Detection Games under Fully Active Adversaries

Signal processing techniques are routinely applied in the great majority of security-oriented applications. In particular, the detection problem plays a fundamental role in many security-related scenarios, including secure detection and classification, target detection in radar-systems, intrusion detection, biometric-based verification, one-bit watermarking, steganalysis, spam-filtering, and multimedia forensics (see [1]). A unifying characteristic of all these fields is the presence of an adversary explicitly aiming at hindering the detection task, with the consequent necessity of adopting proper models that take into account the interplay between the system designer and the adversary. Specifically, the adopted models should be able to deal, on the one hand, with the uncertainty that the designer has about the attack the system is subject to, and, on the other hand, with the uncertainty of the adversary about the target system (i.e., the system it aims at defeating). Game theory has recently been proposed as a way to study the strategic interaction between the choices made by the system designer and the adversary. Among the fields wherein such an approach has been used, we mention steganalysis [2,3], watermarking [4], intrusion detection [5] and adversarial machine learning [6,7]. With regard to binary detection, game theory and information theory have been combined to address the problem of adversarial detection, especially in the field of digital watermarking (see, for instance, [4,8,9,10]). In all these works, the problem of designing watermarking codes that are robust to intentional attacks is studied as a game between the information hider and the attacker.

An attempt to develop a general theory for the binary hypothesis testing problem in the presence of an adversary is made in [11]. Specifically, in [11], the general problem of binary decision under adversarial conditions is addressed and formulated as a game between two players, the defender and the attacker, which have conflicting goals. Given two discrete memoryless sources, $P_0$ and $P_1$, the goal of the defender is to decide whether a given test sequence has been generated by $P_0$ (null hypothesis, ${\mathcal{H}}_0$) or $P_1$ (alternative hypothesis, ${\mathcal{H}}_1$). By adopting the Neyman–Pearson approach, the set of strategies the defender can choose from is the set of decision regions for ${\mathcal{H}}_0$ ensuring that the false positive error probability is lower than a given threshold. On the other hand, the ultimate goal of the attacker in [11] is to cause a false negative decision, so the attacker acts under ${\mathcal{H}}_1$ only. In other words, the attacker modifies a sequence generated by $P_1$, in attempt to move it into the acceptance region of ${\mathcal{H}}_0$. The attacker is subjected to a distortion constraint, which limits his freedom in doing so. Such a struggle between the defender and the attacker is modeled in [11] as a competitive zero-sum game; the asymptotic equilibrium, i.e., the equilibrium when the length of the observed sequence tends to infinity, is derived under the assumption that the defender bases his decision on the analysis of first-order statistics only. In this respect, the analysis conducted in [11] extends the one of [12] to the adversarial scenario. Some variants of this attack-detection game have also been studied; for instance, in [13], the setting is extended to the case where the sources are known to neither the defender nor the attacker, while the training data from both sources are available to both parties. Within this framework, the case where part of the training data available to the defender is corrupted by the attacker has also been studied (see [14]).

The assumption that the attacker is active only under $H_1$ stems from the observation that in many cases $H_0$ corresponds to a kind of normal or safe situation and its rejection corresponds to revealing the presence of a threat or that something anomalous is happening. This is the case, for instance, in intrusion detection systems, tampering detection, target detection in radar systems, steganalysis and so on. In these cases, the goal of the attacker is to avoid the possibility that the monitoring system raises an alarm by rejecting the hypothesis $H_0$, while having no incentive to act under $H_0$. Moreover, in many cases, the attack is not even present under $H_0$ or it does not have the possibility of manipulating the observations the detector relies on when $H_0$ holds.

In many other cases, however, it is reasonable to assume that the attacker is active under both hypotheses with the goal of causing both false positive and false negative detection errors. As an example, we may consider the case of a radar target detection system, where the defender wishes to distinguish between the presence and the absence of a target, by considering the presence of a hostile jammer. To maximize the damage caused by his actions, the jammer may decide to work under both the hypotheses: when $H_1$ holds, to avoid that the defender detects the presence of the target, and in the $H_0$ case, to increase the number of false alarms inducing a waste of resources deriving from the adoption of possibly expensive countermeasures even when they are not needed. In a completely different scenario, we may consider an image forensic system aiming at deciding whether a certain image has been shot by a given camera, for instance because the image is associated to a crime such as child pornography or terrorism. Even in this case, the attacker may be interested in causing a missed detection event to avoid that he is accused of the crime associated to the picture, or to induce a false alarm to accuse an innocent victim. Other examples come from digital watermarking, where an attacker can be interested in either removing or injecting the watermark from an image or a video, to redistribute the content without any ownership information or in such a way to support a false copyright statement [15], and network intrusion detection systems [16], wherein the adversary may try to both avoid the detection of the intrusion by manipulating a malicious traffic, and to implement an overstimulation attack [17,18] to cause a denial of service failure.

According to the scenario at hand, the attacker may be aware of the hypothesis under which it is operating (hypothesis-aware attacker) or not (hypothesis-unaware attacker). While the setup considered in this paper can be used to address both cases, we focus mainly on the case of an hypothesis-aware attacker, since this represents a worst-case assumption for the defender. In addition, the case of an hypothesis-unaware attacker can be handled as a special case of the more general case of an aware attacker subject to identical constraints under the two hypotheses.

With the above ideas in mind, in this paper, we consider the game-theoretic formulation of the defender–attacker interaction when the attacker acts under both hypotheses. We refer to this scenario as a detection game with a fully active attacker. By contrast, when the attacker acts under hypothesis ${\mathcal{H}}_1$ only (as in [11,13]), it is referred to as a partially active attacker. As we show, the game in the partially active case turns out to be a special case of the game with fully active, hypothesis-aware, attacker. Accordingly, the hypothesis-aware fully active scenario forms a unified framework that includes the hypothesis-unaware case and the partially active scenario as special cases.

We define and solve two versions of the detection game with fully active attackers, corresponding to two different formulations of the problem: a Neyman–Pearson formulation and a Bayesian formulation. Another difference with respect to [11] is that here the players are allowed to adopt randomized strategies. Specifically, the defender can adopt a randomized decision strategy, while in [11] the defender’s strategies are confined to deterministic decision rules. As for the attack, it consists of the application of a channel, whereas in [11] it is confined to the application of a deterministic function. Moreover, the partially active case of [11] can easily be obtained as a special case of the fully active case considered here. The problem of solving the game and then finding the optimal detector in the adversarial setting is not trivial and may not be possible in general. Thus, we limit the complexity of the problem and make the analysis tractable by confining the decision to depend on a given set of statistics of the observation. Such an assumption, according to which the detector has access to a limited set of empirical statistics of the sequence, is referred to as limited resources assumption (see [12] for an introduction on this terminology). In particular, as already done in related literature [11,13,14], we limit the detection resources to first-order statistics, which are known to be a sufficient statistic for memoryless systems (Section 2.9, [19]). In the setup studied in this paper, the sources are indeed assumed to be memoryless, however one might still be concerned regarding the sufficiency of first-order statistics in our setting, since the attack channel is not assumed memoryless in the first place. Forcing, nonetheless, the defender to rely on first-order statistics is motivated mainly by its simplicity. In addition, the use of first-order statistics is common in a number of application scenarios even if the source under analysis is not memoryless. In image forensics, for instance, several techniques have been proposed which rely on the analysis of the image histogram or a subset of statistics derived from it, e.g., for the detection of contrast enhancement [20] or cut-and-paste [21] processing. As another example, the analysis of statistics derived from the histograms of block-DCT coefficients is often adopted for detecting both single and multiple JPEG compression [22]. More generally, we observe that the assumption of limited resources is reasonable in application scenarios where the detector has a small computational power. Having said that, it should be also emphasized that the analysis in this work can be extended to richer sets of empirical statistics, e.g., higher-order statistics (see the Conclusions Section for a more elaborated discussion on this point).

As a last note, we observe that, although we limit ourselves to memoryless sources, our results can be easily extended to more general models (e.g., Markov sources), as long as a suitable extension of the method of types is available.

One of the main results of this paper is the characterization of an attack strategy that is both dominant (i.e., optimal no matter what the defense strategy is), and universal, i.e., independent of the (unknown) underlying sources. Moreover, this optimal attack strategy turns out to be the same under both hypotheses, thus rendering the distinction between the hypothesis-aware and the hypothesis-unaware scenarios completely inconsequential. In other words, the optimal attack strategy is universal, not only with respect to uncertainty in the source statistics under either hypothesis, but also with respect to the unknown hypothesis in the hypothesis-unaware case. Moreover, the optimal attack is the same for both the Neyman–Pearson and Bayesian games. This result continues to hold also for the partially active case, thus marking a significant difference with respect to previous works [11,13], where the existence of a dominant strategy wasestablished with regard to the defender only.

Some of our results (in particular, the derivation of the equilibrium point for both the Neyman–Pearson and the Bayesian games) have already appeared mostly without proofs in [23]. Here, we provide the full proofs of the main theorems, evaluate the payoff at equilibrium for both the Neyman–Pearson and Bayesian games and include the analysis of the ultimate performance of the games. Specifically, we characterize the so called indistinguishability region (to be defined formally in Section 6), namely the set of the sources for which it is not possible to attain strictly positive exponents for both false positive and false negative probabilities under the Neyman–Pearson and the Bayesian settings. Furthermore, the setup and analysis presented in [23] is extended by considering a more general case in which the maximum allowed distortion levels the attacker may introduce under the two hypotheses are different.

The paper is organized as follows. In Section 2, we establish the notation and introduce the main concepts. In Section 3, we formalize the problem and define the detection game with a fully active adversary for both the Neyman–Pearson and the Bayesian games, and then prove the existence of a dominant and universal attack strategy. The complete analysis of the Neyman–Pearson and Bayesian detection games, namely, the study of the equilibrium point of the game and the computation of the payoff at the equilibrium, are carried out in Section 4 and Section 5, respectively. Finally, Section 6 is devoted to the analysis of the best achievable performance of the defender and the characterization of the source distinguishability.

Throughout the paper, random variables are denoted by capital letters and specific realizations are denoted by the corresponding lower case letters. All random variables that denote signals in the system are assumed to have the same finite alphabet, denoted by $\mathcal{A}$. Given a random variable X and a positive integer n, we denote by $\mathit{X}=(X_1,X_2,\dots ,X_n)$, $X_i\in \mathcal{A}$, $i=1,2,\dots ,n$, a sequence of n independent copies of x. According to the above-mentioned notation rules, a specific realization of X is denoted by $\mathit{x}=(x_1,x_2,\dots ,x_n)$. Sources are denoted by the letter P. Whenever necessary, we subscript P with the name of the relevant random variables: given a random variable x, $P_X$ denotes its probability mass function (PMF). Similarly, $P_{XY}$ denotes the joint PMF of a pair of random variables, $(X,Y)$. For two positive sequences, $\left\{a_n\right\}$ and $\left\{b_n\right\}$, the notation $a_n\stackrel{·}{=}{b}_n$ stands for exponential equivalence, i.e., ${\displaystyle \underset{n\to \infty }{lim}}1/nln\left(a_n/b_n\right)=0$, and $a_n\stackrel{·}{\le }{b}_n$ designates that ${\displaystyle \underset{n\to \infty }{lim\; sup}}1/nln\left(a_n/b_n\right)\le 0$.

For a given real s, we denote ${\left[s\right]}_{+}\stackrel{▵}{=}max\{s,0\}$. We use notation $U(·)$ for the Heaviside step function.

The type of a sequence $x\in {\mathcal{A}}^n$ is defined as the empirical probability distribution ${\widehat{P}}_x$, that is, the vector $\{{\widehat{P}}_{\mathit{x}}(x),x\in \mathcal{A}\}$ of the relative frequencies of the various alphabet symbols in x. A type class $\mathcal{T}(\mathit{x})$ is defined as the set of all sequences having the same type as x. When we wish to emphasize the dependence of $\mathcal{T}(\mathit{x})$ on ${\widehat{P}}_{\mathit{x}}$, we use the notation $\mathcal{T}({\widehat{P}}_{\mathit{x}})$. Similarly, given a pair of sequences $(\mathit{x},\mathit{y})$, both of length n, the joint type class $\mathcal{T}(\mathit{x},\mathit{y})$ is the set of sequence pairs $\left\{({\mathit{x}}^{\prime },{\mathit{y}}^{\prime })\right\}$ of length n having the same empirical joint probability distribution (or joint type) as $(\mathit{x},\mathit{y})$, ${\widehat{P}}_{\mathit{x}\mathit{y}}$, and the conditional type class $\mathcal{T}(\mathit{y}|\mathit{x})$ is the set of sequences $\left\{{\mathit{y}}^{\prime }\right\}$ with ${\widehat{P}}_{\mathit{x}{\mathit{y}}^{\prime }}={\widehat{P}}_{\mathit{x}\mathit{y}}$.

Regarding information measures, the entropy associated with ${\widehat{P}}_{\mathit{x}}$, which is the empirical entropy of x, is denoted by ${\widehat{H}}_{\mathit{x}}(X)$. Similarly, ${\widehat{H}}_{\mathit{x}\mathit{y}}(X,Y)$ designates the empirical joint entropy of x and y, and ${\widehat{H}}_{\mathit{x}\mathit{y}}(X|Y)$ is the conditional joint entropy. We denote by $\mathcal{D}(P\parallel Q)$ the Kullback–Leibler (K-L) divergence between two sources, P and Q, with the same alphabet (see [19]).

Finally, we use the letter A to denote an attack channel; accordingly, $A(\mathit{y}|\mathit{x})$ is the conditional probability of the channel output y given the channel input x. Given a permutation-invariant distortion function $d:{\mathcal{A}}^n\times {\mathcal{A}}^n\to {\mathrm{I}\mathrm{R}}^{+}$ (a permutation-invariant distortion function $d(\mathit{x},\mathit{y})$ is a distortion function that is invariant if the same permutation is applied to both x and y) and a maximum distortion $\Delta$, we define the class ${\mathcal{C}}_{\Delta }$ of admissible channels $\{A(\mathit{y}|\mathit{x}),\mathit{x},\mathit{y}\in {\mathcal{A}}^n\}$ as those that assign zero probability to every y with $d(\mathit{x},\mathit{y})>n\Delta$.

In this section, we study the detection game with a fully active attacker in the Neyman–Pearson setup as defined in Definition 1. From the analysis of Section 3.3, we already know that there exists a dominant attack strategy. Regarding the defender, we determine the asymptotically optimal strategy regardless of the dominant pair of attack channels; in particular, as shown in Lemma 1, an asymptotically dominant defense strategy can be derived from a detailed analysis of the FP constraint. Consequently, the Neyman–Pearson detection game has a dominant equilibrium.

In this section, we study the Bayesian game (Definition 2). In contrast to the Neyman–Pearson game, in the Bayesian game, the optimal defense strategy is found by assuming that the strategy played by the attacker, namely the optimal pair of channels $(A_0^{*},A_1^{*})$ of Theorem 1, is known to the defender, that is, by exploiting the rationalizability argument (see Section 2.1). Accordingly, the resulting optimal strategy is not dominant, thus the associated equilibrium is weaker compared to that of the Neyman–Pearson game.

In this section, we investigate the performance of the Neyman–Pearson and Bayesian games as a function of $\lambda$ and a, respectively. From the expressions of the equilibrium payoff exponents, it is clear that increase (and then the equilibrium payoffs of the games decrease) as $\lambda$ and a decrease, respectively. In particular, by letting $\lambda =0$ and $a=0$, we obtain the largest achievable exponents of both games, which correspond to the best achievable performance for the defender. Therefore, we say that two sources are distinguishable under the Neyman–Pearson (respectively, Bayesian) setting, if there exists a value of $\lambda$ (respectively, $\alpha$) such that the FP and FN exponents at the equilibrium of the game are simultaneously strictly positive. When such a condition does not hold, we say that the sources are indistinguishable. Specifically, in this section, we characterize, under both the Neyman–Pearson and the Bayesian settings, the indistinguishability region, defined as the set of the alternative sources that cannot be distinguished from a given source $P_0$, given the attack distortion levels ${\Delta }_0$ and ${\Delta }_1$. Although each game has a different asymptotic behavior, we show that the indistinguishability regions in the Neyman–Pearson and the Bayesian settings are the same. The study of the distinguishability between the sources under adversarial conditions, performed in this section, in a way extends the Chernoff–Stein lemma [19] to the adversarial setup (see [31]).

We start by proving the following result for the Neyman–Pearson game.

The theorem is an immediate consequence of the continuity of ${\epsilon }_{\mathrm{FN}}(\lambda )$ as $\lambda \to 0^{+}$, which follows by the continuity of ${\tilde{\mathcal{D}}}_{\Delta }$ with respect to $P_Y$ and the density of the set $\{P_Y:{\tilde{\mathcal{D}}}_{{\Delta }_0}(P_Y,P_0)\le \lambda \}$ in $\{P_Y:{\tilde{\mathcal{D}}}_{{\Delta }_0}(P_Y,P_0)=0\}$ as $\lambda \to 0^{+}$ (It holds true from Property 1).

We notice that, if ${\Delta }_0={\Delta }_1=0$, there is only an admissible point in the set in Equation (28), for which $P_Y=P_0$; then, ${\epsilon }_{\mathrm{FN}}(0)=\mathcal{D}(P_0\left|\right|P_1)$, which corresponds to the best achievable FN exponent known from the classical literature for the non-adversarial case (Stein lemma [19] (Theorem 11.8.3)).

Regarding the Bayesian setting, we have the following theorem, the proof of which appears in Appendix C.1.

Since ${\tilde{\mathcal{D}}}_{{\Delta }_1}(P_Y,P_1)$, and similarly ${\tilde{\mathcal{D}}}_{{\Delta }_0}(P_Y,P_0)$, are convex functions of $P_Y$, and reach their minimum in $P_1$, respectively $P_0$ (the fact that ${\tilde{\mathcal{D}}}_{{\Delta }_0}$ (${\tilde{\mathcal{D}}}_{{\Delta }_1}$) is 0 in a ${\Delta }_0$-limited (${\Delta }_1$-limited) neighborhood of $P_0$ ($P_1$), and not just in $P_0$ ($P_1$), does not affect the argument), the minimum over $P_Y$ of the maximum between these quantities (right-hand side of Equation (29)) is attained when ${\tilde{\mathcal{D}}}_{{\Delta }_1}(P_Y^{*},P_1)={\tilde{\mathcal{D}}}_{{\Delta }_0}(P_Y^{*},P_0)$, for some PMF $P_Y^{*}$. This resembles the best achievable exponent in the Bayesian probability of error for the non-adversarial case, which is attained when $\mathcal{D}(P_Y^{*}\parallel P_0)=\mathcal{D}(P_Y^{*}\parallel P_1)$ for some $P_Y^{*}$ (see [19] (Theorem 11.9.1)). In that case, from the expression of the divergence function, such $P_Y^{*}$ is found in a closed form and the resulting exponent is equivalent to the Chernoff information (see Section 11.9 [19]).

From Theorems 8 and 9, it follows that there is no positive $\lambda$, respectively a, for which the asymptotic exponent of the equilibrium payoff is strictly positive, if there exists a PMF $P_Y$ such that the following conditions are both satisfied:

In this case, then, $P_0$ and $P_1$ are indistinguishable under both the Neyman–Pearson and the Bayesian settings. We observe that the condition ${\tilde{\mathcal{D}}}_{\Delta }(P_Y,P_X)=0$ is equivalent to the following: where the expectation $E_{XY}$ is with respect to $Q_{XY}$. For ease of notation, in Equation (31), we used ${(Q_{XY})}_Y=P_Y$ (respectively ${(Q_{XY})}_X=P_X$) as short for ${\sum }_x{Q}_{XY}(x,y)=P_Y(y)$, $\forall y\in \mathcal{A}$ (respectively ${\sum }_y{Q}_{XY}(x,y)=P_X(x)$, $\forall x\in \mathcal{A}$), where $Q_{XY}$ is a joint PMF and $P_X$ and $P_Y$ are its marginal PMFs.

In computer vision applications, the left-hand side of Equation (31) is known as the Earth Mover Distance (EMD) between $P_X$ and $P_Y$, which is denoted by ${EMD}_d(P_X,P_Y)$ (or, by symmetry, ${EMD}_d(P_Y,P_X)$) [32]. It is also known as the $\rho$-bar distortion measure [33].

A brief comment concerning the analogy between the minimization in Equation (31) and optimal transport theory is worth expounding. The minimization problem in Equation (31) is known in the Operations Research literature as Hitchcock Transportation Problem (TP) [34]. Referring to the original Monge formulation of this problem [35], $P_X$ and $P_Y$ can be interpreted as two different ways of piling up a certain amount of soil; then, $P_{XY}(x,y)$ denotes the quantity of soil shipped from location (source) x in $P_X$ to location (sink) y in $P_Y$ and $d(x,y)$ is the cost for shipping a unitary amount of soil from x to y. In transport theory terminology, $P_{XY}$ is referred to as transportation map. According to this perspective, evaluating the EMD corresponds to finding the minimal transportation cost of moving a pile of soil into the other. Further insights on this parallel can be found in [31].

We summarize our findings in the following corollary, which characterizes the conditions for distinguishability under both the Neyman–Pearson and the Bayesian setting.

Set $\Gamma$ is the indistinguishability region. By definition (see the beginning of this section), the PMFs inside $\Gamma$ are those for which, as a consequence of the attack, the FP and FN probabilities cannot go to zero simultaneously with strictly positive exponents. Clearly, if ${\Delta }_0={\Delta }_1=0$, that is, in the non-adversarial case, $\Gamma =\left\{P_0\right\}$, as any two distinct sources are always distinguishable.

When d is a metric, for a given $P\in \Gamma$, the computation of the optimal $P_Y$ can be traced back to the computation of the EMD between $P_0$ and P, as stated by the following corollary, whose proof appears in Appendix C.2.

According to Corollary 2, when d is a metric, the performance of the game depends only on the sum of distortions, ${\Delta }_0+{\Delta }_1$, and it is immaterial how this amount is distributed between the two hypotheses.

In the general case (d not a metric), the condition on the EMD stated in Equation (34) is sufficient in order for $P_0$ and P be indistinguishable, that is $\Gamma \supseteq \{P:{EMD}_d(P_0,P)\le {\Delta }_0+{\Delta }_1\}$ (see discussion in Appendix C.2, at the end of the proof of Corollary 2).

Furthermore, in the case of an $L_p^p$ distortion function ($p\ge 1$), i.e., $d(\mathit{x},\mathit{y})={\sum }_{i=1}^n{|x_i-y_i|}^p$, we have the following corollary.

Corollary 3 can be proven by exploiting the Hölder inequality [36] (see Appendix C.3).

We consider the problem of binary hypothesis testing when an attacker is active under both hypotheses, and then an attack is carried out aiming at both false negative and false positive errors. By modeling the defender–attacker interaction as a game, we defined and solved two different detection games: the Neyman–Pearson and the Bayesian game. This paper extends the analysis in [11], where the attacker is active under the alternative hypothesis only. Another aspect of greater generality is that here both players are allowed to use randomized strategies. By relying on the method of types, the main result of this paper is the existence of an attack strategy, which is both dominant and universal, that is, optimal regardless of the statistics of the sources. The optimal attack strategy is also independent of the underlying hypothesis, namely fully-universal, when the distortion introduced by the attacker in the two cases is the same. From the analysis of the asymptotic behavior of the equilibrium payoff, we are able to establish conditions under which the sources can be reliably distinguished in the fully active adversarial setup. The theory developed permits to assess the security of the detection in adversarial setting and give insights on how the detector should be designed in such a way to make the attack hard.

Among the possible directions for future work, we mention the extension to continuous alphabets, which calls for an extension of the method of types to this case, or to more realistic models of finite alphabet sources, still amenable to analysis, such as Markov sources. As mentioned in the Introduction, it would be also relevant to extend the analysis to higher order statistics. In fact, the techniques introduced in this paper are very general and lend themselves to extensions that allow richer sets of sufficient statistics (as currently pursued in an ongoing work of the first two coauthors). This generalization, however, comes at the price of an increased complexity of the analysis with regard to both the expressions of the equilibrium strategies and the performance achieved by the two parties at the equilibrium. More specifically, given the set of statistics used by the defender, it turns out that the optimal attacker also uses the very same statistics (plus the empirical correlation with the source sequence, due to the distortion constraint) and the optimal attack channel is given in terms of uniform distributions across conditional types that depend on these set of statistics. Therefore, in a sequence of games, where the defender exploits more and more statistics, so would the attacker, and it would be interesting to explore the limiting behaviour of this process.

We also mention the case of unknown sources, where the source statistics are estimated from training data, possibly corrupted by the attacker. In this scenario, the detection game has been studied for a partially active case, with both uncorrupted and corrupted training data [13,14]. The extension of such analyses to the fully active scenario represents a further interesting direction for future research.

Finally, we stress that, in this paper, as well as in virtually all prior works using game theory to model the interplay between the attacker and the defender, it is assumed that the attacker is always present. This is a pessimistic or worst-case assumption, leading to the adoption of an overly conservative defense strategy (when the attacker is not present, in fact, better performance could be in principle achieved by adopting a non-adversarial detection strategy). A more far-reaching extension would require that the ubiquitous presence of the attacker is reconsidered, for instance by resorting to a two-steps analysis, where the presence or absence of the attacker is established in the first step, or by defining and studying more complex game models, e.g., games with incomplete information [37].