Definition 1: Static game, refers to the simultaneous choice of actions by participants. Or even though the participants take action in sequence, the person who takes action later does not know what kind of actions the person who takes action first takes.

Definition 2: Bayesian Game (G (T) or G (∞, δ)): It means that at least one participant cannot determine the income function of another participant, as the income function is not common knowledge among all participants.

The strategic formulation of n-person static Bayesian game includes: type space of participants {Θ₁,…,Θ_n} conditional probability {p₁,…, p_n}, type dependency strategy space {A₁(θ₁), …, A_n(θ_n)} and type dependent payment function u₁ (a₁,…,a_n; θ₁),…, u_N (a₁,…,a_n; θ_n).

Participant i knows its own type θ_i∈Θ_i, and conditional probability p_i = p_i (θ_−i|θ_i) describes, given that it belongs to θ_i, the uncertainty of participant i about other participating human type θ_−i∈Θ_−i. We use G = {A₁,…, A_n;θ₁,…,θ_n;p₁,…,p_n;u₁,…,u_n}, representing the game.

Definition 3: Bayesian Equilibrium: The pure strategic Bayesian Nash equilibrium of n humans static game with incomplete information G = {A₁,…,A_n;θ₁,…,θ_n;p₁,…,p_n;u₁,…,u_n} is a type-dependent strategic combination {a_i^*(θ_i)}, i = 1,…,n, where each participant i chooses action a_i^*(θ_i) to maximize his expected utility function_i given his own type θ_i and other participating human-type dependency strategies {a_−i*(θ_−i)}.

Namely:maxai∗∈Aiui{a1∗,⋯,ai−1∗,ai∗,ai+1∗,⋯,an∗,θi}.

Definition 4: The principles of statistical groupings are as follows. [37]

The principle of consistency. In a grouping, once the grouping criteria are selected, the meaning cannot be changed. However, in a composite grouping, the grouping criteria at different levels should be different. But in the same level of grouping, the grouping criteria should be consistent. Therefore, the consistency principle of grouping should be called the consistency principle of grouping standard.

The principle of proportionality. After grouping, the total number of elements contained in each group, in this sense, should be exactly equal to the sum of its groups, also known as completeness.

The principle of mutual exclusion. This principle is also called the principle of incompatibility or the principle of difference. In general, the relationship between groups at the same level should be a mutually exclusive relationship between two groups, that is to say, there should be no general public unit in any two groups.

The principle of hierarchy. It means that the statistical grouping should be hierarchical, and the phenomenon of over-grading should not be allowed. Therefore, the hierarchical principle of grouping can also be called the hierarchical principle or the orderly principle.

The algorithm of sensitive information protection model based on Bayesian game is given in Fig. 1. And the Fig. 2 shows framework of sensitive information protection model.

Aiming at keeping the balance between information protection and quality of service in sensitive information protection, this paper explores the user’s information protection intensity and data accuracy requirements, and quantifies the user’s needs, by which the sensitive level of information is determined.

(1) Protection strength of user input and query accuracy.

Suppose N is the highest level of protection strength and data accuracy. PS_i(PS_i∈[1,N], and PS_i∈Z) is the protection strength required by the user, and DA_i (DA_i∈[1,N], and DA_i∈Z) is the data accuracy required by the user, the weight coefficient of data accuracy is k (k∈ [0,1]), and the user' s sensitive information is i (i∈[1,n], and i∈Z).

(2) According to the basic principles of consistency, proportionality, mutual exclusion and hierarchy of statistical grouping, the judgment rules are obtained by using the protection intensity and data accuracy [10].

(1) The two parameters are negatively correlated, which means that the accuracy decreases while the protection intensity increases.

(2) When the requirements of protection intensity and the data accuracy intensity are low, reducing protection intensity and sensitivity level, and improving data accuracy should be given priority in order to achieve Pareto optimum as far as possible.

(3) When there is a contradiction between the requirements of protection intensity and accurate data intensity, it is necessary to integrate the two requirements to meet the higher requirement of the preference.

(3) The protection strength and the accurate data strength are fused into sensitive level parameters SIi(PSi,DAi), and the sensitive level parameters are obtained.

(1)SIi(PSi,DAi)=PSi−k∗DAiPSi+DAi

The data of SI_i (PS_i, DA_i) will be scaled up and standardized to the range of [0,1] by deviation standardization method to facilitate the division of sensitive levels and obtain standard sensitive levels.

(2)SSIi(i,SIi(PSi,DAi))=SIi(PSi,DAi)−(SIj(PSj,DAj))min(SIj(PSj,DAj))max−(SIj(PSj,DAj))min

In this paper, we provide users with personalized sensitive information protection based on static Bayesian game according to the user’s demand for sensitive level of data, which affects the choice of game strategy in game model.

Definition 5: The game model of sensitive information protection is a quintuple: [I, T_A, P, U, S]. (1)

I is a set of players participating in the game. Whatever the strategic choices made by any player, other players will choose a certain strategy. Each player’s equilibrium strategy is to achieve the maximum expected return, and the combination constitutes their own dominant strategy. In order to simplify the calculation, the players are sensitive information protection service provider P and attacker A, i.e., I = {SP, A}.

The static Bayesian game is constructed according to the user’s sensitive level requirement, the attacker’s type space T_A and the attacker’s type probability distribution P. The game tree is given by Harsanyi transformation, and the utility functions of both sides of the game are analyzed. Fig. 3 shows game tree between service providers and attackers after Harsanyi Conversion. Tab. 2 shows income matrix of Service Provide (SP) and Attacker (A). Figure 3 Table 2

a_i, c_i, e_i, g_i (i∈{1,2,3,4}) are the profit functions of the attackers in the corresponding game situation.

b_i, d_i, f_i, h_i, w_i (i∈{1,2,3,4}) are the revenue functions of service providers in the corresponding game situations.

(1) {(ON_j, (E, H)), (ON_j, (E, N))} (j∈ {I, II, III, IV})represents the benefits of both sides of the game when an efficient attacker chooses either malicious attack or general goodwill access while the service provider chooses to provide the service. However, when the attacker chooses a lower attack strategy than a higher one under the same service level strategy, the loss of profit is lower. Therefore, the attacker chooses a lower attack strategy than a higher one, and it can be obtained: b₁ ≧ b₂ ≧ b₃ ≧ b₄, d₁ ≧ d₂ ≧ d₃ ≧ d₄.

(2) {(ON_j, (UE,H)), (ON_j, (UE,N))} (j∈ {I, II, III, IV}) represents the benefits of both sides of the game when the service provider chooses to provide the service, while the inefficient attacker chooses either malicious attack or general goodwill access. The same as (1) can be obtained: f₁ ≧ f₂ ≧ f₃ ≧ f₄, h₁ ≧ h₂ ≧ h₃ ≧ h₄.

(3) {(OFF, (E, H)), (OFF, (E, N))} denotes the benefits of both sides of the game when an efficient attacker chooses either malicious attack or general goodwill access, while the service provider chooses not to provide the service.

(4) {(OFF, (UE, H)), (OFF, (UE, N))} denotes the benefits of both sides of the game when the service provider chooses not to provide the service, while the inefficient attacker chooses either malicious attacks or a group of good-faith visits.

The existence theorem of mixed strategy Bayesian Nash equilibrium is a direct extension of the existence theorem of Nash equilibrium. In the paper the game scenario of sensitive information protection model can be judged as a limited game based on Bayesian game because the attacker type set TA, conditional probability p, action set SSP and SA, revenue function USP and UA are all limited in this model. At the same time, according to Nash’s relevant proof, there is a Bayesian Nash equilibrium of pure strategy or mixed strategy in all finite games, and the Bayesian Nash equilibrium of pure strategy is a special case of Bayesian Nash equilibrium of mixed strategy. Thus, there is a Bayesian Nash equilibrium of mixed strategy in this game model.

According to the benefit matrix of the game, the mixed Bayesian equilibrium of the participants is calculated.

Assuming in the game, the attacker is the corresponding probability distribution (p, 1 − p) of high-efficiency and low-efficiency. Moreover, the common knowledge of the participants in the Bayesian game, i.e., p, (1 − p) is a parameter known to both sides of the game. The probability distribution of the two strategies of service providers in the game is (q, 1 − q), indicating the service providers’ preference to use and withdraw. The probability of providing corresponding sensitive level services is q, while the probability of using closed corresponding sensitive level services is 1 − q. The probability distribution of attackers choosing malicious attack and general goodwill access strategies is (r, 1 − r). That is, the probability of attackers preferring malicious attack (H) is r, while the probability of using general access (N) is 1 − r.

(1) The expected return of the attacker

When an attacker chooses a malicious attack, the expected benefits of the attacker are as follows.

(3)EA(H)=p(qbi+(1−q)w1)+(1−p)(qfi+(1−q)w3)

When an attacker chooses a general goodwill visit, the expected benefits of the attacker are as follows.

(4)EA(N)=p(qdi+(1−q)w2)+(1−p)(qhi+(1−q)w4)

If the policy combination is the best choice for service providers, then E_A(H) = E_SP(N), that is as follows.

(5)p(qbi+(1−q)w1)+(1−p)(qfi+(1−q)w3)=p(qdi+(1−q)w2)+(1−p)(qhi+(1−q)w4)

Calculations are available as follows.

(6)qi=p(w2−w1)+(1−p)(w4−w3)p(bi−di+w2−w1)+(1−p)(fi−hi+w4−w3)

(2) Expected revenue of service providers

When choosing to provide services, the expected benefits of service providers are as follows.

(7)ESP(ONi)=p(rai+(1−r)ci)+(1−p)(rei+(1−r)gi)

When choosing not to provide services, the expected benefits of service providers are as follows.

(8)ESP(OFF)=0

If the policy combination is the best choice for service providers, E_SP(ON_i) = E_SP(OFF), that is as follows.

(9)p(rai+(1−r)ci)+(1−p)(rei+(1−r)gi)=0

Calculations are available as follows.

(10)ri=−pci−(1−p)gip(ai−ci)+(1−p)(ei−gi)

In summary, when service providers provide level-i standard-sensitive services, the mixed Bayesian equilibrium results between service providers and attackers are as follows.

(11){qi=p(w2−w1)+(1−p)(w4−w3)p(bi−di+w2−w1)+(1−p)(fi−hi+w4−w3)ri=−pci−(1−p)gip(ai−ci)+(1−p)(ei−gi)

In a sense, Nash equilibrium is a fixed point. In the process of service providers providing services based on users’ needs for information protection and data accuracy, and playing games with attackers, both sides are striving for maximum benefits for their own sake. After calculating the Bayesian equilibrium by utilizing the utility matrix of both sides, the distribution probability of two kinds of service providers, high-efficiency and low-efficiency, can be obtained in the game. Based on the calculation of game theory and the monotonicity of information entropy, this paper introduces information entropy into game theory to solve the measurement problem of sensitive information leakage in the process of service providers’ service measurement [13].

Formulas for calculating information entropy are follows.

(12)H(X)=−C∑x∈χp(x)logp(x)

Among them, C is a constant and normalized to 1.

In this paper, i is the information sensitive level, q is the probability of providing services for service providers, and 1 − q is the probability of not providing services for service providers to express the sensitive information disclosure entropy.

(13)H=−qilog⁡qi−(1−qi)log⁡(1−qi)

And in (13) we set H = 0 when qi = 0.