Audrey Putoux

Soumaya Mougou-Zerelli

Sophie Thomas

Nadia Elkhartoufi

Sophie Audollent

Martine Le Merrer

Augusta Lachmeijer

Sabine Sigaudy

Annie Buenerd

Carla Fernandez

Anne-Lise Delezoide

Marie- Claire Gubler

Rémi Salomon

Ali Saad

Marie-Pierre Cordier

Michel Vekemans

Raymonde Bouvier

Tania Attie-Bitach

BBS10 mutations are frequent in

Keywords: Bardet-Biedl syndrome, cystic kidney, BBS10, ciliopathy

teaching and research institutions in France or abroad, or from public or private research centers.

INTRODUCTION

Congenital anomalies of the kidney and urinary tract (CAKUT) in association with nonrenal anomalies are found in more than 200 syndromes. CAKUT represent a broad range of disorders that result from abnormal embryogenic renal development due to parenchymal malformations, abnormalities in migration of organ primordia, or abnormalities in the developing collecting system. Malformations of the renal parenchyme lead to failure of normal nephron development in terms of renal dysplasia, renal agenesis, renal tubular dysgenesis, and polycystic renal diseases. Cystic kidneys can be detected on prenatal ultrasonography, particularly during the second trimester, and can cause fetal death in utero by oligohydramnios or associated anomalies. This feature, visible on ultrasound, can appear isolated, as in polycystic kidney disease, or associated with multiple congenital anomalies. Accurate diagnosis in antenatal cases is important to evaluate prognosis, and to propose adequate management of the pregnancy and genetic counselling. [START_REF] Deshpande | Genetic syndromes and prenatally detected renal anomalies[END_REF] Bardet-Biedl syndrome (BBS, OMIM 209900), initially described by Bardet in 1920 and Biedl in 1922, is an autosomal recessive multisystemic disorder characterized by progressive retinal dystrophy, postaxial polydactyly, obesity, hypogenitalism, learning difficulties and renal abnormalities. In addition to the major diagnostic features, multiple other manifestations have also been documented. [START_REF] Rooryck | Bardet-Biedl syndrome[END_REF][START_REF] Beales | New criteria for improved diagnosis of Bardet-Biedl syndrome: results of a population survey[END_REF] These include diabetes mellitus, neurological signs, behavioural traits, facial dysmorphism, dental anomalies, heart disease, and hepatic fibrosis. [START_REF] Beales | New criteria for improved diagnosis of Bardet-Biedl syndrome: results of a population survey[END_REF] Prevalence rates in North America and Europe range from 1:125,000 to 1:175,000 live births. [START_REF] Rooryck | Bardet-Biedl syndrome[END_REF] Because of the late onset of symptoms, the diagnosis of BBS is usually made during childhood and certainly underdiagnosed antenatally. At birth, suggestive features are polydactyly, renal abnormalities, genital or heart malformations. However, it has been shown that a severe clinical presentation of BBS including lethal cystic kidneys disease can mimic Meckel Syndrome (MKS, OMIM 249000). [START_REF] Karmous-Benailly | Antenatal presentation of Bardet-Biedl syndrome may mimic Meckel syndrome[END_REF] Fourteen BBS genes have been identified to date (BBS1-BBS14). Two of these genes, MKS1 (BBS13) and CEP290 (BBS14) are usually involved in Meckel Syndrome and Joubert Syndrome, and may have a potential epistatic effect with known BBS-associated loci. [START_REF] Leitch | Hypomorphic mutations in syndromic encephalocele genes are associated with Bardet-Biedl syndrome[END_REF] BBS genes encode proteins involved in the development and function of primary cilia. [START_REF] Ansley | Basal body dysfunction is a likely cause of pleiotropic Bardet-Biedl syndrome[END_REF] BBS therefore became a model to help understand of ciliary signalling mechanisms. [START_REF] Zaghloul | Mechanistic insights into Bardet-Biedl syndrome, a model ciliopathy[END_REF] This discovery of other disorders caused by similar ciliary structural and signalling defects supported the concept of "ciliopathies" [START_REF] Badano | Heterozygous mutations in BBS1, BBS2 and BBS6 have a potential epistatic effect on Bardet-Biedl patients with two mutations at a second BBS locus[END_REF] , inherited diseases resulting from ciliary dysfunction. [START_REF] Fliegauf | When cilia go bad: cilia defects and ciliopathies[END_REF] Ciliopathies comprise phenotypically overlapping disorders [START_REF] Quinlan | Modeling ciliopathies: Primary cilia in development and disease[END_REF] with renal malformations (renal dysplasia and cystic kidney disease) being one of the more common unifying features [START_REF] Adams | Recent advances in the molecular pathology, cell biology and genetics of ciliopathies[END_REF][START_REF] Johnson | Molecular pathology and genetics of congenital hepatorenal fibrocystic syndromes[END_REF] and a variable degree of polydactyly, obesity, hypogonadism, central nervous anomalies, retinitis pigmentosa and laterality defects.

Mutations in one of the 14 known BBS genes are found in approximately 80% of BBS cases. [START_REF] Zaghloul | Mechanistic insights into Bardet-Biedl syndrome, a model ciliopathy[END_REF] In addition, a complex digenic inheritance has been established in some families, where three mutations at two BBS loci are necessary for the expression of the disease. [START_REF] Badano | Heterozygous mutations in BBS1, BBS2 and BBS6 have a potential epistatic effect on Bardet-Biedl patients with two mutations at a second BBS locus[END_REF][START_REF] Beales | Genetic interaction of BBS1 mutations with alleles at other BBS loci can result in non-Mendelian Bardet-Biedl syndrome[END_REF][START_REF] Katsanis | The oligogenic properties of Bardet-Biedl syndrome[END_REF][START_REF] Katsanis | Triallelic inheritance in Bardet-Biedl syndrome, a Mendelian recessive disorder[END_REF] . The BBS10 gene, also called FLJ23560, identified in 2006 by Stoetzel et al., accounts for 21% of BBS cases. [START_REF] Stoetzel | BBS10 encodes a vertebrate-specific chaperonin-like protein and is a major BBS locus[END_REF] BBS10 encodes a vertebrate-specific chaperonin-like protein which interacts with bbs1, 4 and 6 in zebrafish [START_REF] Stoetzel | BBS10 encodes a vertebrate-specific chaperonin-like protein and is a major BBS locus[END_REF] and is localised at the basal body of the primary cilium. [START_REF] Marion | Transient ciliogenesis involving Bardet-Biedl syndrome proteins is a fundamental characteristic of adipogenic differentiation[END_REF] Recent studies have demonstrated the role for the three chaperonin-like BBS proteins (BBS10 with BBS6 and BBS12) in forming a complex of CCT/TRiC family chaperonins which then mediates BBSome assembly, a structure which transports vesicles within the cilium. [START_REF] Seo | BBS6, BBS10, and BBS12 form a complex with CCT/TRiC family chaperonins and mediate BBSome assembly[END_REF] Given the phenotypic overlap of ciliopathies, the fact that mutations in BBS genes have already been found in Meckel-like fetuses, and the major contribution of BBS10 to BBS, we screened for mutations in BBS10 in 20 fetuses and a child referred for cystic kidneys, polydactyly and/or a central nervous system anomaly but without the encephalocele or biliary dysgenesis characteristic of Meckel syndrome.

We analysed the BBS10 gene in 20 cases with cystic kidneys diagnosed antenatally and polydactyly, but without occipital encephalocele or biliary dysgenesis. Parental consents for the genetic study were obtained in all cases. In all but one, pregnancy was terminated in accordance with French legislation either because of the severe renal dysfunction (oligohydramnios) or because of its association with another anomaly. Chromosome analysis and clinicopathological examination were performed in all cases except case one, where parents declined pregnancy termination after genetic counselling. Clinical and histological features of mutated cases are summarized in Table 1.

Genomic DNA was extracted from frozen fetal tissues or from a blood sample in case 1, and from parents. Primers used were previously described. [START_REF] Stoetzel | BBS10 encodes a vertebrate-specific chaperonin-like protein and is a major BBS locus[END_REF] All amplifications were performed under the same conditions, using a touchdown protocol consisting of denaturation for 30s at 96°C, annealing for 30s at a temperature ranging from 64°C to 50°C (decreasing 1° during 14 cycles, then 20 cycles at 50°) and extension at 72°C for 30s. PCR products were treated with ExoSAP-IT (USB, Affymetrix). Both strands were sequenced with the appropriate primer and the BigDye terminator cycle sequencing kit (Applied Biosystems, Foster City, CA) and analyzed on ABI3130 automated sequencers (Applied Biosystems, Foster City, CA). Segregation of the identified mutations was investigated in parents when available. Mutation numbering is based on cDNA sequence with a 'c.' symbol before the number, where +1 corresponds to the A of ATG translation codon (codon 1) of the cDNA reference sequences (NM_024685). Mutation names were checked by the Mutalyzer program. [START_REF] Wildeman | Improving sequence variant descriptions in mutation databases and literature using the Mutalyzer sequence variation nomenclature checker[END_REF]

RESULTS

We found BBS10 mutations in five cases, four fetuses and a child. Clinical and mutation data are presented in Table 1. Case 1 is now a twenty year-old young woman, seen antenatally because of the association of enlarged hyperechogenic kidneys and postaxial polydactyly, and described previously (case 7 of Karmous-Benailly). [START_REF] Karmous-Benailly | Antenatal presentation of Bardet-Biedl syndrome may mimic Meckel syndrome[END_REF] After birth, the size of the kidneys decreased to normal while progressive renal failure appeared. Obesity started at 3 years and an electroretinogram examination established the diagnosis of BBS. At 12 years of age, vision was normal. Direct sequencing of the BBS10 gene found a homozygous T insertion in exon 2, at residue 91, leading to premature protein termination (c.271dupT, p.Cys91LeufsX5). Moreover, previous sequencing of BBS1 to BBS8 genes had revealed a heterozygous mutation in exon 3 of the BBS6 gene: p.Arg139X. [START_REF] Karmous-Benailly | Antenatal presentation of Bardet-Biedl syndrome may mimic Meckel syndrome[END_REF] Case 2 was a 23-weeks old female fetus. The pregnancy was terminated because of severe cystic kidneys and anamnios. Autopsy revealed enlarged kidneys with nonetheless normal nephronogenesis, containing multiple thin-walled cysts along nephron segments and collecting ducts, and demonstrating a gradient in the size of cysts from periphery to center,. The parenchyme was otherwise normal, without metaplasic cartilage. The kidneys were therefore histologically similar to those observed in Meckel syndrome, and termed "Meckel-like" kidneys (Fig 1A) Among the 15 other cases in this series, eight had mutations in another BBS gene, namely BBS2 (3 cases), BBS4 (2 cases), BBS6 (2 cases) and BBS7 (1 case), and six of them have been reported previously. [START_REF] Karmous-Benailly | Antenatal presentation of Bardet-Biedl syndrome may mimic Meckel syndrome[END_REF] In addition, two fetuses within this series had agenesis of the cerebellar vermis, and in these, mutations were found in the CEP290 gene (NPHP6/MKS4), where biliary dysgenesis is known to potentially be absent. These two cases have also been described previously (cases 27 and 29). [START_REF] Baala | Pleiotropic effects of CEP290 (NPHP6) mutations extend to Meckel syndrome[END_REF] In the five remaining cases, all with similar Meckel-like kidney histology, polydactyly, but without biliary dysgenesis or brain malformations, no BBS gene mutations have been identified thus far.

DISCUSSION

Genetic screening in the cohort

The most characteristic diagnostic criteria for BBS, such as obesity and retinal anomalies, appear postnatally. Only the renal abnormalities, congenital heart defect, genital anomalies and polydactyly can be detected antenatally. In particular, enlarged and undifferentiated hyperechogenic kidneys on prenatal ultrasonography may suggest the diagnosis of BBS. [START_REF] Cassart | Antenatal renal sonographic anomalies and postnatal follow-up of renal involvement in Bardet-Biedl syndrome[END_REF] A previous study showed that renal histological anomalies in BBS fetuses can be very comparable to those observed in Meckel Syndrome. [START_REF] Karmous-Benailly | Antenatal presentation of Bardet-Biedl syndrome may mimic Meckel syndrome[END_REF] However, liver histological anomalies included hepatic fibrosis but not biliary dysgenesis. Based on our previous analysis of BBS genes in antenatal cases, and the major contribution of BBS10 to BBS, we focused on a series of cases with cystic kidneys and polydactyly but no biliary dysgenesis to evaluate the contribution of BBS10 to this association. BBS10 mutations were found in 5/20 cases, demonstrating that BBS10 mutations are also observed in the lethal form of the disorder and that the c.271dupT, p.Cys91Leufs*5 mutation is a major contributor to the fetal form as well. Overall, 13/20 fetuses carried BBS gene mutations, further highlighting the recognized clinical variability that characterizes Bardet-Biedl syndrome (BBS). This frequency confirms that BBS can present as a perinatal, even lethal form, and suggests that the combination of renal malformation and polydactyly alone can be highly predictive of BBS.

BBS10 mutated alleles and oligogenism

The same c.271dupT, p.Cys91Leufs*5 was found at the homozygous state in two non consanguineous and unrelated cases (cases 1 and 2), and represented 6/10 of the mutated alleles in our series. This is in accordance with the previous reports, where missense and truncating BBS10 mutations have been found in 21% of BBS patients, the p.Cys91Leufs*5 change accounting for 46% of the mutant alleles in the report of Stoetzel. [START_REF] Stoetzel | BBS10 encodes a vertebrate-specific chaperonin-like protein and is a major BBS locus[END_REF] This recurrent mutation is therefore the cause of the major contribution of BBS10 to the disease. Whether this mutation represents an ancient allele or a mutational hotspot has been debated, but the second hypothesis is favoured because of its identification in populations of various origins. Interestingly, unrelated cases 3 and 4 were compound heterozygous for BBS10 mutations, both carrying the same c.1044_1045delTT, p.Pro350Ilefs*11 mutation. This mutation has also been reported twice by Stoetzel et al. among the 118 BBS10-mutated alleles in their series. [START_REF] Stoetzel | BBS10 encodes a vertebrate-specific chaperonin-like protein and is a major BBS locus[END_REF] In case 1, in addition to the homozygous BBS10 mutation, a heterozygous nonsense BBS6 mutation was observed, in accordance with the suggested oligogenic inheritance of BBS. Indeed, in some families, three mutations at two loci are necessary to cause this disease. [START_REF] Beales | Genetic interaction of BBS1 mutations with alleles at other BBS loci can result in non-Mendelian Bardet-Biedl syndrome[END_REF][START_REF] Katsanis | The oligogenic properties of Bardet-Biedl syndrome[END_REF] Such observations provide a clue to the clinical variability of BBS [START_REF] Badano | Heterozygous mutations in BBS1, BBS2 and BBS6 have a potential epistatic effect on Bardet-Biedl patients with two mutations at a second BBS locus[END_REF][START_REF] Beales | Genetic interaction of BBS1 mutations with alleles at other BBS loci can result in non-Mendelian Bardet-Biedl syndrome[END_REF] , since in some families, two mutations at one locus have been sufficient to cause BBS, but a third mutation at another locus has been found in a more severely affected sib. [START_REF] Badano | Heterozygous mutations in BBS1, BBS2 and BBS6 have a potential epistatic effect on Bardet-Biedl patients with two mutations at a second BBS locus[END_REF][START_REF] Beales | Genetic interaction of BBS1 mutations with alleles at other BBS loci can result in non-Mendelian Bardet-Biedl syndrome[END_REF] Moreover, a single gene can have either a causal or a modifying role in the disease. [START_REF] Katsanis | The oligogenic properties of Bardet-Biedl syndrome[END_REF] The ability of each BBS locus to modify the phenotypic expression of mutations in another BBS gene first suggested they are part of a same multiproteic complex, which has been demonstrated since by the identification of at least seven BBS proteins within a complex known as the BBSome, involved in ciliary protein trafficking [START_REF] Nachury | A core complex of BBS proteins cooperates with the GTPase Rab8 to promote ciliary membrane biogenesis[END_REF] Moreover, BBS6, BBS10, and BBS12 form a complex and are involved in BBSome assembly. [START_REF] Seo | BBS6, BBS10, and BBS12 form a complex with CCT/TRiC family chaperonins and mediate BBSome assembly[END_REF] The complex inheritance is relevant in light of genetic counselling and the explanation of variable expressivity. BBS6 is more often associated with oligogenic inheritance than the other BBS genes, as heterozygous mutations are the most frequent. 8

BBS10 phenotype

The clinical presentation of these five cases is consistent with previously described antenatal cases of BBS. In particular, no brain anomalies were found. One of our cases, Case 4, presented other features, namely situs ambiguous with polysplenia, pancreatic hypoplasia (absence of the tail) and pulmonary artery stenosis.

Other studies of BBS have described less frequent clinical signs, including laterality defects such as situs inversus in a few cases [START_REF] Deffert | Recurrent insertional polydactyly and situs inversus in a Bardet-Biedl syndrome family[END_REF][START_REF] Lorda-Sanchez | Situs inversus and hirschsprung disease: two uncommon manifestations in Bardet-Biedl syndrome[END_REF] . Ansley described 3 affected siblings with a homozygous 3 bp deletion in the BBS8 gene. [START_REF] Ansley | Basal body dysfunction is a likely cause of pleiotropic Bardet-Biedl syndrome[END_REF] One of the siblings had complete situs inversus, pointing to variable expressivity of this feature. Moreover, Yen et al. demonstrated the implication of BBS genes in lateralization using knockdown zebrafish for the homologues of six human BBS genes, BBS2, 4, 5, 6, 7 and 8. The result is a disruption in Kuppfer's vesicle, a ciliated organ playing a role in lateralization during embryogenesis. [START_REF] Yen | Bardet-Biedl syndrome genes are important in retrograde intracellular trafficking and Kupffer's vesicle cilia function[END_REF] Deffert et al. proposed that situs inversus could be considered to be a minor criterion for BBS. However, this criterion is a rare but non-specific feature of many ciliopathies.

Pleiotropic effect of ciliopathies : common mechanisms

The clinical phenotype of BBS is extremely variable and overlaps with other ciliopathies.

There is also a genetic overlap, as the same gene mutations can be involved in different ciliopathies. [START_REF] Leitch | Hypomorphic mutations in syndromic encephalocele genes are associated with Bardet-Biedl syndrome[END_REF][START_REF] Baala | Pleiotropic effects of CEP290 (NPHP6) mutations extend to Meckel syndrome[END_REF][START_REF] Baala | The Meckel-Gruber syndrome gene, MKS3, is mutated in Joubert syndrome[END_REF][START_REF] Bergmann | Loss of nephrocystin-3 function can cause embryonic lethality, Meckel-Gruber-like syndrome, situs inversus, and renal-hepaticpancreatic dysplasia[END_REF][START_REF] Delous | The ciliary gene RPGRIP1L is mutated in cerebello-oculo-renal syndrome (Joubert syndrome type B) and Meckel syndrome[END_REF] Common features can be explained by common pathways, protein interactions, or multi-subunit complexes. [START_REF] Johnson | Molecular pathology and genetics of congenital hepatorenal fibrocystic syndromes[END_REF][START_REF] Delous | The ciliary gene RPGRIP1L is mutated in cerebello-oculo-renal syndrome (Joubert syndrome type B) and Meckel syndrome[END_REF] Primary cilia are present in numerous cell types and are involved in many cellular functions as cell polarity, chemosensation and mechanosensation, intercellular junctions' formation, cell-cell contacts and interactions with the extracellular environment. [START_REF] Goetz | The primary cilium: a signalling centre during vertebrate development[END_REF] Pleiotropic features of ciliopathies are explained by the interference with signalling pathways necessary for embryonic development of organ primordia. Components of the ciliary signaling machinery that have been identified include ligands and effectors of the Hedgehog 30 , Wnt [START_REF] Gerdes | Ciliary function and Wnt signal modulation[END_REF] , and Platelet-Derived Growth Factor Receptor 32 signaling pathways. Following signal reception, ciliary transduction controls the balance between cellular differentiation, cell division and apoptosis through the regulation of such key developmental pathways. [START_REF] Tobin | Bardet-Biedl syndrome: beyond the cilium[END_REF]

Genotype -phenotype correlations in ciliopathies

While there is a clinical and genetic overlap between ciliopathies, differences in severity can be explained by the nature of the mutation itself, for some genes. For example, Delous et al. showed that while RPGRIP1L missense mutations lead to JBS, truncating mutations lead to MKS. [START_REF] Delous | The ciliary gene RPGRIP1L is mutated in cerebello-oculo-renal syndrome (Joubert syndrome type B) and Meckel syndrome[END_REF][START_REF] Mykytyn | Establishing a connection between cilia and Bardet-Biedl Syndrome[END_REF] A strong genotype-phenotype correlation was also shown for the CC2D2A gene (JBS9, MKS6). [START_REF] Mougou-Zerelli | CC2D2A mutations in Meckel and Joubert syndromes indicate a genotype-phenotype correlation[END_REF] These data suggest that the two phenotypes represent a continuum in the spectrum of a single disorder. Leitch et al. showed that hypomorphic mutations in the MKS1 gene can be associated with BBS, while, to date, only MKS1 truncating mutations have been found in MKS fetuses. [START_REF] Leitch | Hypomorphic mutations in syndromic encephalocele genes are associated with Bardet-Biedl syndrome[END_REF] Other MKS genes may act as modifiers or be directly implied in digenic transmission. [START_REF] Leitch | Hypomorphic mutations in syndromic encephalocele genes are associated with Bardet-Biedl syndrome[END_REF] Therefore, in other instances, when no evident genotype-phenotype correlations are found, clinical variability might be explained by the total mutational load in ciliopathy genes, as suggested by the oligogenic inheritance in Joubert/MKS, nephronophthisis [START_REF] Tory | High NPHP1 and NPHP6 mutation rate in patients with Joubert syndrome and nephronophthisis: potential epistatic effect of NPHP6 and AHI1 mutations in patients with NPHP1 mutations[END_REF] and retinal degeneration of ciliopathies. [START_REF] Khanna | A common allele in RPGRIP1L is a modifier of retinal degeneration in ciliopathies[END_REF]

Conclusion

This study suggests a high frequency of BBS10 mutations in the severe antenatal and lethal form of BBS, a frequency also observed in postnatal cases. Overall, previous analyses of BBS1-8 genes and the new data brought by this study strongly support the conclusion that the association of renal anomalies and polydactyly, without biliary dysgenesis or brain anomalies, can be highly predictive of Bardet Biedl before birth (13/18, 70%). One-fifth of BBS cases still remain unaccounted for by mutations in the 14 loci described to date. Our data support the existence of other, yet unidentified, BBS genes to explain our failure to find mutations in certain suggestive antenatal cases. The identification of BBS genes and the delineation of a fetal phenotype of BBS has improved the molecular diagnosis of lethal cystic kidney disease before birth and allows vastly improved genetic counselling for concerned families.

AKNOWLEDGEMENTS

We are thankful to the SOFFOET (Société Française de Foetopathologie) for patient data and material, and to Heather Etchevers for re-reading the manuscript. This work was supported by grants from ANR (ANR-06-MRAR-034-02). AP was granted a fellowship from the Académie de Médecine, and SZ is supported by INSERM-DGRSRT (CS/RN/2008 n°56 and CS/RN/2008 n°87).

COMPETING INTEREST: none

"The Corresponding Author has the right to grant on behalf of all authors and does grant on behalf of all authors, an exclusive licence (or non exclusive for government employees) on a worldwide basis to the BMJ Publishing Group Ltd to permit this article (if accepted) to be published in Journal of Medical Genetics and any other BMJPGL products and sublicences such use and exploit all subsidiary rights, as set out in our licence (http://group.bmj.com/products/journals/instructions-forauthors/licence-forms)."

  . The fetus had also right hand and foot hexadactyly. No other abnormality was found, in particular no liver anomaly (Fig 1B). Molecular studies found a homozygous frameshift mutation in exon 2 c.271dupT, p.Cys91LeufsX5. Case 3 was a 26-week old female fetus presenting enlarged hyperechogenic kidneys and hexadactyly of all four limbs. Meckel or Bardet-Biedl syndromes were evoked antenatally. After genetic counselling, parents asked for termination of pregnancy. Autopsy showed facial dysmorphism with a round face, hypertelorism, small flattened nose, micro-retrognathism and small ears, characteristic of Potter's dysmorphism. Examination confirmed post-axial hexadactyly and cystic kidneys. Histological examination of the kidneys showed "Meckel-like" cyst size and number augmentation from the cortex to the medulla (Fig 1C). Lesions were moderate with persistence of cortico-medulary differentiation and sub-capsular nephrogenesis. The liver was histologically normal (fig 1D). Direct sequencing of BBS10 found compound heterozygous mutations. The fetus carried a T insertion at residue 91 leading to premature termination c.271dupT, p.Cys91Leufs*5 (fig 1I) inherited from his mother and a 2 base pair deletion paternally inherited: c.1044_1045delTT, p.Pro350Ilefs*11 (fig 1J). Case 4 was a 21-weeks old male fetus. The pregnancy was terminated because of the association of cystic kidneys and situs ambiguus. Examination of this fetus found a facial dysmorphism with retrognatism and hypoplastic nasal bone characteristic of Potter sequence. There were postaxial foot polydactyly, pulmonary artery stenosis, and situs ambiguus where the stomach and spleen were localized on the right side with polysplenia. The pancreas was hypoplasic with absence of the tail. Histological examination of the kidneys showed Meckel-like cyst size and number augmentation from the cortex to the medulla (Fig 1E). Pancreatic ducts were slightly dilated. There were no brain or liver (Fig 1F) anomalies. Direct sequencing of BBS10 found two heterozygous mutations: a missense mutation c.273C>G, p.Cys91Trp (fig 1K) inherited from his mother and a TT deletion in exon 2 c.1044-1045delTT, p.Pro350Ilefs*11. Case 5 was a 22 week female fetus presenting Meckel-like cystic kidneys (fig 1G), lower limb postaxial polydactyly and a Potter sequence with dysmorphism and contracted limbs. The liver was normal (Fig 1H). A previous pregnancy was terminated because of cystic kidneys and hexadactyly 11 years ago. We identified two heterozygous mutations: a maternal missense mutation c.185A>G p.His62Arg located in exon 1 (Fig 1L) and the recurrent c.271dupT, Cys91Leufs*5 inherited from the father.

Figure 1 :

 1 Figure 1: A-H: Histological sections of kidney (A, C, E, G) and liver (B, D, F, H) of four fetuses

Table 1 : Clinical data and BBS10 mutations Case Age Kidney PD Other Nucleotide alterations Exon Predicted effect on protein

 1 Foetal cases: age is given in gestational weeks. PRF: progressive renal failure, MKS-like: cystic kidneys similar to that observed in Meckel syndrome, PD: polydactyly, 4L: 4 limbs, UL: upper limbs, LL: lower limbs, RH: right hand, RF: right foot, LF: left foot, PRD: progressive retinal dystrophy.

	1	20y	PRF	UL,	Obesity	c.271dupT	2	p.Cys91LeufsX5
	CRE			LF	PRD	c.271dupT	2	p.Cys91LeufsX5
						BBS6 mutation:
						p.Arg139X
	2	23w MKS-like RH,		c.271dupT	2	p.Cys91LeufsX5
	LAN			RF		c.271dupT	2	p.Cys91LeufsX5
	3	26w MKS_like 4 L		c.271dupT	2	p.Cys91LeufsX5
	ILL					c.1044-1045delTT	2	p.Pro350IlefsX11
	4	21w MKS_like LL	Situs ambiguus, polysplenia,	c.273C>G	2	p.Cys91Trp
	EIW				pancreas hypoplasia (absence	c.1044-1045delTT	2	p.Pro350IlefsX11
					of the tail), pulmonary artery
					stenosis
	5	22w MKS_like LL		c.185A>G	1	p.His62Arg
	DEC					c.271dupT	2	p.Cys91LeufsX5


Patrick Maillé
email: patrick.maille@telecom-bretagne.eu

Peter Reichl
email: reichl@ftw.at

Bruno Tuffin
email: bruno.tuffin@inria.fr

Interplay Between Security Providers, Consumers, and Attackers: A Weighted Congestion Game Approach

Keywords: K.6 [Management of Computing and Information Systems]: Economics; K.4.4 [Computers and Society]: Electronic Commerce-security Game theory, Weighted games, Security

Network users can choose among different security solutions to protect their data. Those solutions are offered by competing providers, with possibly different performance and price levels. In this paper, we model the interactions among users as a noncooperative game, with a negative externality coming from the fact that attackers target popular systems to maximize their expected gain. Using a nonatomic weighted congestion game model for user interactions, we prove the existence and uniqueness of a user equilibrium, compute the corresponding Price of Anarchy, that is the loss of efficiency due to user selfishness, and investigate some consequences for the (higher-level) pricing game played by security providers.

INTRODUCTION

Within the current evolution towards the Future Internet, the provision of appropriate network security is considered to be one of the most difficult as well as most challenging tasks. Among the broad range of related research approaches, the attempt to better understand the mindset of attackers serves for sure as one of the key sources for developing advanced protection mechanisms. In this context, it is especially interesting to consider attacker preferences from a global operating system perspective. For instance, a recent survey showed that "more than half (52%) of Americans believe that PCs are very or extremely vulnerable to cybercrime attacks ... By contrast, only 20% say Macs are very or extremely vulnerable to attacks" [START_REF] Eset | Securing our e-city -national cybercrime survey[END_REF]. This suggests that among all machines that get compromised year by year, a clear majority are running Windows, and that this asymmetry even remains when considering the relative market shares of all OSs. That situation may be ascribed to several reasons: Firstly, different OSs of course exhibit different relative security performance. Furthermore, the heterogeneity in protection results may come from heterogeneity in average user skills with respect to the various OSs (e.g., Linux or Mac OS vs Windows). Finally, another explanation -that we will focus on in this paper -is directly linked to the market shares of OSs. Indeed, since Linux or Mac users with a market share of 5% or less are still marginal with respect to the 90% market share of Windows 1 , they are simply making a less interesting target for profit-minded attackers.

The latter interpretation of the phenomenon is justified by the fact that cybercrime concerns huge amounts of money, and is highly organized so that attacker efforts are rationalized to maximize the associated gains. That interpretation also raises an interesting negative externality effect of security architectures and systems, through the attractiveness for potential attackers. Indeed, the choice of a particular system and security protection -that we will call a security provider from now on-by the whole online population can now be considered as a congestion game, where congestion is not considered in the common sense of an excessive demand for a finite resource amount, but more generally as a degradation of the performance on a given choice when it gets too popular. Here the performance degradation is indirect, since it stems from the behavior of attackers.

In the specific context of security, the link between the audience of a system and its attractiveness to attackers can be further described when attacks are intended to steal or damage data: an attacker would be attracted by the potential gain (or damage) of the attack, which depends on the value of the users' data, but that value affects (and is therefore, to some extent, revealed by) the security option users choose.

For example, the "safest" solutions may attract users with high-value data to protect, making those solutions an interesting target for an attacker even if their market share is small.

In this paper, we propose a model that encompasses that effect, by considering users with heterogeneous data values making a choice among several security possibilities. The criteria considered in that choice are the security protection level -measured by the likeliness of having one's data stolen or damaged, that is subject to negative externalities-and the price set by the security provider. The negative externalities come from attacker behavior, and are formulated not in terms of the market share of each security solution but rather in terms of potential gain, hence, of total value of the data protected through a given solution. Assuming each individual user has a negligible impact on the protection level, we establish the existence and uniqueness of a user equilibrium by proving that the game admits a strictly convex potential function. The results are then applied to give some insights about the prices that profit-oriented security providers should set.

The paper is organized as follows. Section 2 presents the related work and the specificities taken into account in our model. The model is formally introduced in Section 3. We focus on the user equilibrium existence and uniqueness in Section 4, and give an upper bound on the loss of efficiency due to user selfishness. The consequences on provider pricing decisions are studied in Section 5. We conclude and suggest directions for future work in Section 6.

RELATED WORK

The literature on network security involving game-theoretic models and tools is recent and still not very abundant. Some very interesting works have been published regarding the interactions between attacking and defending entities, where the available strategies can consist in spreading effort over the links of a network [START_REF] Bohacek | Game theoretic stochastic routing for fault tolerance and security in computer networks[END_REF][START_REF] Kodialam | Detecting network intrusions via sampling: A game theoretic approach[END_REF] or over specific targets [START_REF] Cremonini | Understanding and influencing attackers' decisions: Implications for security investment strategies[END_REF], or in selecting some particular attack or defense measures [START_REF] Bistarelli | Strategic games on defense trees[END_REF][START_REF] Ganesh | Efficient quarantining of scanning worms: Optimal detection and co-ordination[END_REF]. In those references, the security game is a zero-sum game between two players only, and therefore no externalities among several potential defenders are considered.

Another stream of work considers security protection investments, through models that encompass positive externalities among users: indeed, when considering epidemic attacks (like, e.g., worms), the likeliness of being infected decreases with the proportion of neighbors that are protected. Since protection has a cost and users selfishly decide to protect or not without considering the externality they generate, the equilibrium outcome is such that investment is suboptimal [START_REF] Jiang | Efficiency of selfish investments in network security[END_REF] and needs to be incentivized through specific measures [START_REF] Lelarge | Network externalities and the deployment of security features and protocols in the Internet[END_REF][START_REF] Lelarge | Economic incentives to increase security in the internet: The case for insurance[END_REF]. For more references on game theory applied to network security contexts, see [START_REF] Alpcan | Network Security: A Decision and Game Theoretic Approach[END_REF][START_REF] Maillé | Of threats and costs: A game-theoretic approach to security risk management[END_REF].

In contrast, the work presented here considers negative externalities in the choices of security software/procedures. As highlighted in the introduction, the negative externality comes from the attractiveness of security solutions for attackers. Such situations can arise when attacks are not epidemic but rather direct, as are attacks targeting randomly chosen IP addresses. The interaction among users can then be modeled as a population game, that is a game where the user payoffs for a given strategy (here, a security solution) change as more users choose that same strategy [START_REF] Fudenberg | Game Theory[END_REF]. Such games are particular cases of so-called congestion games where user strategies are subsets of a given set of resources, and the total cost experienced by users is the sum of the costs on each resource [START_REF] Beckmann | Studies in the economics of transportation[END_REF][START_REF] Monderer | Potential games[END_REF]. Here, users select only one resource, and congestion corresponds to the fact that the more customers, the more likely an attack.

In this paper, we consider a very large population, where the extra congestion created by any individual user is negligible. The set of players can therefore be considered as a continuum; note that such games are called nonatomic [START_REF] Schmeidler | Equilibrium points of nonatomic games[END_REF]. While the study of nonatomic congestion games has seen recent advances for the case when all users are identical or belong to a finite set of populations [START_REF] Correa | A geometric approach to the price of anarchy in nonatomic congestion games[END_REF][START_REF] Karakostas | Edge pricing of multicommodity networks for heterogeneous selfish users[END_REF][START_REF] Perakis | The "Price of Anarchy" under nonlinear and asymmetric costs[END_REF][START_REF] Roughgarden | Selfish Routing and the Price of Anarchy[END_REF][START_REF] Roughgarden | Bounding the inefficiency of equilibria in nonatomic congestion games[END_REF], we want here to encompass the larger attractiveness to attackers of "rich" users, compared to the ones with no valuable data online. More precisely, we intend to model the heterogeneity in users congestion effects, by introducing a distribution among users valuation for the data to protect. The congestion game is therefore weighted in the sense that not all users contribute to congestion in an identical manner. Fewer results exist for those games [START_REF] Bhawalkar | Weighted congestion games: Price of anarchy, universal worst-case examples, and tightness[END_REF][START_REF] Milchtaich | Weighted congestion games with separable preferences[END_REF], even when user strategies only consist in choosing one resource among a strategy set that is identical for all players.

Moreover, in our model users undergo the congestion cost of the security solution they select -which depends on the congestion as well as on their particular data valuation -, but also the monetary cost associated to that solution -which is the same for all users -. As a result, following [START_REF] Milchtaich | Congestion games with player-specific payoff functions[END_REF][START_REF] Milchtaich | Weighted congestion games with separable preferences[END_REF] the game would be called a weighted congestion game with separable preferences, and can be transformed into an equivalent weighted congestion game with player-specific constants [START_REF] Mavronicolas | Congestion games with player-specific constants[END_REF] (i.e., the payoffs of users selecting the same strategy only differ through a user-specific additive constant). In general, the existence of an equilibrium is not ensured for such games when the number of users is finite [START_REF] Mavronicolas | Congestion games with player-specific constants[END_REF][START_REF] Milchtaich | Congestion games with player-specific payoff functions[END_REF][START_REF] Milchtaich | Weighted congestion games with separable preferences[END_REF]. In the nonatomic case, the existence of a mixed equilibrium is ensured by [START_REF] Schmeidler | Equilibrium points of nonatomic games[END_REF] and the loss of efficiency due to user selfishness is bounded [START_REF] Bhawalkar | Weighted congestion games: Price of anarchy, universal worst-case examples, and tightness[END_REF], but the existence of a pure equilibrium in the general case is not guaranteed. In this paper, we establish the existence and essential uniqueness of a pure equilibrium for our model, through a potential function. Such proofs for nonatomic games had only been given for unweighted games [START_REF] Sandholm | Potential games with continuous player sets[END_REF][START_REF] Sandholm | Large population potential games[END_REF], with possibly a finite number of different user populations; here we consider a weighted game with possibly an infinity of different weight values, with the specificity that the differences in user congestion weights are directly linked to their user-specific valuations.

MODEL

We consider a set I of security providers (each one on a given architecture), and define I := |I|.

User data valuation

Users differ with the valuation for their data. When an attack is successful over a target user u, that user is assumed to experience a financial loss vu ≥ 0, that we call her data valuation. The distribution of valuations over the population is given by a cumulative distribution function F on R + , where F (v) represents the proportion of users with valuation lower or equal to v. Since users who do not value their data (i.e., for whom vu = 0) will not play any role in our model, we can ignore them; the distribution function F is therefore such that F (0) = 0. The overall total "mass" of users is finite, and through a unit change we can assume it to be 1 without loss of generality.

Equivalently, the repartition F of user preferences among the population can be represented by its corresponding quantile function q : [0, 1) → R + . For x ∈ [0, 1), the quantity q(x) represents the valuation2 of the (infinitesimal) user at (continuous) position x on a valuation-related increasing ranking. Formally, we have

∀x ∈ [0, 1), q(x) = inf{v ∈ R + : F (v) ≥ x}, (1)
∀v ∈ R + , F (v) = inf{x ∈ [0, 1) : q(x) > v}, (2)
with the convention inf ∅ := 1 in the latter equation. Note that F is right-continuous, while the quantile function q is left-continuous. Both functions are nonnegative and nondecreasing.

We may not suppose that the support of F , that we denote by Sv, is bounded, but we will assume that the overall value of the data in the population is finite, i.e., we consider that

Vtot := Sv v dF (v) < +∞.
Finally, we define N (V ) as the user mass3 such that the total data valuation for the N (V ) users with smallest valuation exactly equals V :

∀V ∈ [0, Vtot), N (V ) := min x :

x y=0 q(y)dy = V .

N (V ) is obtained by inverting the bijective function

V : [0, 1] → [0, Vtot] x → V(x) = x y=0
q(y)dy.

Notice that V is continuous and differentiable on [0, 1], with left-derivative q(x) and right-derivative q(x + ), where q(x + ) = limy→x,y>x q(y). Since q is nondecreasing and strictly positive for x > 0, then V is convex and strictly increasing on [0, 1]. As a result, its inverse function N is concave on (0, Vtot), and has left-derivative

N l (V ) = 1 q(N (V )) (4)
and right-derivative

N r (V ) = 1 q(N (V ) + ) . ( 5
)
The distribution F , the quantity Vtot as well as the functions q and N are illustrated in Figure 1. Throughout the paper, while our results are valid for any valuation distribution, we illustrate the results with numerical examples considering an exponential distribution, i.e., such that

Vtot V N (V ) F (v) 0 q(x) 0 N (V )
F (v) = 1 -e -λv (6)
for a given λ > 0, where a straightforward calculation gives λ = 1/Vtot. Such a distribution models an unbounded continuum of valuations among the population, where a large majority of users have limited valuations, but there exist few people with extremely high value data to protect.

Security systems performance

In this paper, we focus on direct attacks targeting some specific machines, which may for instance come from an attackgenerating robot that randomly chooses IP addresses and launches attacks to those hosts.

The attacks generated by such a scheme have to target a specific vulnerability of a given security system. As a result, the attacker has to select which security system i ∈ I to focus on. If an attack is launched to a security system i, we consider that all machines protected by a system j = i do not run any risk, while the success probability of the attack is supposed to be fixed, denoted by πi, on machines with protection system i. In other terms, the parameter πi measures the effectiveness of the security defense.

The attacker point of view

Successful attacks bring some revenue to the attacker. Be it in terms of damage done to user data, or in terms of stolen data from users, it is reasonable to consider that for a given attack, the gain for the attacker is proportional to the value that the data had to the victim. Indeed, in the case of data steal, more sensitive data (e.g., bank details) are more likely to bring high revenues when used. Likewise, when the objective of the attacker is simply to maximize user damage, then the link between attacker utility and user data valuation is direct.

For a given distribution of the population among providers, we define for each provider i ∈ I the total value of the protected data, as

Vi := users with prov. i v dF (v). (7)
For an attacker, the expected benefit from launching an attack targeted at system i (but without knowing which users are with provider i) is thus proportional to πiVi.

As a result, we can reasonably assume that the likeliness of attacks occurring on system i is a nondecreasing function of πiVi: the higher the potential attacker utility, the more interesting the attack for the attacker. We discretize time, and denote by Ri(πiVi) the probability that a particular user is the target of a system-i attack over a time period.

Remark that we consider system-specific functions (Ri)i∈I, so that the model can encompass some heterogeneity in the difficulty of creating system-targeted attacks.

To simplify a bit the writing, let us define Ti(Vi) as the risk, for a user, of having one's data compromised when choosing security provider i. Since that risk is the product of the attack success probability πi (assumed fixed for now) and the attack occurrence probability Ri(πiVi), it can be written as a function of the total protected data value Vi:

Ti(Vi) := πiRi(πiVi) = πiRi πi users with prov. i vdF (v) . ( 8
)
We will often make use of the assumption below.

Assumption A. For all i ∈ I, Ti is a continuous and strictly increasing function of Vi, and Ti(0) = 0.

For Ti functions of the form given in [START_REF] Cremonini | Understanding and influencing attackers' decisions: Implications for security investment strategies[END_REF], Assumption A is equivalent to

• πi > 0 for all i ∈ I,
• Ri is a continuous and strictly increasing function with Ri(0) = 0, for all i ∈ I.

The latter point suggests that attackers will not target providers that do not protect valuable data, whereas the former means that no provider offers a perfect protection against attacks.

User preferences

For a user u with data valuation vu, the total expected cost at provider i depends on the risk of being (successfully) attacked, and on the price pi charged by the security provider. That total cost is therefore given by vuTi(Vi) + pi.

To ensure that all users select one option, we can assume that there exists a provider i with pi = 0, which would correspond to security solutions offered by free software communities (e.g., avast! R4 ). Indeed, if pi = 0, the total cost is

USER EQUILIBRIUM

In this section, we investigate how demand is split among providers, when their prices pi and security levels πi are fixed. Recall we assumed that users are infinitely small: their individual choices do not affect the overall user distribution among providers (and therefore the total values (Vi)i∈I).

The outcome from such user interactions should be determined by user selfishness: demand should be distributed in such a way that each user u chooses one of the cheapest providers (in terms of perceived price) with respect to her valuation vu and the current risk values (Ti(Vi)) i∈I . Such a distribution of users among providers, if it exists, will be called a user equilibrium. In other words, if provider i ∈ I is chosen by some users u, then it is cheaper for those users (in terms of total expected cost) than any other provider j ∈ I, otherwise they would be better off switching to j. Formally,

i ∈ arg min j∈I vuTj(Vj) + pj.
We use here the nonatomicity assumption: an individual user switching providers has no influence on expected costs, so each user u considers the values (Vj)i∈I as fixed.

Structure of a user equilibrium

We now investigate the existence and uniqueness of a user equilibrium, for fixed values of prices and attack success probabilities, when Ri is a strictly increasing function for all i ∈ I. To do so, we first define the notion of user repartition.

Definition 1. Denote by PI the set of probability distributions over providers in I, i.e., PI := {(y1, ..., yI ) ≥ 0, i∈I yi = 1}. For a given price profile p = (p1, ..., pI ), a user repartition is a mapping A : Sv → PI, that is interpreted as follows:

For all v ∈ Sv, among users with valuation v, a proportion Ai(v) chooses provider i,

where A(v) = (A1(v), ..., AI (v)).
Therefore, to a given user repartition A corresponds a unique distribution of the total data valuation Vtot among providers, given by

Vi(A) = v∈Sv v Ai(v) dF (v) ∀i ∈ I. (9)
Reciprocally, we say that a distribution V = (Vi)i∈I of the data valuation is feasible if Vi ≥ 0 for all i, and i∈I Vi = Vtot. For a feasible distribution V, when providers are sorted such that p1 ≤ ... ≤ pI , we define for each i ∈ I ∪ {0} the quantity

V [i] := i j=1 Vj, with V [0] = 0. V [i]
therefore represents the total value of the data protected by the i cheapest providers.

We now formally define the outcome that we should expect from the interaction of users, i.e., an equilibrium situation.

Definition 2. A user equilibrium is a user repartition A eq such that no user has an interest to switch providers. In other words, for any value v ∈ Sv, a user with valuation v cannot do better than following the provider choice given by A eq (v). Formally, A eq is a user equilibrium if and only if ∀v ∈ Sv,

A eq i (v) > 0 ⇒ i ∈ arg min j∈I vTj(Vj(A eq )) + pj, (10)
where Vj(A eq ) is given by ( 9).

We first establish some monotonicity properties that should be verified by a user equilibrium: if a user y values her data strictly less than another user x, then she selects cheaper (in terms of price) providers than x.

Lemma 1. Consider a user equilibrium A eq . Then user choices -in terms of price of the chosen provider(s)-are monotone in their valuation: for any two users x and y with respective valuations vx and vy, and any providers i and j,

(vx -vy) • A eq i (vx) • A eq j (vy) > 0 ⇒ pi ≥ pj. (11)
Proof. Let us write Vi := Vi(A eq ) and Vj := Vj(A eq ). From [START_REF] Fudenberg | The folk theorem in repeated games with discounting or with incomplete information[END_REF] applied to users x and y, the left-hand inequality of [START_REF] Fudenberg | Game Theory[END_REF] implies

vxTi(Vi) + pi ≤ vxTj(Vj) + pj and vyTi(Vi) + pi ≥ vyTj(Vj) + pj. (12)
Subtracting those inequalities gives Ti(Vi) ≤ Tj(Vj) since (vx-vy) > 0. Then (12) yields the right-hand side of [START_REF] Fudenberg | Game Theory[END_REF].

We then use that result to prove that for a given value repartition (Vi)i∈I over the providers, there can be only one equilibrium repartition if all providers set different prices.

Lemma 2. Assume that all providers set different prices. If a user equilibrium exists, it is completely characterized (unless for a zero-measure set of users) by the total values (Vi)i∈I of protected data for each provider i ∈ I, provided that i∈I Vi = Vtot.

Proof. Without loss of generality, assume that provider prices are sorted, such that p1 < p2 < ... < pI .

From Definition 1 and ( 9), to a given equilibrium corresponds a unique set of values (Vi)i∈I.

Reciprocally, consider a feasible data value repartition V = (Vi)i∈I, and assume it corresponds to a user equilibrium A eq . Since we do not differentiate users with similar valuations, we can sort them -still without loss of generality-in an increasing order of the price of their chosen provider: if x < y and q(x) = q(y) then we can impose that pi x ≤ pi y , where ix (resp. iy) would be the (unique) provider chosen by user at position x (resp. y) in the user valuation ranking. Therefore from Lemma 1, at the user equilibrium A eq , provider prices can be considered as sorted in a increasing order of user valuations among all users. As a result, provider choices are uniquely (unless on a zero-measure user set) determined by their position x ∈ [0, 1] in the user valuation ranking, and given by

V(x) ∈ (V [i-1] , V [i] ) ⇒ user x selects provider i, ( 13
)
where V is defined in (3).

The case of several providers with the same price

In this subsection, we establish a way to consider several providers with the same price as one single option from the user point of view. Let us consider a common price p, and define Ip := {i ∈ I : pi = p}.

First, it is easy to see that if one such provider i gets nonnegligible demand (i.e., Vi > 0), then at a user equilibrium all providers with the same price also get nonnegligible demand: indeed, Assumption A implies that Ti > 0, and therefore the total cost of a user u with positive valuation choosing provider i ∈ Ip is vuTi(Vi) + p > p. Therefore each provider j ∈ Ip necessarily has a strictly positive Tj, otherwise it would have cost vuTj(0) + p = p for user u, who would be better off switching from i to j. Consequently, at a user equilibrium we necessarily have Ti(Vi) = Tj(Vj).

When the set of users choosing one of the providers with price p is fixed, so is the total valuation VI p of those users' data. Consequently, the distribution of users among all providers in Ip should be such that

i, j ∈ Ip ⇒ Ti(Vi) = Tj(Vj) i∈Ip Vi = VI p . (14)
Following [START_REF] Beckmann | Studies in the economics of transportation[END_REF], we reformulate ( 14) as a minimization problem:

(Vi)i∈I p ∈ arg min

(x i ) i∈Ip ≥0 i∈Ip x i y=0
Ti(y)dy (15)

s.t. i∈Ip xi = VI p .
Under Assumption A, there exists a unique vector of values (Vi)i∈I p satisfying the above system. In the following, we will denote by TI p (V ) the corresponding common value of Ti(Vi). Interestingly, remark that the function TI p that we have defined also satisfies Assumption A. As a result, in the rest of the analysis of user equilibria, we will associate providers with the same price p and consider them as a single choice Ip that we assimilate as a single provider k, with corresponding risk function T k (V ) := TI p (V ) satisfying Assumption A.

A potential game

Based on the reasoning in Subsection 4.2, we assume that all providers submit a different price, and we sort them such that p1 < ... < pI . For a given feasible value repartition V = (Vi)i∈I among providers, we consider that users react selfishly and therefore make their provider choice according to [START_REF] Jiang | Efficiency of selfish investments in network security[END_REF]. Now let us consider the following measure:

L(V, p) := i∈I V i y=0 Ti(y)dy + pi N(V [i] ) -N(V [i-1] ) Market share of prov. i (16)
=

I i=1 V i y=0
Ti(y)dy + pI -

I-1 i=1 (pi+1 -pi)N(V [i]
), [START_REF] Koutsoupias | Worst-case equilibria[END_REF] with p0 := 0.

Remark that the first part of the quantity L(V, p) in ( 16) is the potential function usually associated to unweighted congestion games (see, e.g., [START_REF] Beckmann | Studies in the economics of transportation[END_REF]), while the second part stands for the total price paid by all users.

The expression [START_REF] Koutsoupias | Worst-case equilibria[END_REF] highlights the fact that L is a strictly convex function of V, since N is concave and under Assumption A, Ti is strictly increasing. As a result, it admits a unique minimum V * on the (convex) domain of feasible value shares; and V * is completely characterized by the firstorder conditions. We now prove that this valuation repartition V * actually corresponds to a user equilibrium.

Proposition 1. Let Assumption A hold. For any price profile p, there exists a user equilibrium, that is completely characterized by the valuation repartition V * , unique solution of the convex optimization problem

min V feasible L(V, p). ( 18
)
Proof. We first consider the feasible directions consisting in switching some infinitesimal amount of value from i > 1 to j < i, when V * i > 0. The optimality condition in [START_REF] Koutsoupias | Worst-case equilibria[END_REF]

then yields 0 ≤ Tj(V * j ) -Ti(V * i ) - i-1 k=j (p k+1 -p k )N r (V * [k] ) ≤ Tj(V * j ) -Ti(V * i ) -(pi -pj)N r (V * [i-1] ), (19)
where the second line comes from the concavity of N .

Notice that since pj < pi and N is nondecreasing, Relation [START_REF] Lelarge | Economic incentives to increase security in the internet: The case for insurance[END_REF] and Assumption A imply that V * j > 0.

Consequently, if we define i * := max{i ∈ I : V * i > 0}, then we have

V * i > 0 ⇔ i ≤ i * . ( 20
)
As a result, since Vi > 0 and i > 1 in [START_REF] Lelarge | Economic incentives to increase security in the internet: The case for insurance[END_REF], then 0

< V * [i-1] < Vtot. Thus, from (5), N r (V * [i-1] ) = 1 q(N (V * [i-1] )) is strictly positive. Relation (19) is then equivalent to v * i Ti(V * i ) + pi ≤ v * i Tj(V * j ) + pj, (21)
with

v * i := q(N (V * [i-1] ) + ) = inf{v : v u=0 udF (u) > V * [i-1] }. Remark that necessarily from (21), Ti(V * i ) < Tj(V * j ) since pi > pj.
For i < I such that V * i > 0 (i.e., i ≤ i * ), we now investigate the possibility of switching some value from i to j > i. Still applying the optimality condition for V * , we get

0 ≤ Tj(V * j ) -Ti(V * i ) + j-1 k=i (p k+1 -p k )N l (V * [k] ) (22) ≤ Tj(V * j ) -Ti(V * i ) + (pj -pi)N l (V * [i] ), (23)
where we used again the concavity of N .

Applying (4), Relation ( 23) is equivalent to

v * i Ti(V * i ) + pi ≤ v * i Tj(V * j ) + pj, (24)
with v * i = q(N (V * [i] )) = inf{v : v u=0 udF (u) ≥ V * [i] }.
Relations ( 21) and ( 24) can be interpreted as users with valuation v ∈ [v * i , v * i ] preferring provider i over any other provider, for the repartition value V * . Formally,

v ∈ [v * i , v * i ] ⇒ i ∈ arg min j∈I vTj(V * j ) + pj. (25)
Now, consider the provider choices induced by the value repartition V * as given in [START_REF] Jiang | Efficiency of selfish investments in network security[END_REF]. We prove here that this repartition is a user equilibrium, since no user has an interest to change providers.

Take a provider i ∈ I. We then have for x ∈ [0, 1],

V(x) ∈ (V * [i-1] , V * [i] ) ⇔ V * [i-1] < x y=0 q(y)dy < V * [i] ⇔ N (V * [i-1] ) < x < N (V * [i] ) ⇒ v * i ≤ q(x) ≤ v * i .
The last line and [START_REF] Osborne | A Course in Game Theory[END_REF] imply that the considered user, that is at position x in the population when it is ranked according to valuations, cannot do better than choosing the provider suggested by [START_REF] Jiang | Efficiency of selfish investments in network security[END_REF]. In other words, each user is satisfied with her current provider choice, i.e., we have a user equilibrium.

We now establish the uniqueness of the equilibrium value repartition V * (and thus, of the user equilibrium due to Lemma 2 when all prices are different).

Proposition 2. Under Assumption A, the value repartition at a user equilibrium necessarily equals

V * = arg min V feasible L(V, p).
Consequently, there exists a unique value equilibrium value repartition, and there exists a user equilibrium that is unique (unless for a zero-measure set of users) when all providers set different prices.

Note that the uniqueness of the equilibrium value repartition V * implies that even in cases where several user equilibria exist, for all users the cost of each provider at equilibrium is unique; in that sense the user equilibrium is said essentially unique [START_REF] Beckmann | Studies in the economics of transportation[END_REF].

Proof. We consider a user equilibrium, and prove that the corresponding value repartition Ṽ satisfies the first-order conditions of the convex optimization problem [START_REF] Lelarge | Network externalities and the deployment of security features and protocols in the Internet[END_REF], that has been shown to have a unique solution V * .

We actually only need to show the counterpart of Relation (19) (resp., [START_REF] Milchtaich | Weighted congestion games with separable preferences[END_REF]) for j = i -1 (resp., j = i + 1), since the other cases immediately follow.

From [START_REF] Jiang | Efficiency of selfish investments in network security[END_REF], at a user equilibrium we should have for all x ∈ (0, 1) and all i, j ∈ I,

x ∈ N ( Ṽ[i-1] ), N ( Ṽ[i] ) ⇒ q(x)(Ti( Ṽi) -Tj( Ṽj)) + pi -pj ≤ 0. ( 26
)
Consider i ∈ I such that Ṽi > 0.

• If j = i -1, then Ti( Ṽi) -Tj( Ṽj) < 0. Applying [START_REF] Perakis | The "Price of Anarchy" under nonlinear and asymmetric costs[END_REF] when x tends to N ( Ṽ[i-1] ), we have

q(N ( Ṽ[i-1] ) + ) =N r ( Ṽ[i-1] ) (Ti( Ṽi) -Tj( Ṽj)) + pi -pj ≤ 0,
which is exactly the counterpart of ( 19).

• Likewise for j = i+1, from ( 26) for x tending to N ( Ṽ[i] ) we get (using the fact that q is left-continuous)

q(N ( Ṽ[i] )) =N l ( Ṽ[i] )
(Ti( Ṽi) -Tj( Ṽj)) + pi -pj ≤ 0, the counterpart of [START_REF] Milchtaich | Weighted congestion games with separable preferences[END_REF].

Consequently, the value repartition Ṽ satisfies the first-order conditions of the convex optimization problem [START_REF] Lelarge | Network externalities and the deployment of security features and protocols in the Internet[END_REF] and is feasible, therefore Ṽ coincides with the unique solution V * of the problem.

The second claim of the proposition is a direct application of Lemma 2.

Note that it was not compulsory to aggregate providers with the same price p: at the minimum of L(•, p) we notice from ( 15) that the term

V Ip 0
TI p involving the aggregated function coincides with the corresponding separate expression i∈Ip x i y=0 Ti(y)dy. Therefore, the equilibrium value distribution V * can directly be found by solving the potential minimization problem [START_REF] Lelarge | Network externalities and the deployment of security features and protocols in the Internet[END_REF]. Nevertheless, the interpretation of the potential is changed, since the terms

N (V [i] ) -N (V [i-1]
) of ( 16) do not necessarily correspond anymore to provider i's market share.

The next result shows some continuity properties verified by the user equilibrium.

Proposition 3. The (unique) equilibrium value repartition V * is continuous in the price profile. Moreover, at any price profile such that all prices are different, the provider market shares are continuous in the price profile.

Proof. Remark that L(V, p) is jointly continuous in V and p, and that the set of feasible value repartitions is compact. Therefore, from the Theorem of the Maximum (see [START_REF] Berge | Espaces topologiques. Fonctions multivoques[END_REF]) applied to the minimization problem [START_REF] Lelarge | Network externalities and the deployment of security features and protocols in the Internet[END_REF], the set of equilibrium distributions is upper hemicontinuous in p. It is actually continuous due to the uniqueness of the equilibrium distribution V * .

For a given price profile p where all prices differ, the strict order of prices is maintained within a vicinity of p. Therefore, in such a vicinity the market share of provider i is

N (V * [i] ) -N (V * [i-1]
), which is jointly continuous in V and p since N is continuous.

Note that while the equilibrium value repartition V * is continuous for all price profiles, that is not the case of provider market shares. Indeed, market shares (θi)i∈I strongly depend on the order of prices through the expression

N (V * [i] )- N (V * [i-1]
), that holds when prices are sorted in an increasing order. Since N is a concave function, then the market share of a provider may drastically decrease when a slight price modification changes his position from k to k +1 in the price ranking. This effect is more prominent when N is more concave, i.e., when user valuations are heterogeneous. In the other extreme, if all users had the same valuation N would be linear, and the market share of a provider i would simply be θi = N (V * i ), which is continuous in the price profile.

Price of Anarchy of the user game

In non-cooperative games, the Price of Anarchy measures the loss of efficiency due to user selfishness [START_REF] Koutsoupias | Worst-case equilibria[END_REF]. This metric is usually defined as the worst-case ratio of the total cost at an equilibrium to the minimal feasible total cost, and has been extensively studied in the last years [START_REF] Correa | A geometric approach to the price of anarchy in nonatomic congestion games[END_REF][START_REF] Perakis | The "Price of Anarchy" under nonlinear and asymmetric costs[END_REF][START_REF] Roughgarden | Selfish Routing and the Price of Anarchy[END_REF][START_REF] Roughgarden | Bounding the inefficiency of equilibria in nonatomic congestion games[END_REF]. The results closest to the one presented in this subsection come from [START_REF] Bhawalkar | Weighted congestion games: Price of anarchy, universal worst-case examples, and tightness[END_REF]: the authors consider weighted congestion games, where the cost experienced by each user would correspond to the situation where all prices are set to 0 in our model. Then the authors prove that the upper bound for the Price of Anarchy is not greater for the weighted game than for its unweighted counterpart. We actually establish the same kind of result for any value of the provider price profile p, except that in our case the total user cost (sum of the costs perceived by all users) for any feasible user valuation repartition V is

Cuser := i∈I ViTi(Vi) + pi(N (V [i] ) -N (V [i-1] )) . ( 27
)
Proposition 4. Assume that the risk functions (Ti)i∈I belong to a family C, and define as in [START_REF] Correa | A geometric approach to the price of anarchy in nonatomic congestion games[END_REF] the quantity

β(C) := sup T ∈C,(x,y)∈[0,V tot ] 2
x(T (y) -T (x)) yT (y) .

Then for any nonnegative price profile p,

C * user C opt user ≤ 1 1 -β(C) , (28)
where C * user (resp. C opt user ) is the total user cost at the user equilibrium (resp. the minimum total user cost) for the price profile p.

Proof. We apply a variational inequality that is satisfied by the user equilibrium value repartition V * , and that directly stems from the fact that users only select their preferred provider, ignoring their externality effect: for any feasible value repartition V, we have i∈I

V * i Ti(V * i ) + pi(N (V * [i] ) -N (V * [i-1] )) ≤ i∈I ViTi(V * i ) + pi(N (V [i] ) -N (V [i-1] )) .
This yields

C * user ≤ Cuser + i∈I Vi(Ti(V * i ) -Ti(Vi)) ≤ Cuser + β(C) i∈I V * i Ti(V * i ) ≤ Cuser + β(C)C * user ,
which establishes the proposition.

As in [START_REF] Bhawalkar | Weighted congestion games: Price of anarchy, universal worst-case examples, and tightness[END_REF], we find that the introduction of weights among user congestion effects (and here, in addition, among user perceived costs) does not worsen the Price of Anarchy. The bound given in Proposition 4 can indeed be attained, when C includes the constant functions, with a simple 2-provider instance with prices set to zero, and all users having the same weight (i.e., the valuation repartition is of the form F (v) = 1l {v≥v 0 } for some v0 > 0, with 1l {A} = 1 if A is verified, and 0 otherwise.).

PRICING DECISIONS OF SECURITY PROVIDERS

We now focus at the decisions that are made by security providers when choosing their charging price. We consider that providers are able to anticipate the reactions of users, and that they take those reactions into account when fixing their prices. We then have a two-stage game, where at a first step (larger time scale) providers compete on setting their prices so as to maximize revenue, considering that at a second step (smaller time scale) users selfishly select their provider.

The utility of provider i is given by his revenue

ri := piθi,
where θi is the market share of provider i.

When all providers propose different prices and providers are ranked such that p1 < p2 < ... < pI , from Proposition 2 the user equilibrium exists and is unique, and we simply have

θi = N (V * [i] ) -N (V * [i-1]
), where V * is the equilibrium value repartition. On the other hand, if several providers in a set Ip propose the same price p, then the equilibrium valuation repartition V * is unique, but the user equilibrium choices need not be unique: indeed, any price-monotone user repartition consistent with V is a user equilibrium, and several such repartitions may exist when several providers set the same price. For those special cases, a reasonable assumption could be that users make their provider choice independently of their valuation when they have several equally preferred providers. As a result, the total market share of providers in Ip would be split among them proportionally to the data value V * i that they attract, yielding

θi = V * i j:p j =p i V * j   N ( j:p j ≤p i V * j ) -N ( j:p j <p i V * j )   .
We first establish that, when there exists a provider with a bounded price, the revenue of another provider tends to zero if he increases his price to infinity. In practice, such a bounded-price option always exists, even if it has bad performance: one just needs to consider any free security possibility. The following proposition therefore proves that prices will not be arbitrarily high when providers want to maximize revenue.

Proposition 5. Assume that there exists a provider i0 whose price pi 0 is bounded by pi 0 . Then for any provider j = i0, the revenue rj = pjθj tends to 0 when pj → ∞.

Proof. Let us consider a user with valuation v, for whom provider j is among the favorite providers. In particular, that user prefers j over i0, thus at a user equilibrium we have

v(Ti 0 (Vi 0 ) -Tj(Vj)) ≥ pj -pi 0 ≥ pj -pi 0 . (29)
Therefore if pj > pi 0 then Tj(Vj) < Ti 0 (Vi 0 ) and

v ≥ pj -pi 0 Ti 0 (Vi 0 ) -Tj(Vj) ≥ pj -pi 0 Ti 0 (Vtot) := vmin.
The revenue rj of provider j can then be upper bounded:

rj = pjθj ≤ pj +∞ v=v min dF (v) = Ti 0 (Vtot) pj -pi 0 Ti 0 (Vtot) +∞ v= p j -pi 0 T i 0 (V tot ) dF (v) ----→ p j →∞ 0 + +pi 0 +∞ v= p j -pi 0 T i 0 (V tot ) dF (v) ----→ p j →∞ 0 ,
where the two terms tend to zero since

∞ 0 vdF (v) = Vtot < ∞.

Licensed versus free security provider

We first consider a simple situation with two providers, but only one trying to maximize his profit through subscription benefits. The other provider (or, more likely, a community of developers) offers the security service for free and does not play on price.

Denote by 0 and 1 the freeware provider and the licensed provider, respectively. While provider 0 does not care about profits and simply sets his price to p0 = 0, provider 1 has to choose a strictly positive price p1 = p > 0 to get some benefit.

From Proposition 1, there exists a unique value repartition (V0(p), Vtot -V0(p)) at the user equilibrium, for any price p set by provider 1. Likewise, for any p > 0 the equilibrium market share of provider 1 is unique and given by θ1 = 1 -N (V0(p)); the profit maximization problem of provider 1 can therefore be written as

max p≥0 p • (1 -N (V0(p))). ( 30
)
Note that provider 1 gets demand as soon as his price is strictly below sup(Sv) × T0(Vtot), therefore by choosing p ∈ (0, sup(Sv)T0(Vtot)) he can ensure a positive revenue. The next result directly follows from Propositions 3 and 5, and simply states that the provider revenue optimization problem (30) has a solution, that is finite.

Corollary 1. When a profit-oriented provider faces only a competitor with null price, then under Assumption A there exists a finite price p > 0 that maximizes his revenue, whose maximum value is strictly positive.

We illustrate those results when user valuations are distributed according to an exponential law with average value 1/λ = 10 monetary units. The risk function considered in all our numerical computations is

Ri(x) = 1 -e -x
for each provider i, which models the fact that systems with no valuable data are not targeted while successful systems are very likely to attract attacks.

Figures 2 and3 display the evolution of V * 1 (the data value protected by provider 1) and the corresponding market share θ1, respectively, when the price set by provider 1 varies. Curves are plotted for π1 = 0.01, for given values of the vulnerability π0 of the free alternative.

As shown in Figure 2, the equilibrium total value protected by provider 1 decreases with the price p1, since some users prefer to switch to the free provider. Nevertheless, this effect is less prominent when the other alternative performs poorly (here, when π0 increases): users with very sensitive data are willing to pay the extra price to keep benefitting from the high-level protection.

With respect to provider 0, provider 1 only attracts the most protection-sensitive users. As a result, his market share 1 -N (V * 0 (p1)) decreases faster than his protected data value share V * 1 /Vtot, as can be seen in Figure 3. Both figures also illustrate the continuity results of Proposition 3. Figure 4 on the other hand displays provider 1's revenue in terms of his price p1. One can see that the optimal price value of Proposition 5 can easily be obtained numerically and that both (optimal) price and revenue increase with the attack success probability at provider 0.

Competition among providers: the risk of price war

Competitive contexts where providers play on price to attract customers often lead to price war situations, i.e., situations where each provider has an interest in decreasing one's price below the price of his competitor. The outcome then corresponds to providers making no profit, and possibly not surviving.

With the model presented in this paper, not all demand goes to the cheapest provider because of the congestion effect due to attackers' behavior. However, some threshold effect still exist, as illustrated by the non-continuity of provider market shares when provider prices cross each other.

Let us for example consider two identical profit-oriented providers and a free alternative. Due to the symmetry of the game, one would expect a situation where both providers set their price to the same level, say p > 0. As a result, again from symmetry arguments both providers would be chosen by users to protect, at equilibrium, the same value V * 1 = V * 2 := V * of data each, while the free provider covers a total data value V0. Then, if provider 1 sets his price to p -ε for a small ε > 0, the market share repartition is such that when ε → 0,

θ0 = N (V * 0 ), θ1 = N (V * 0 + V * ) -N (V * 0 ), θ2 = N (V * 0 + 2V * ) -N (V * 0 + V * ).
When users choosing provider 1 or 2 are not all homogeneous in their data valuations (which is for example the case if the valuation distribution F admits a density), then θ1 > θ2. In other words, provider 1 strictly improves his market share (and thus his revenue) by setting his price just below the price of his competitor. But provider 2 can make the exact same reasoning, resulting in a price war situation.

Consequently, there can be no symmetric Nash equilibrium (i.e., a price profile such that no provider can improve his revenue by a unilateral change) where p1 = p2 > 0, despite the symmetry of the pricing game. Furthermore, the price profile where all prices are set to 0 is not an equilibrium either: both providers would get no revenue, which each one could strictly improve by a small price increase as stated in Corollary 1.

Remark that this reasoning does not totally rule out the possibility of the pricing game having a (non-symmetric) Nash equilibrium, however we cannot always guarantee that such an equilibrium exists. An explanation to the existence of stable price profiles can nevertheless still be found from gametheoretic arguments, since the pricing game among providers is not played only once but repeatedly over time. When considering repeated games (i.e., where players take into account not only their current payoff but also a discounted sum of their future ones), the set of Nash equilibria is indeed much larger than for their one-shot counterpart, as evidenced by the Folk theorem [START_REF] Osborne | A Course in Game Theory[END_REF]. The stability of prices can then stem from the threat of being sanctioned by competitors for an (immediate-profit) price change.

As a numerical illustration, we consider here three providers: a provider 0 with performance parameter π0 = 0.05, that is always free: p0 = 0; and two profit-oriented providers, namely 1 and 2, with respective performance values π1 = 0.01 and π2 = 0, 005. Providers protected data values and market shares are shown in Figures 5 and6, and the revenue of provider 2 is displayed in Figure 7. trate the continuity results of Proposition 3. Interestingly, we remark for our numerical example that despite the discontinuity in revenue when prices cross each other, provider 2 actually has a revenue-maximizing price p BR 2 (p1), that is strictly below the price of his competitor. This is also illustrated in Figure 8 where best-reply prices p BR i (pj), i = j of both providers are plotted. That last figure shows the price war situation: if providers engage in successive best-reply price adaptations to the competition, then prices tend to very low values, which jeopardizes the viability of security providers. On the contrary, a situation with strictly positive prices from both providers could be stable in a repeated game context. One just needs to check that for a given price profile (p1, p2) each provider obtains at least what he could obtain with an aggressive competitor (i.e., a competitor that tries to minimize the provider revenue). Then, when providers value the future almost as much as the present (i.e., when the discount factor that relates current prices to future prices is close to 1), the price profile (p1, p2) can be maintained as a subgame-perfect equilibrium of the repeated game [START_REF] Fudenberg | The folk theorem in repeated games with discounting or with incomplete information[END_REF].

CONCLUSIONS

The model introduced in this paper takes into account the attractiveness that successful security systems represent to profit-minded attackers. This constitutes a negative externality among users: their (selfish) security choices then form a noncooperative congestion game. We have considered heterogeneity among user valuations for data protection, which affects both the externality level and the user cost functions. The corresponding game is therefore a weighted congestion game with user-specific payoffs. We have studied that game for the case of a continuum of infinitesimal users, and have proved that it admits a potential and therefore an equilibrium, that is unique when providers submit different prices.

The study of the user selection game has helped us understand the interaction among security providers, who have to attract customers but are then subject to quality degradation due to more attacks, hence a trade-off. Our analysis shows that providers will keep their prices low, and that competition may lead to price war situations, unless providers consider long-term repeated interactions.

Future work will focus on the information asymmetry and uncertainty among actors: we have studied the interactions in a complete information context, whereas users may not have a perfect knowledge of the performance level of the different providers, or of their total protected data value. Likewise, attackers can only estimate the potential gain from targeting a given system.

Another interesting direction for future research concerns the investment strategies that security providers should implement: indeed, improving the protection performance has a cost, that has to be compensated by the extra revenue due to user subscription decisions. While there exist references for this kind of problem when users are homogeneous [START_REF] Johari | Investment and market structure in industries with congestion[END_REF], the case when users have different weights deserves further attention.

Figure 1 :

 1 Figure 1: Values and functions of interest regarding the user valuation distribution F .

Figure 2 :Figure 3 :

 23 Figure 2: Total value of the data protected by provider 1, when p1 varies.

Figure 4 :

 4 Figure 4: Revenue of provider 1, when p1 varies.

3 Figure 5 :

 35 Figure 5: Protected data values when provider 2 varies his price.

Figure 6 :

 6 Figure 6: Market shares when provider 2 varies his price.

Figure 7 :Figure 8 :

 78 Figure 7: Revenue of provider 2 (π2 = 0.005) when facing provider 1 (π1 = 0.01) and free provider 0 (π0 = 0.05).

Except, possibly, on a zero-measure set of users.

i.e., proportion since we normalized the total user mass to 1.

http://www.avast.com the valuation times a product of probabilities, and therefore less than the valuation itself, so that this choice of a free service is always a valuable option

.Remark that we consider risk-neutral users here, as may be expected from large entities, while private individuals should rather be considered risk-averse. Nevertheless, one can imagine some extra mechanisms (e.g., insurance[START_REF] Lelarge | Economic incentives to increase security in the internet: The case for insurance[END_REF]) to reach a risk-neutral equivalent formulation.

We implicitly assume here that each user u is willing to pay at least vu to benefit from the online service.

http://marketshare.hitslink.com/ operating-system-market-share.aspx?qprid=8