rules and uncertain legal risks in the vulnerability disclosure process or security crowd-testing platforms [45].

The mechanisms to promote active vulnerability disclosure behaviors of security researchers in security crowd-testing have been a recent hotspot. From the perspective of the crowdsourcing platform, Luna [15] found a positive correlation between the completeness of security crowd-testing rules and the willingness of vulnerability disclosure behavior in HackerOne. Ahmed et al. [46] discovered that redundant and ineffective disclosure reports decrease the population of experienced white-hat hackers. From a macro-policy perspective, Zhao et al. [5] evaluated various policies by developing economic models and found that incentive mechanisms are more effective for security researchers. From guiding participant behavior perspective, numerous scholars employed methods such as machine learning, deep learning, and others capable of efficiently identifying and classifying characteristics to monitor data and predict behavior [31, 33], and often using confusion matrices to evaluate their results [47]. These methods often focus on accurate predictions of the behavior of individual participants, while the analysis of regulatory mechanisms typically involves multiple stakeholders including regulators and those being regulated, whose behaviors interact with each other. Therefore, in addressing such issues, game theory has become the most suitable and preferred approach that is applicable for studying behavior interactions and strategy selection. Xiong et al. [48] constructed a game model considering third-party vulnerability-sharing platforms and found that security researchers’ vulnerability disclosure behaviors are encouraged by establishing a credit system for patch development and improving the punishment mechanism for dishonesty. Xu et al. [49] developed a game model to confirm government punishment mechanisms can facilitate win-win situations for enterprises and consumers in certain scenarios. Further, evolutionary game theory has become the preferred choice for most scholars to investigate regulatory mechanisms due to its applicability in studying the dynamic evolution of the long-term behavior of multiple parties. Chen et al. [50] constructed an evolutionary game model of the government and enterprises which explored the constraints of government tax subsidy mechanism on the behavior of the participants. Zhou et al. [51] focused on a punishment mechanism within a reasonable range which is more effective than an incentive mechanism, and proposed suggestions such as intervening as early as possible, and gradually weakening the regulation after stabilizing. Chen et al. [52] also pointed out that a high degree of subsidies will not play a role in restraining the behavior of the main parties, and the government should set up reasonable incentive mechanisms to prevent potential “incentive redundancy”. Chen et al. [53] took a long-term perspective and argued that the enhancement of government reputation plays a crucial role in constraining the behavior of other agents.

It is worth noting that traditional game models require the rational players. However, such strict conditions are not satisfied by the SRCs, security researchers, and the government in reality. For example, security researchers may be irrationally driven by huge profits, hiding their illegal behaviors from SRCs and governments without being detected. Therefore, traditional game models are not suitable in our paper. The evolutionary game model overcomes the above drawbacks and does not require the players to be completely rational. Hence, the evolutionary game model is developed to analyze the stakeholders’ vulnerability disclosure behaviors in the security crowd-testing service.

In summary, the gaps between existing research and this paper are: 1) Existing research primarily has focused on the reasons for participating in vulnerability disclosure and the legal boundaries and risks faced by security researchers, while there is relatively little research on the regulation of vulnerability disclosure behavior. 2) It has been confirmed that security crowd-testing is an effective means to promote vulnerability disclosure, and many scholars have conducted research on the motivation, characteristics, and trust of responders (enterprises) and discoverers (security researchers). Although the interdependence of interests and behaviors among participants has proven to be pervasive, research on their interactions has been limited. 3) Previous research has mainly explored reasons for the low willingness of discoverers (security researchers) to participate in vulnerability disclosure from a legal perspective, but rarely investigated managerial regulatory mechanisms for guiding operators (SRCs) and discoverers (security researchers) to collaborative disclosure. 4) It has been confirmed that incentive mechanisms can encourage security researchers to engage in vulnerability disclosure in security crowd-testing, most studies focus on platforms’ reward mechanisms and the government’s punishment mechanisms. The scope and variety of these mechanisms are relatively limited, leading to a lack of the theoretical foundation for guiding the healthy development of the security crowd-testing industry. Therefore, focusing on promoting collaborative vulnerability disclosure among all parties under security crowd-testing, this paper constructs an evolutionary game model considering factors such as punishments, rewards, trust costs, illegal benefits, etc. We explore the interactions of SRCs, security researchers, and the government to propose regulation mechanisms including reward and punishment mechanisms, trust mechanisms, publicity and training mechanisms, and further analyze the impact of these mechanisms on tripartite parties’ behaviors. This paper aims to provide theoretical support and practical recommendations for improving regulatory mechanisms to facilitate collaborative vulnerability disclosure considering security crowd-testing. The differences between the existing literature and this paper are shown in Table 1.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Differences between the existing literature and this paper.

https://doi.org/10.1371/journal.pone.0304467.t001

3.1 Problem description

In the security crowd-testing process, SRCs need to communicate directly with security researchers and be regulated by the government as well. Hence, there are three players in the game including SRCs, security researchers, and the government.

Generally, SRCs are established by technically proficient enterprises, attracting security researchers to report vulnerabilities in a platform. Although the costs are relatively high, forming a collaborative vulnerability reporting system with security researchers outside the enterprises can enhance their abilities to deal with vulnerabilities, which simplifies the vulnerability disclosure process. However, during the operation of SRCs, their mismanagement may conflict with security researchers, such as inconsistencies in vulnerability rating rules, disputes over the methods of vulnerability testing, and unclear vulnerability reward mechanisms, etc. In this situation, SRCs usually employ two strategies, i.e., “active management” and “negative management”.

Security researchers are providers of security crowd-testing services, mainly comprising internal experts from enterprises and external white-hat hackers from the hacker community. Due to the wide variety of security researchers, it is challenging to detect and restrict their behaviors effectively. Plus, their motivations are various, including personal interests, beliefs, and self-affirmation. But most of them are primarily driven by external factors such as rewards (money, gifts) and reputation (hall of fame, industry prestige), etc. When profits are significant, security researchers may take illegal behaviors that violate crowd-testing rules, and they may even sell discovered vulnerability information to the black market. Therefore, security researchers have two strategies, i.e., “legal participation” and “illegal participation”.

The government primarily refers to agencies responsible for cybersecurity regulation, including government departments such as the Cyber Security Office, National Security Agency, Ministry of Industry and Information Technology, as well as cybersecurity technology centers such as Computer Emergency Response Teams and Center for Internet Security. These agencies are responsible for managing vulnerability disclosure activities, and their responsibilities encompass coordinating the vulnerability disclosure process, promoting collaborative vulnerability disclosure and real-time sharing of vulnerability information, jointly assessing and managing vulnerability risks, and against illegal activities related to vulnerability disclosure. Theoretically, both SRCs and security researchers are regulated by the government. However, in reality, vulnerability disclosure spans various industries with numerous entities. In the condition of limited personnel, financial, and material resources, government regulatory efforts may vary significantly. Therefore, the government typically adopts two behavioral strategies, i.e., “strict regulation” and “lax regulation”.

In cases where SRCs are driven by negative management motivations stemming from factors like time, cost, and funding, it may result in inadequate management, a lack of respect for the security researchers’ efforts, and a deficit in effective communication with them. This may lead to mistrust between SRCs and security researchers, which further affects their cooperative relationship, causing losses for both parties. Security researchers help SRCs discover vulnerabilities but are also driven by their own interests, so they do not always prioritize SRCs’ rules. When security researchers are legal participants, they receive bounties from SRCs based on the severity and value of the vulnerabilities. However, when they are illegal participants, they may violate SRCs’ rules and face punishments under SRCs’ positive management, while they also could gain illegal benefits. For the government, it punishes SRCs and security researchers who violate legal regulations, while also rewarding those SRCs who engage in positive management. The game relationship among these three parties is shown in Fig 2.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 2. Game relationship among SRCs, security researchers and the government.

https://doi.org/10.1371/journal.pone.0304467.g002

3.2 Assumptions and variables

Assumption 1. The set of strategies for SRCs is {active management, negative management}, the probability of active management is x, and the probability of negative management is 1 − x; the set of strategies for security researchers is {legal participation, illegal participation}, the probability of legal participation is y, and the probability of illegal participation is 1 − y; the set of strategies for the government is {strict regulation, lax regulation}, the probability of strict regulation is z, and the probability of lax regulation is 1 − z, in which x, y and z ∈ [0, 1].

Assumption 2. The basic benefits for SRCs participating in security crowd-testing are S₁, which include obtaining vulnerability information to improve system security, enhancing user trust, and establishing a positive credit of actively addressing security issues. The basic costs of SRCs are C₁, including operational costs and incentive costs. Operational costs cover expenses for running and maintaining the security crowd-testing platform, formulating vulnerability crowd-testing guidelines, auditing vulnerability quality, and assessing vulnerability risks. Incentive costs include expenses for organizing cybersecurity skills competitions, vulnerability bounties, team bonuses, credit rewards, honor lists, etc. It is worth noting that there is a superlinear relationship between the number of security researchers and the number of vulnerabilities discovered. In other words, the more security researchers participate, the higher the quality of SRCs’ services and the system’s security level. In the case of positive management, a higher degree of active management α will attract more security researchers, resulting in higher benefits and costs. Therefore, the benefits of SRCs’ active management are αS₁, and the costs are αC₁. Additionally, SRCs’ negative management receives additional benefits S₂, for example, concealing the authenticity and severity of vulnerabilities to reduce the bounties paid to security researchers, where S₁ + S₂ > αS₁. Security researchers of illegal participation cause losses to SRC’ L₁, including vulnerability information leakage and exploitation of vulnerabilities.

Assumption 3. The costs of security researchers to participate in security crowd-testing are C₂, including tools, time, and effort required to discover vulnerabilities, which are the same for legal and illegal participation. The benefits for security researchers’ legal participants are P₁, which include bounties, reputation, and credits earned, while those who illegally participate earn higher benefits of P₂, including benefits from infiltrating other systems or illegally selling vulnerabilities, in which P₁ < P₂. SRCs with positive management can detect the illegal behaviors in time and impose punishments of F, such as freezing credit rewards, banning the conversion of bonuses, etc. However, in the case of negative management, SRCs may not detect security researchers’ illegal behaviors promptly. Additionally, SRCs’ negative management causes losses of L₂ to security researchers who participate legally, such as not responding promptly or refusing to acknowledge vulnerabilities submitted by researchers, in which L₂ ≤ P₁ < P₂.

Assumption 4. The costs of the government’s strict regulation are C₃, which include costs of improving the establishment of a supervisory system for vulnerability disclosure, inspections of non-compliance with disclosure regulations, optimization of cybersecurity vulnerability management technologies, and participation in vulnerability disclosure audit. Strict regulation can increase public satisfaction and enhance government credibility, resulting in regulatory benefits for the government of R. To promote collaborative vulnerability disclosure, the government usually implements rewards and punishments measures. Specifically, the government provides rewards of A for SRCs’ active management, imposes punishments of K₁ for SRCs’ negative management, and gives punishments of K₂ for security researchers of illegal participation, such as warnings, fines and rectifications. In the case of lax regulation, there are no regulatory costs or benefits.

Assumption 5. Trust between SRCs and security researchers is crucial. In the case of active management, SRCs always pay additional trust costs C₄ to establish and maintain long-term effective trust relationships, including the establishment of vulnerability reporting response mechanisms, timely coordination and communication, feedback on the progress of vulnerability disclosure, etc. At this time, the higher level of trust between the two parties brings trust benefits of S₃ to SRCs. For example, security researchers tend to participate in crowd-testing tasks from SRCs with higher trustworthiness. In contrast, SRC’ negative management are unwilling to pay additional trust costs, leading to an escalation of conflicts, resulting in losses of L₃ to SRCs, such as the loss of security researchers boycotting SRCs’ crowd-testing tasks and reputational damage from media coverage, etc. As there is no trust issue between security researchers of illegal participation and SRCs, we do not consider this situation in the game.

Assumption 6. When SRCs choose active management and security researchers choose legal participation, it brings social benefits of M. However, when SRCs engage in negative management or security researchers engage in illegal participation, the social losses would be W.

Table 2 presents the parameters along with their meanings.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. The main parameters of the tripartite regulatory game model under security crowd-testing.

https://doi.org/10.1371/journal.pone.0304467.t002

3.3 Model construction

Based on the assumptions and parameters defined, the game payoff matrix of the tripartite is shown in Table 3.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 3. Payment matrix of evolution game among SRCs, security researchers and the government.

https://doi.org/10.1371/journal.pone.0304467.t003

4.1 Stability analysis of SRCs

According to Table 2, the expected income E₁₁ or E₁₂ of SRCs when they choose the “active management” or “negative management” strategy is respectively: (1) (2)

The average expected income of SRCs is: (3)

According to Formulas 1, 2 and 3, we can further obtain the replicator dynamics equation of SRCs’ strategy as follows: (4)

The first-order derivatives of x and G(y) are as follows: (5) (6)

In order to find the probability of SRCs choosing active management in the steady state, it must be satisfied that F(x) = 0, and . As ∂G(y)/∂y < 0, G(y) is a decreasing function with respect to y.

When y = S₁ + S₂ + αC₁ + C₄ − C₁ − αS₁ − F − (A + K₁) z/L₃ + S₃ − F = y**, G(y) = 0, so , that is F(x) = 0, at this time all x is in a stable state. When y < y*, G(y) < 0, and d(F(x))/dx|_{x = 0} < 0, at this time for any x = 0 as an evolutionary stabilization strategy for SRCs. Conversely, x = 1 is an evolutionary stabilization strategy for SRCs. The strategy evolution phase diagram of SRCs is shown in Fig 3:

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 3. Strategy evolution phase diagram of SRCs.

https://doi.org/10.1371/journal.pone.0304467.g003

Fig 3 shows that the volume of the probability that SRCs choose negative management is of A₁, and the volume of the probability that they choose compliance disclosure behavior is of A₂: (7) (8)

Proposition 1. The probability that SRCs choose active management is positively correlated with trust losses and gains, and the governments’ rewards and punishments, while negatively correlated with the benefits of negative management and the costs of active management.

Proof. The probability of SRCs active management is , By solving for the first-order partial derivatives of the elements, we get:, , , . Therefore, the increase of L₃, S₃, A, and K₁, and the decrease of S₁ + S₂ and αC₁ + C₄ can make the SRCs increase the probability of active management.

Proposition 1 indicates that increasing the benefits of SRCs’ active management can reduce the probability of their negative management. Therefore, the government can take various measures to enhance SRCs’ willingness to choose active management, which includes strengthening reward mechanisms and guiding the behavior of SRCs and security researchers through media promotion and policy documents to promote the establishment of the trust relationship. Simultaneously, enhancing the degree of punishments, which can rigorously control the benefits of negative management to decrease the costs of active management, can promote the stable development of SRCs.

4.2 Stability analysis of security researchers

According to Table 2, the expected income E₂₁ or E₂₂ of security researchers when they choose the “legal participation” or “illegal participation” strategy is respectively: (9) (10)

The average expected income of security researchers is: (11)

According to Formulas 9, 10 and 11, we can further obtain the replicator dynamics equation of the strategy selection of security researchers as follows: (12)

The first-order derivative of y is as follows: (13)

Let: (14)

In order to find the probability of security researchers choosing legal participation in the steady state, it must be satisfied that F(y) = 0 and d(F(y))/dy < 0, which results in J(z) being a decreasing function.

When z = L₂ + P₂ − P₁ − (F + L₂) x/K₂ = z*, J(z) = 0, at this time , for any y is in a stable state. When z < z*, G(z) > 0, at this time d(F(y))/dy|_y=0 < 0, y = 0 is an evolutionary stabilization strategy for security researchers. Conversely, y = 1 is an evolutionary stabilization strategy. The strategy evolution phase diagram of security researchers is shown in Fig 4.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 4. Strategy evolution phase diagram of security researchers.

https://doi.org/10.1371/journal.pone.0304467.g004

According to Fig 4, the volume of the probability of security researchers’ legal participation is of B₁, and the volume of the probability of illegal participation is of B₂: (15) (16) Proposition 2. The probability of security researchers’ legal participation is positively correlated with the benefits of legal participation and the punishments imposed by the government and SRCs, while negatively correlated with the losses from negative management by SRCs and the benefits of illegal participation.

Proof. Based on the expression for the probability of security researchers’ legal participation , the first-order partial derivative of each element is obtained: , , , , . Thus, both an increase in P₁, K₂, and F and a decrease in P₂ and L₂ both increase the probability of security researchers’ legal participation.

Proposition 2 suggests that when the illegal benefits of security researchers participating illegally are too high, the government should strengthen regulation. Additionally, the government can reduce the probability of security researchers’ illegal participation by cooperating with SRCs in regulation and providing timely punishments.

4.3 Stability analysis of the government

Similarly, the expected income E₃₁ or E₃₂ of the government when choosing “strict regulation” or “lax regulation” strategy is respectively: (17) (18)

The average expected income of the government is: (19)

According to Formulas 17, 18 and 19, we can further obtain the replicator dynamics equation of the behavior strategy selection of the government as follows: (20)

The first-order derivatives of z, and the set H(y) are as follows: (21) (22)

The government chooses strict regulation in a steady state must be satisfied that F(z) = 0, and d(F(z))/dz < 0. It can be derived that ∂H(y)/∂y > 0, H(y) is an increasing function with respect to y.

When y = C₃ − K₁ − K₂ − R + (A + K₁) x/K₂ = y**, at this time H(y) = 0, and , for any z is in a stable state. When y < y*, G(z)>0, at this time H(y) < 0, and d(F(z))/dz|_z=1 > 0, z = 1 is an evolutionary stabilization strategy. Conversely, z = 0 is an evolutionary stabilization strategy. The strategy evolution phase diagram of the government is shown in Fig 5.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 5. Strategy evolution phase diagram of the government.

https://doi.org/10.1371/journal.pone.0304467.g005

From Fig 5, the volume of the probability that the government strict regulation is of C₁, and the volume of the probability that the government strict regulation is of C₂: (23) (24) Proposition 3. The probability that the government implements strict regulation is positively correlated with its punishments for SRCs and security researchers, and regulatory benefits, while negatively correlated with the costs of strict regulation and rewards of the government.

Proof. According to the , it is derived that , , , , . Therefore, an increase in K₁, K₂, R and a decrease in C₃, A can lead to an increase in the probability of the government’s strict regulation.

Proposition 3 indicates that the severity of government punishments is positively correlated with the degree of strict regulation and negatively correlated with the level of rewards. In other words, higher regulatory benefits can incentivize the government to rigorously fulfill its regulatory responsibilities.

4.4 Systematic equilibrium point analysis of the tripartite evolutionary game

The above equilibrium point is not completely an evolutionary stability strategy for replicating a dynamic system. In asymmetric games, the mixed strategy equilibrium points are saddle points, and the strategies at strict Nash equilibrium are all pure. Therefore, we only focus on analyzing the stability of the eight pure strategy equilibrium points. It is necessary to further discuss the stability of the system equilibrium point by using the Jacobian matrix local stability analysis method. According to the Lyapunov theorem, when all the eigenvalues in the Jacobi matrix are satisfied with negative real parts, then the potential equilibrium point represents an evolutionarily stable strategy in the evolutionary game. The Jacobian matrix of the tripartite evolutionary game system is (25) Where (26) (27) (28) (29) (30) (31) (32) (33) (34)

The eigenvalues of the Jacobian matrix corresponding to the eight equilibrium points and the system stability are shown in Table 4.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 4. Eigenvalues corresponding to pure strategy equilibrium points.

https://doi.org/10.1371/journal.pone.0304467.t004

It can be seen that E₂(0, 1, 0) is never an equilibrium under any case, indicating the absence of security researchers choosing the legal participation strategy without external incentives. This indirectly illustrates the crucial role played by the government in guiding security researchers’ behavior. As for point E₅(1, 0, 0), when SRCs choose active management, in reality, offering substantial rewards and diverse incentives, security researchers tend to legal participation rather than engage in illegal activities like trading in the black market for vulnerabilities. This point contradicts reality, so it is excluded.

Furthermore, it is calculated that E₈(1, 1, 1) is in a stable state. In this scenario, the government regulation tends to become routine, with SRCs actively communicating and collaborating with it. At this time, SRCs stay updated on the latest regulatory developments, enhance risk management and preventive measures, and avoid non-compliant disclosure behavior. Meanwhile, SRCs make efforts to improve the rules of security crowd-testing, define internal responsibilities, specify the scope of security researchers’ authority, rigorously follow vulnerability approval and authorization procedures, and enhance relevant incentive mechanisms. In this context, the advantages of SRCs’ active management become evident, and they tend to choose active management strategy, i.e., C₄ + S₁ + S₂ + αC₁ − C₁ − A − K₁ − S₃ − L₃ − αS₁ < 0. Through the continuous development of SRCs, the legitimacy, security, and stability of the security researcher crowd-testing environment have improved, making it more attractive to security researchers, with P₂ − K₂ − P₁ − F < 0, prompting security researchers to prefer the legal participation strategy. For the government, SRCs and security researchers actively cooperate, gradually reducing the government’s regulatory costs, and significantly increasing regulatory benefits, i.e., A + C₃ − R < 0, leading the government to implement strict regulatory strategy. Ultimately, the system achieves the ideal state of active management, legal participation, strict regulation in collaborative vulnerability disclosure.

6.1 Conclusions

Security crowd-testing has reduced the barriers to the vulnerability disclosure process but has also brought about issues like non-compliant vulnerability disclosure and conflicts of interest. Therefore, to promote collaborative disclosure among various stakeholders, investigating the regulatory mechanisms of vulnerability disclosure behaviors in security crowd-testing is essential. In view of this, based on evolutionary game theory, this paper explores the evolutionary process of strategies for SRCs, security researchers, and the government, as well as the corresponding stable states. Subsequently, numerical simulations are conducted by MATLAB to investigate the impact of key parameters on evolutionary stability and propose targeted regulatory mechanisms.

Differing from previous studies, we examine the evolution of vulnerability disclosure behaviors in multi-agent interactions from a management perspective and identify the following conclusions. Firstly, in terms of the factors and mechanisms impacting the evolutionary game system’s steady state, the initial willingness of SRCs, security researchers, and the government has no impact on the system’s stable evolutionary strategy, which evolves to the stable state of collaborative vulnerability disclosure {active management, legal participation, strict regulation}. The higher their initial willingness to adopt cooperative strategies, the faster the system reaches this equilibrium, which was consistent with the conclusion of Zhou et al. [51]. However, when government regulatory benefits are low, the system cannot reach a stable state. Secondly, in terms of the government’s incentive mechanisms for SRCs, increasing rewards and punishments can incentivize SRCs and security researchers to adopt cooperative strategies. However, excessive punishments result in high regulatory costs that are unfavorable for the government to implement strict regulation, and excessive rewards induce SRCs to adopt overly stringent management measures, thereby diminishing the motivation of security researchers, both of which hinder collaborative disclosure. Chen et al. [50] constructed a similar evolutionary game model for government subsidies, which also concluded that excessive government subsidies are detrimental to reaching the system’s steady state. Thirdly, in terms of the government’s incentive mechanisms for security researchers, different from the findings of Zhao et al. [56], we find that compared to incentive mechanisms for SRCs, the government’s increasing punishments for security researchers are more effective, which can encourage SRCs to adopt cooperative strategies by regulating security researchers’ behaviors. Fourthly, in terms of SRCs’ incentive mechanisms for security researchers, while SRCs’ increasing punishments for security researchers may decelerate the government reaching a stable state, it can compensate for the government’s deficiencies in sole regulation by forming a society-wide co-regulatory system as mentioned by Chen et al. [53], but excessive punishments should be avoided. Fifthly, in terms of the trust mechanism between SRCs and security researchers, increasing trust benefits or reducing illegal benefits can enhance the willingness of SRCs and security researchers to choose cooperative strategies, which plays an important role in promoting the system to reach the ideal state of collaborative disclosure. It is consistent with Chen et al. [57] who used evolutionary game theory to argue that building trust relationships is a crucial part of public crisis governance.

Combining previous research and based on the analysis results of this paper, we optimize existing regulatory mechanisms and propose new regulatory mechanisms from the perspective of the new model of security crowd-testing. In response to different regulators and those being regulated, incentive mechanisms including the reward mechanism, the punishment mechanism, the trust mechanism, and the publicity and training mechanism have been proposed, as shown in Fig 14.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 14. Proposed regulatory mechanisms.

https://doi.org/10.1371/journal.pone.0304467.g014

1. The government’s reward and punishment mechanism for SRCs
   The government should set appropriate reward levels based on the situation of SRCs and security researchers, and dynamically adjust the reward mechanism to achieve the dual goals of reducing regulatory costs and maximizing the effectiveness of the reward mechanism. Meanwhile, to swiftly achieve the goal of collaborative vulnerability disclosure, the government should adopt the regulatory mechanism as “punishments primarily, rewards complementary”, while setting scientific punishment levels to achieve effective regulation without diminishing the enthusiasm of participants in vulnerability disclosure.
2. The government’s punishment mechanism for security researchers
   The government should clarify the policy provisions and industry norms of security crowd-testing and implement strict punishment mechanisms for security researchers. To intensify punishments for security researchers engaged in illegal activities, the government should implement measures including administrative sanctions, reputational punishments, and notification of illegal activities, to fundamentally reduce or prevent the illegal participation of security researchers, optimizing the environment of the security crowd-testing market.
3. SRCs’ punishment mechanism for security researchers
   To incentivize security researchers to participate legally, SRCs must enhance the platform’s relevant regulations in accordance with the government’s policies, including clearly defining rights and responsibilities, establishing responsibility boundaries, and clarifying illegal activities. Moreover, SRCs should promptly detect and punish illegal security researchers based on platform rules, including fines, revoking credits, and account suspensions. This supplements government regulation, establishing a collaborative regulatory system between the government and SRCs.
4. The trust mechanism between SRCs and security researchers
   SRCs should proactively implement diverse trust mechanism through multiple channels, including establishing communication platforms, promoting multi-channel communication, and implementing vulnerability disclosure credit systems, to actively build a trust framework enhancing the long-term effectiveness of security crowd-testing vulnerability disclosure.
5. The publicity and training mechanism for security researchers
   The government should establish a comprehensive publicity mechanism, including policy advocacy, the establishment of publicity platforms, and the organization of regular publicity events, to clarify the severe harm and consequences of illegal activities, reducing security researchers’ illegal participation willingness. Additionally, SRCs should establish a training mechanism, including routine training, online training, and periodic evaluations, to enhance security researchers’ capabilities and reduce their illegal benefits, which can optimize the security crowd-testing environment to promote collaborative vulnerability disclosure.

6.2 Limitations and future work

This paper provides a theoretical foundation and practical recommendations for regulatory mechanisms of participants’ vulnerability disclosure behaviors in security crowd-testing. There are still worthy viewpoints to further study. On one hand, vulnerability disclosure in security crowd-testing is a complex process involving multiple stakeholders, while we only focus on the core participants involved in vulnerability disclosure and do not consider various types and characteristics of participants, such as social public and the media, etc., or considering the homogeneity or heterogeneity of SRCs or security researchers as well. On the other hand, the security crowd-testing environment is not sufficiently detailed, which considers the cooperation between SRCs and security researchers, as well as between enterprises and SRCs. In fact, there is intense competition among enterprises, SRCs and security researchers. In future research, it may be worthwhile to analyze vulnerability disclosure issues from a competitive perspective, considering the preferences and attributes of different participants.