text: With the increasing connectivity enabled by the Internet of Things (IoT), security becomes a critical concern, and users should invest to secure their IoT applications. Due to the massive devices in the IoT network, users cannot be aware of the security policies taken by all its connected neighbors. Instead, a user makes security decisions based on the cyber risks that he perceives by observing a selected number of nodes. To this end, we propose a model which incorporates the limited attention or bounded rationality nature of players in the IoT. Specifically, each individual builds a sparse cognitive network of nodes to respond to. Based on this simplified cognitive network representation, each user then determines his security management policy by minimizing his own real-world security cost. The bounded rational decision-makings of players and their cognitive network formations are interdependent and thus should be addressed in a holistic manner. We establish a games-in-games framework and propose a Gestalt Nash equilibrium (GNE) solution concept to characterize the decisions of agents and quantify their risk of bounded perception due to the limited attention. In addition, we design a proximal-based iterative algorithm to compute the GNE. With case studies of smart communities, the designed algorithm can successfully identify the critical users whose decisions need to be taken into account by the other users during the security management.
  @cite_36: In a complex and uncertain world, humans and animals make decisions under the constraints of limited knowledge, resources, and time. Yet models of rational decision making in economics, cognitive science, biology, and other fields largely ignore these real constraints and instead assume agents with perfect information and unlimited time. About forty years ago, Herbert Simon challenged this view with his notion of "bounded rationality." Today, bounded rationality has become a fashionable term used for disparate views of reasoning. This book promotes bounded rationality as the key to understanding how real people make decisions. Using the concept of an "adaptive toolbox," a repertoire of fast and frugal rules for decision making under uncertainty, it attempts to impose more order and coherence on the idea of bounded rationality. The contributors view bounded rationality neither as optimization under constraints nor as the study of people's reasoning fallacies. The strategies in the adaptive toolbox dispense with optimization and, for the most part, with calculations of probabilities and utilities. The book extends the concept of bounded rationality from cognitive tools to emotions; it analyzes social norms, imitation, and other cultural tools as rational strategies; and it shows how smart heuristics can exploit the structure of environments.
  @cite_19: This paper models an agent who has a limited capacity to pay attention to information and thus conditions her actions on a coarsening of the available information. An optimally inattentive agent chooses both her coarsening and her actions by maximization of an underlying subjective expected utility preference relation, net of a cognitive cost of attention. The main result axiomatically characterizes the conditional choices of actions by an agent that are necessary and sufficient for her behavior to be seen as if it is the result of optimal inattention. Observing these choices permits unique identification of the agent's utility index, the information to which she pays attention, her attention cost and her prior whenever information is costly.
  @cite_5: With the increasing connectivity enabled by the Internet of Things (IoT), security becomes a critical concern, and the users should invest to secure their IoT applications. Due to the massive devices in the IoT network, users cannot be aware of the security policies taken by all its connected neighbors. Instead, a user makes security decisions based on the cyber risks he perceives by observing a selected number of nodes. To this end, we propose a model which incorporates the limited attention or bounded rationality nature of players in the IoT. Specifically, each individual builds a sparse cognitive network which includes the users to respond to. Based on this simplified cognitive network representation, each user then determines his security investment policy by minimizing his own real-world security cost. The bounded rational decision-makings of players and their cognitive network formations are interdependent, and thus should be addressed in a holistic manner. We propose a Gestalt Nash equilibrium (GNE) solution concept to characterize the decisions of agents. Then, we design a proximal-based iterative algorithm to compute the GNE and show its convergence. With case studies to smart home communities, the designed algorithm can successfully identify the critical users whose decisions need to be taken into account by the other users during the security investment.
  @cite_13: This paper defines and analyzes a "sparse max" operator, which is a less than fully attentive and rational version of the traditional max operator. The agent builds (as economists do) a simplified model of the world which is sparse, considering only the variables of first-order importance. His stylized model and his resulting choices both derive from constrained optimization. Still, the sparse max remains tractable to compute. Moreover, the induced outcomes reflect basic psychological forces governing limited attention. The sparse max yields a behavioral version of two basic chapters of the microeconomics textbook: consumer demand and competitive equilibrium. We obtain a behavioral version of Marshallian and Hicksian demand, the Slutsky matrix, the Edgeworth box, Roy's identity etc. The Slutsky matrix is no longer symmetric: non-salient prices are associated with anomalously small demand elasticities. Because the consumer exhibits nominal illusion, in the Edgeworth box, the offer curve is a two-dimensional surface rather than a one-dimensional curve. As a result, different aggregate price levels correspond to materially distinct competitive equilibria, in a similar spirit to a Phillips curve. This framework provides a way to assess which parts of basic microeconomics are robust, and which are not, to the assumption of perfect maximization.
summary: Humans with limited knowledge or cognitive resources are bounded rational, since they cannot pay attention to all the information @cite_36 @cite_19 . Gabaix has proposed a sparse max'' operator to model the limited attention of players in which each agent builds a simplified model of the network based on an @math norm @cite_13 . Built upon @cite_5 which includes some preliminary results, our work leverages on the established sparse max'' operator and formulates a constrained game program to capture the bounded cognition ability of players in the IoT. In addition, we further consider the risk management of each user based on their underperceived cyber risks over the network.