Keywords: Security, Internet, Economics, Insurance

Managing security risks in the Internet has so far mostly involved methods to reduce the risks and the severity of the damages. Those methods (such as firewalls, intrusion detection and prevention, etc) reduce but do not eliminate risk, and the question remains on how to handle the residual risk.

In this paper, we take a new approach to the problem of Internet security and advocate managing this residual risk by buying insurance against it, in other words by transferring the risk to an insurance company in return for a fee, namely the insurance premium. We consider the problem of whether buying insurance to protect the Internet and its users from security risks makes sense, and if so, of identifying specific benefits of insurance and designing appropriate insurance policies.

Using insurance in the Internet raises several questions because entities in the Internet face correlated risks, which means that insurance claims will likely be correlated, making those entities less attractive to insurance companies. Furthermore, risks are interdependent, meaning that the decision by an entity to invest in security and self-protect affects the risk faced by others. We analyze the impact of these externalities on the security investments of the users using simple models that combine recent ideas from risk theory and network modeling.

Our key result is that using insurance would increase the security in the Internet. Specifically, we show that the adoption of security investments follows a threshold or tipping point dynamics, and that insurance is a powerful incentive mechanism which pushes entities over the threshold into a desirable state where they invest in self-protection.

Given its many benefits, we argue that insurance should become an important component of risk management in the Internet, and discuss its impact on Internet mechanisms and architecture.

Une nouvelle perspective sur la sécurité dans Internet grâce à l'assurance

Résumé : La gestion des risques en matière de sécurité dans l'Internet a jusqu'ici principalement concerné des méthodes pour réduire les risques et la gravité des dommages. Ces méthodes (telles que les pare-feu, détection d'intrusion et prévention, etc ..) réduisent mais n'éliminent pas le risque, et la question demeure sur la manière de gérer le risque résiduel. Dans ce document, nous adoptons une nouvelle approche du problème de la sécurité dans Internet et proposons de transférer ce risque résiduel à une compagnie d'assurance en échange d'une rémunération, à savoir la prime d'assurance. Nous considérons le problème de savoir s'il est possible d'utiliser des mécanismes économiques (tels que l'assurance) pour protéger les utilisatuers d'Internet. Dans ce contexte, nous nous proposons de déterminer les avantages de l'assurance et étudions la conception de polices d'assurance adéquates.

Notre principal résultat est que l'utilisation de l'assurance permettrait d'accroître la sécurité de l'Internet. Plus précisément, nous montrons que l'assurance est un puissant mécanisme d'incitation qui pousse les entités à investir dans l'auto-protection.

Mots-clés : Sécurité, Internet, Economie, Assurance

Introduction

The Internet has become a fundamental component of modern economies, and it provide services, starting with connectivity, that are strategic to companies, governments, families and individual users, and in general to the well functioning of modern life. As a result, it has become crucial to the various entities (operators, enterprises, individuals,...) that deliver or use Internet services to protect the Internet infrastructure and the services delivered through that infrastructure (or the ability of the infrastructure to deliver those services) against risks.

There are typically four options that individuals or organizations can take in the face of risks and the associated damages: 1) avoid the risk, 2) retain the risk, 3) self-protect and mitigate the risk, and 4) transfer the risk. Option 1 involves preventing any action that could involve risk, and it is clearly not realistic for the Internet. Option 2 involves accepting the loss when it occurs. Option 3 involves investing in methods to reduce the impact of the risk and the severity of the damages. Option 4 involves transferring the risk to another willing party through contract or hedging.

Most entities have so far chosen, or are only aware of the possibility of, a mix of options 2 and 3. As a result, these entities have been busy investing in people and devices to identify threats and develop and deploy coutermeasures. In practice, this has led to the development and deployment of a vast array of systems to detect threats and anomalies (both malicious such as intrusions, denial-of-service attacks, port scanners, worms, viruses, etc., and nonintentional such as overloads from flash crowds) and to protect the network infrastructure and its users from the negative impact of those anomalies, along with efforts in the area of security education in an attempt to minimize the risks related to the human factor [START_REF] Cheswick | Firewalls and Internet Security: Repelling the Wily Hacker[END_REF]. In parallel, most of the research on Internet security has similarly focused on issues related to option 3, with an emphasis on algorithms and solutions for threat or anomaly detection, identification, and mitigation.

Unfortunately, self protecting against risk or mitigating risk does not eliminate risk. There are several reasons for this. First, there do not always exist fool-proof ways to detect and identify even well defined threats; for example, even state of the art detectors of port scanners and other known anomalies suffer from non-zero rates of false positives and false negatives [START_REF] Jung | Fast portscan detection using sequential hypothesis testing[END_REF]. Furthermore, the originators of threats, and the threats they produce, evolve on their own and in response to detection and mitigation solutions being deployed, which makes it harder to detect and mitigate evolving threat signatures and characteristics [START_REF] Vojnovic | On the race of worms, alerts and patches[END_REF]. Other types of damages caused by non-intentional users, such as denial of service as a result of flash crowds, can be predicted and alleviated to some extent but not eliminated altogether. Finally, eliminating risks would require the use of formal methods to design provably secure systems, and formal methods capture with difficulty the presence of those messy humans, even non malicious humans, in the loop [START_REF] Odlyzko | Economics, psychology, and sociology of security[END_REF].

In the end, despite all the research, time, effort, and investment spent in Internet security, there remains a residual risk: the Internet infrastructure and its users are still very much at risk, with accounted damages already reaching considerable amounts of money and possible damage even more daunting (e.g. [START_REF] Gordon | Managing Cybersecurity Resources[END_REF], [START_REF] Weaver | A worst-case worm[END_REF] for a discussion on worm damage and conference web site for an opinion on damage cost estimation.) The question then is how to handle this residual risk.

One way to handle residual risk which has not been considered in much detail yet is to use the fourth option mentioned above, namely transfer the risk to another willing entity through contract or hedging. A widely used way to do this is through insurance, which is one type of risk transfer using contracts. In practice, the risk is transferred to an insurance company, in return for a fee which is the insurance premium. Insurance allows individuals or organizations to smooth payouts for uncertain events (variable costs of the damages associated with security risks) into predictable periodic costs. Using insurance to handle security risks in the Internet raises several questions: does this option make sense for the Internet, under which circumstances? Does it provide benefits, and if so, to whom, and to what extent? Our goal in this paper is to consider those questions.

There have traditionally been two approaches to modeling insurance and computing premiums, an actuarial approach and an economic approach. The actuarial approach uses the classical model for insurance risk where the risk process U (t) is expressed as

U (t) = C + ℘t -S(t), t ≥ 0, ( 1
)
where C is the initial capital, ℘ is the premium rate and the claim amount

S(t) = i X i consists of a random sum of claims X i , 1 ≤ i ≤ N (t)
where N (t) is the number of claims until time t. The goal of the modeling effort is, given statistics on the claims, to determine a premium rate ℘ which avoids the so-called ruin for the insurer, i.e. a negative value of U (t) (for a large initial capital C). Simple models consider for {N (t)} a homegeneous Poisson process. To capture the correlation between risks faced by users, and therefore between claims made by those users, some approaches model claims using heavy-tailed distributions . Refer to [START_REF] Mikosh | Non-Life Insurance Mathematics: An Introduction with Stochastic Processes[END_REF] for details.

The economic approach considers that a limit to insurability cannot be defined only on the characteristics of the risk distribution, but should take into account the economic environment. We take this approach in the paper. We consider a sequence of increasingly complex, but simple models, to examine the impact of insurance in the Internet.

Our first model is the classical, expected utility model with a single entity or user. We use it to present known results from the literature, and in particular to examine the interplay between self-protection and insurance. The main relevant result is that the insurance premium should be negatively related to the amount invested by the user in security (self-protection). This parallels the real life situtation where homeowners who invest in a burglar alarm and new locks expect their house theft premium to decrease following their investment.

The single user model is not appropriate for our purpose because the entities in the Internet face risks that are correlated, meaning that the risk faced by an entity increases with the risk faced by the entity's neighbors (e.g. I am likely to be attacked by a virus if my neighbors have just been attacked by that virus). Furthermore, entities face risks that are interdependent, meaning that those risks depend on the behavior of other entities in the network (such as their decisions to invest in security). Thus, the reward for a user investing INRIA in security depends on the general level of security in the network, leading to the feedback loop situation shown below.

self-protection

→ state of the network ↑ ↓ strategy of the user ← pricing of the premium We analyze the impact of these externalities on the security investments of the users with and without insurance being available. We focus on risks such as those caused by propagating worms or viruses, where damages can be caused either directly by a user, or indirectly via the user's neighbors. Users can decide whether or not to invest some amount c in security solutions to protect themselves against risk, which eliminates direct (but not indirect) damages. In the 2-user case, it is known [START_REF] Kunreuther | Interdependent security: the case of identical agents[END_REF] that, in the absence of insurance, there exists a Nash equilibrium in a "good" state (where both users self protect) if the security investment cost c is low enough.

We first build upon this result to add insurance to the 2-user case. We then consider the general case of a n-user network for which damages spread among the users that decide whether or not to invest in security for self-protection. We compare both situtations when insurance is available and when it is not. We show that if the premium discriminates against user that do not invest in security, then insurance is a strong incentive to invest in security. We also show how insurance can be a mechanism to facilitate the deployment of security investments by taking advantage network effects such as threshold or tipping point dynamics.

The models we use in the paper are simple, and our results will not by themselves establish insurance markets for the Internet and its users. Still, the models and results are significant because they provide a convenient way to formulate the problem of deploying insurance in the Internet, they provide a methodology to evaluate the impact of insurance and design appropriate insurance policies, and they bring out the significant benefits of insurance. Given those benefits, we believe that insurance ought to be considered as an important component of Internet security, as a mechanism to increase the adoptability of security measures Internet-wide, and as a mechanism that could have significant impact on Internet architecture and policies.

The rest of the paper is organized as follows. In Section 2, we describe related work. In Section 3, we introduce the classical expected utility model for a single user and present the standard results about risk premium and the interplay between self-protection and insurance. In Section 4, we describe the 2-user model, present the known results for self-protection in the absence of insurance, then build on this model to include insurance and prove our main results in the 2-user case. In Section 5, we extend those results to the case of a general network of n users. In Section 6, we discuss the impact of insurance and risk transfer on Internet mechanisms and architecture. Section 7 concludes the paper.

Related work

Risk management in the Internet has typically involved approaches that retain the risk (i.e. accept the loss when it occurs) and self-protect against the risk. As a result, a vast amount of research has been published in the area of protection against risk in the Internet, ranging from risk or threat detection, identification, mitigation, to ways to survive or recover from damages (refer to the large body of research published in related conferences [START_REF]Internet Measurement Conference[END_REF], and in relevant security conferences [24,37]. In parallel, researchers in the insurance community published a vast body of results in the area of insurance against risk (e.g. [START_REF] Gollier | The Economics of Risk and Time[END_REF]17]).

Comparatively little has been carried out or published at the intersection of insurance and the Internet. We can divide relevant contributions in three areas: Internet economics (without insurance), cyberinsurance or insurance of computer risks in general (without much focus on network effects), and insurance of correlated or interdependent risks.

Research on Internet economics aims at increasing our understanding of the Internet as an economic system and at developing policies and mechanisms to achieve desirable economic goals (much the same way early research on the Internet aimed at developing policies and mechanisms -such as the IP protocol -to achieve desirable design goals such as those described in [START_REF] Clark | The design philosophy of the DARPA Internet protocols[END_REF], or more recent research aims at developing clean-slate policies and mechanisms to achieve the desired goals of the future Internet [START_REF]NSF Future INternet Design program area[END_REF]). The importance of the economic aspects of the Internet was recognized very early on. Kleinrock in 1974 mentioned that "[H]ow does one introduce an equitable charging and accounting scheme in such a mixed network system. In fact, the general question of accounting, privacy, security and resource control and allocation are really unsolved questions which require a sophisticated set of tools" [START_REF] Kleinrock | Research areas in computer communications[END_REF]. More recently, Clark et al [START_REF] Clark | Tussle in cyberspace: defining tomorrow's internet[END_REF] mention economic drivers as key drivers to revisit old design principles and suggest new ones. Research in Internet economics has examined several issues, such as the economics of digital networks (refer to [START_REF] Varian | The Economics of Information Technology[END_REF] for pointers to recent work in the area, and e.g. [START_REF] Gong | The economics of layered networks[END_REF] for the analysis of a point problem, specifically the impact of layering), pricing models and incentive mechanisms for resource allocation that align the interests of possibly selfish users with the interests of the network architect [START_REF] Shenker | Pricing in computer networks: Reshaping the research agenda[END_REF][START_REF] Mackie-Mason | Pricing the Internet[END_REF][START_REF] Davie | Network dimensioning, service costing, and pricing in a packet switched environment[END_REF], and the economics of security (refer to [START_REF] Anderson | The economics of information security: A survey and open questions[END_REF] for a recent survey and references, also [START_REF] Camp | Pricing security[END_REF] and the proceedings of the Workshop on economics of information security).

Using cyberinsurance as a way to handle the residual risk after computer security investments have been made was proposed more than 10 years ago [START_REF] Lai | Endorsments, licensing, and insurance for distributed systems services[END_REF] and but popularized only recently [START_REF] Schneier | Insurance and the computer industry[END_REF][START_REF] Schneier | Computer security: It's the economics, stupid[END_REF]. The authors in [START_REF] Kesan | The economic case for cyberinsurance[END_REF][START_REF] Kesan | Cyberinsurance as a market-based solution to the problem of cybersecurity:a case study[END_REF] make the economic case for insurance, arguing that insurance results in higher security investments (and therefore increases the global level of safety), that it encourages standards for best practices to be at the socially optimum level, and that it solves a market failure (namely the absence of risk transfer opportunity), and they see the emerging market for cyberinsurance as a validation of the case they make in the paper.

The market for cyberinsurance started in the late 90's with insurance policies offered by security software companies partnering with insurance companies as packages (software + insurance). The insurance provided a way to highlight the (supposedly high) quality of the security software being sold, and to deliver a "total" risk management solution (risk INRIA reduction + residual risk transfer), rather than the customary risk reduction-only solution (combined with risk retaining); see for examples solutions offered by Cigna (Cigna's Secure System Insurance) or Counterpane/Lloyd's of London [14]. More recently, insurance companies started offering standalone products (e.g. AIG's NetAdvantage [1]). Reference [START_REF] Majuca | The evolution of cyberinsurance[END_REF] provides a recent and comprehensive description of the history and the current state of computer insurance.

A challenging problem for Internet insurance companies is caused by correlations between risks, which makes it difficult to spread the risk across customers -a sizeable fraction of worm and virus attacks, for example, tend to propagate rapidly throughout the Internet and inflict correlated damages to customers worldwide [START_REF] Zou | Code Red worm propagation modeling and analysis[END_REF][START_REF] Saniford | The top speed of flash worms[END_REF]. Furthermore, entities in the Internet face interdependent risks, i.e. risks that depend on the behavior of other entities in the network (e.g. whether or not they invested in security solutions to handle their risk), and thus the reward for a user investing in security depends on the general level of security in the network. Correlated and interdependent risks have only very recently started being addressed in the literature. Reference [START_REF] Böhme | Cyber-insurance revisited[END_REF] considers insurance with correlations in the extreme case of a monoculture (a system of uniform agents) with correlated Bernouilli risks and argues that the strong correlation of claims in that case may indeed hinder the development of a cyberinsurance industry. Subsequent work in [START_REF] Böhme | Models and measures for correlation in cyber-insurance[END_REF] argues that correlations are actually two-tiered and supports the argument with honeypot data. One tier represents the correlations across risks within an entity such as a corporation, the other tier represents the correlations of risks across independent entities. Correlations in the different tiers impact the insurance process in different ways: the tier-1 correlations will then influence an entity to seek insurance, whereas the tier-2 correlations influence the price of the premium set by the insurance company.

Reference [START_REF] Kunreuther | Interdependent security: the case of identical agents[END_REF] considers the situation of agents faced with interdependent risks and proposes a parametric game-theoretic model for such a situation. In the model, agents decide whether or not to invest in security and agents face a risk of damage which depends on the state of other agents. They show the existence of two Nash equilibria (all agents invest or none invests), and suggest that taxation or insurance would be ways to provide incentives for agents to invest (and therefore reach the "good" Nash equilibrium), but they do not analyze the interplay between insurance and security investments. The model in [START_REF] Kunreuther | Interdependent security: the case of identical agents[END_REF] is extended in [START_REF] Hofmann | Internalizing externalities of loss prevention through insurance monopoly[END_REF] to include compulsory insurance offered by a monopolistic insurer. The results show that a compulsory monopoly may lead to a higher social level of security investment if the insurer engages in premium discrimination, and that the level of investment is higher in a compulsory insurance monopoly market than in competitive insurance markets. Our work also builds on the model of [START_REF] Kunreuther | Interdependent security: the case of identical agents[END_REF], and considers a single insurance market. However, our work differs from [START_REF] Kunreuther | Interdependent security: the case of identical agents[END_REF] and [START_REF] Hofmann | Internalizing externalities of loss prevention through insurance monopoly[END_REF] because it models all three desirable characteristics of an Internet-like network, namely correlated risks, interdependent agents, and a general model of a network with a flexible and controllable topology, and it derives general results about the state of the network and the behavior of the agents, with and without insurance being available.

Next, we describe the classical expected utility model for a single agent and present the standard results about premium computation and the interplay between self-protection and insurance.

3 Insurance and self-protection: basic concepts

Classical model for insurance

The classical expected utility model is named thus because it considers agents that attempt to maximize some kind of expected utility function u. In this paper, we assume that agents are rational and that they are risk averse, i.e. their utility function is concave (see Proposition 2.1 in [START_REF] Gollier | The Economics of Risk and Time[END_REF]). Risk averse agents dislike mean-preserving spreads in the distribution of their final wealth. For example, consider an agent given the choice between i) a bet of either receiving $100 or nothing, both with a probability of 50%, or ii) receiving some amount with certainty. A risk averse agent would rather accept a payoff of less than $50 with probability 1 than the bet.

We denote by w 0 the initial wealth of the agent. The risk premium π is the maximum amount of money that one is ready to pay to escape a pure risk X, where a pure risk X is a random variable such that E[X] = 0. The risk premium corresponds to an amount of money paid (thereby decreasing the wealth of the agent from w 0 to w 0 -π) which covers the risk; hence, π is given by the following equation:

u[w 0 -π] = E[u[w 0 + X]]
The risk premium plays a fundamental role in the theory of insurance and we refer to [START_REF] Gollier | The Economics of Risk and Time[END_REF] for a detailed account of the economics of insurance. We will focus in the rest of this section on the interplay between insurance and self-protection investments in networks. To simplify our analysis, we consider simple one-period probabilistic models for the risk, in which all decisions and outcomes occur in a simultaneous instant; we do not consider dynamic aspects such as first mover advantage or the time value of money.

Each agent faces a potential loss ℓ, which we take in this paper to be a fixed (nonrandom) value. We denote by p the probability of loss or damage. There are two possible final states for the agent: a good state, in which the final wealth of the agent is equal to its initial wealth w 0 , and a bad state in which the final wealth is w 0 -ℓ. If the probability of loss is p > 0, the risk is clearly not a pure risk. The amount of money m the agent is ready to invest to escape the risk is given by the equation:

pu[w 0 -ℓ] + (1 -p)u[w 0 ] = u[w 0 -m] (2)
As shown by Mossin [START_REF] Mossin | Aspects of rational insurance purchasing[END_REF], we clearly have m > pℓ, as described on Figure 1 1 : We can actually relate m to the risk premium defined above. Note that the left hand-side of Equation ( 2) can be written as

E[u[w 0 -pℓ -X]] with X defined by P(X = ℓ(1 -p)) = p w0 w0 -ℓ pℓ m u Figure 1: Computation of m and P(X = -pℓ) = 1 -p. Hence we have E[w 0 -pℓ -X] = u[w 0 -pℓ -π[p]] where π[p]
denotes the risk premium when the loss probability equals p. Therefore:

m = pℓ + π[p].
The term pℓ corresponds to what is referred to as the fair premium, i.e. the premium which exactly matches expected loss (for which process U defined in Equation 1 has exactly zero drift). On the left hand side of the equation, m corresponds to the maximum acceptable premium for full coverage: if an insurer makes a proposition for full coverage at a cost of ℘, then the agent will accept the contract if ℘ ≤ m. From the insurer's perspective, the premium ℘ depends on the distribution of the loss (here p and ℓ) and should be greater than pℓ in order for the random process U defined in Equation (1) to have a positive drift. Hence the existence of a market for insuring this risk is a function of u, ℓ, p.

A model for self-protection

Investments in security involve either self-protection (to reduce the probability of a loss) and/or self-insurance (to reduce the size of a loss). For example, intrusion detection and prevention systems are mechanisms of self-protection. Denial-of-service mitigation systems, traffic engineering solutions, overprovisioning, and public relations companies are mechanisms of self-insurance (overprovisioning to reduce the impact of overloads or attacks, PR firms to reduce the impact of security attack on a company stock price with crafty messages to investors). It is somewhat artificial to distinguish mechanisms that reduce the probability of a loss from mechanisms that reduce the size of the loss, since many mechanisms do both. Nevertheless, we focus on self-protection mechanisms only.

We first look at the problem of optimal self-protection without insurance. We denote by c the cost of self-protection and by p[c] the corresponding probability of loss. We expect larger investments in self-protection to translate into a lower likelyhood of loss, and therefore we reasonably assume that p is a non-increasing function of c. The optimal amount of selfprotection is given by the value c * which maximizes

p[c]u[w 0 -ℓ -c] + (1 -p[c])u[w 0 -c]. (3)
Note that if ℓ increases, then c * has to increase too because the gain caused by self-protection is increased. Consider the simple case where the loss probability is either one of two values, namely p

[c] = p + if c < c t or p[c] = p -if c > c t , with p + > p -.
The optimization problem (3) above becomes easy to solve: indeed, the optimal expenditure is either 0 or c t .

In the rest of the paper, we assume that the choice of an agent regarding self-protection is a binary choice: either the agent does not invest, or it invests c t which will be denoted c for simplicity. If the agent does not invest, the expected utility is

p + u[w 0 -ℓ]+(1-p + )u[w 0 ]; if the agent invests, the expected utility is p -u[w 0 -ℓ -c] + (1 -p -)u[w 0 -c].
Using the derivation in the subsection above, we see that these quantities are equal to u[w 0 -p + ℓ -

π[p + ]] and u[w 0 -c -p -ℓ -π[p -]
], respectively. Therefore, the optimal strategy is for the agent to invest in self-protection only if the cost for self-protection is less than the threshold

c < (p + -p -)ℓ + π[p + ] -π[p -] =: c sp 1 . (4)
Recall that pℓ + π[p] corresponds to the amount of money the agent is willing to pay to escape a loss of probability p. Hence we can interpret Equation ( 4) as follows:

c sp 1 + p -+ π[p -]ℓ = p + + π[p + ]ℓ.
The left hand term corresponds to the scenario where the agent invests c 1 in self-protection (and hence lower the probability of loss to p -) and then pays p -+ π[p -]ℓ to escape the risk.

The right hand term is exactly the amount he would pay to escape the original risk of a loss of probability p + . Clearly the first scenario is preferred when c < c sp 1 which corresponds exactly to Equation (4).

Interplay between insurance and self -protection

We now analyze the impact that the availability of insurance has on the level of investment in self-protection chosen by the agent.

Consider first the case when Equation ( 4) is satisfied, namely it is best for the agent to invest in self-protection. We assume that the agent can choose between insurance with full coverage and self-protection. Clearly if the agent choose full coverage, it will not spend money on self-protection since losses are covered and the utility becomes

u f c = u[w 0 -℘].
In the case of optimal self-protection, the utility has been computed above: 4) holds. Hence the optimal strategy for the agent is to use insurance if

u sp = u[w 0 - c -p -ℓ -π[p -]] since Equation (
c sp 4 := ℘ -p -ℓ -π[p -] < c (5)
-c -p -ℓ + γ] (I, N ) u[w 0 -p + ℓ -γ] (N I, S) (1 -p -)u[w 0 -c] + p -u[w 0 -c -ℓ] (N I, N ) (1 -p + )u[w 0 ] + p + u(w 0 -ℓ)
Note that because of Equation ( 4), we must have

℘ < p + ℓ + π[p + ]. (6)
If Equation ( 4) does not hold, then it is best for the agent to not invest in self-protection, and the choice is between insurance and no self-protection. It is easy to see that if Equation ( 6) holds, then the premium is low enough and the optimal strategy is to pay for insurance. In summary: if Equation ( 5) holds, the optimal strategy is to pay for full coverage insurance and not invest in self-protection. Otherwise, the optimal strategy is to invest in self-protection and not pay for insurance.

The combination of insurance and self-protection raises the problem of what is referred to as moral hazard. Moral hazard occurs when agents or companies covered by insurance take fewer measures to prevent losses from happening, or maybe even cause the loss (and reap the insurance benefits from it). Indeed, if the premium does not depend on whether or not the agent invests in self-protection, then insurance becomes a negative incentive to self-protection. A known solution to the problem is to tie the premium to the amount of selfprotection (and, in practice, for the insurer to audit self-protection practices and the level of care that the agent takes to prevent the loss) [START_REF] Ehrlich | Market insurance, self-insurance, and self-protection[END_REF]. Note that this condition is necessary to avoid moral hazard: if the premium is not designed as above, then self-protection will be discouraged by insurance and we would observe either a large demand for insurance and a small demand for self-protection, or the converse.

A natural candidate for such a desirable premium proposed in [START_REF] Ehrlich | Market insurance, self-insurance, and self-protection[END_REF] is the fair premium:

℘[S] = p -ℓ, and, ℘[N ] = p + ℓ.
With this premium, insurance co-exists with an incentive to invest in self-protection [START_REF] Ehrlich | Market insurance, self-insurance, and self-protection[END_REF].

To agents that do not invest in prevention, the insurer may offer a premium ℘[N ] + γ, where γ ≥ 0 denotes a premium penalty (loading). To agents that invest in prevention, the insurer may offer a premium ℘[S] -γ, where γ denotes a premium rebate.

The utility for all possible cases is summarized in Table 1. The first colum denotes the choice made by an agent. It is denoted by the pair (U, V ), where U = I means that the agent pays for insurance and U = N I otherwise, and V = S means that the agent invests in self-protection and V = N otherwise.

Note that for any non-negative value of γ, the strategy (I, S) always dominates the strategy (N I, S). Now for (I, S) to dominate (I, N ), we need c < (p + -p -)ℓ + 2γ.

For (I, S) to dominate (N I, N ), we need

c < (p + -p -)ℓ + γ + π[p + ].
The results are summarized in Figure 2. The grayed area corresponds to the space where the parameter c is such that not investing in self-protection is optimal (N ). Each row corresponds to a different case:

• The first row N I corresponds to the case when no insurance is available;

• The second row I corresponds to the case when a full coverage insurance is available with premium ℘ satisfying Equation ( 6);

• The third row I, γ = 0 corresponds to the case when a full coverage insurance is available with premium defined as above with γ = 0 (as in [START_REF] Ehrlich | Market insurance, self-insurance, and self-protection[END_REF]);

• The fourth row I, γ > 0 is the same as the row above but with a strictly positive value of γ.

The pair (I, S) in row 3, for example (resp. the pair (N I, S) in row 2) means that insurance and self-protection (resp. no insurance and self-protection) is the optimal strategy for those values of c. We have

c sp 1 = (p + -p -)ℓ + π[p + ] -π[p -], c sp [γ] = (p + -p -)ℓ + γ + min(γ, π[p + ]), c sp 3 = (p + -p -)ℓ, c sp 4 = ℘ -p -ℓ -π[p -].
This concludes the description of results from classical insurance theory. Next, we consider a 2-agent model (the first step towards the general network model), with correlated and interdependent risks. We first describe known results in the absence of insurance, then present our new results, with insurance available to agents. Recall that interdependent risks are risks that depend on the behavior of other entities in the network (e.g. whether or not they invested in security solutions to handle their risk).

In the presence of interdependent risks, the reward for a user investing in self-protection depends on the general level of security in the network.

Interdependent risks for 2 agents

Reference [START_REF] Kunreuther | Interdependent security: the case of identical agents[END_REF] was the first to introduce a model for interdependent security (IDS), specifically a model for two agents faced with interdependent risks, and it proposed a parametric game-theoretic model for such a situation. In the model, agents decide whether or not to invest in security and agents face a risk of damage which depends on the state of other agents. As in Section 3 above, the decision is a discrete choice: an agent either invests or does not invest in self-protection. We assume that loss can happen in two ways: it can either be caused directly by an agent (direct loss), or indirectly via the actions of other agents (indirect loss). We assume that the cost of investing in self-protection is c, and that a direct loss can be avoided with certainty when the agent has invest in self-protection. The cost of protection should not exceed the possible loss, hence 0 ≤ c ≤ ℓ. Four possible states of final wealth of an agent result: without protection, the final wealth is w 0 in case of no loss and w 0 -ℓ in case of loss. If an agent invests in protection, its final wealth is w 0 -c in case of no loss and w 0 -c -ℓ in case of loss.

Consider now a network of 2 agents sharing one link. There are four possible states denoted by (i, j), where i, j ∈ {S, N }, i describes the decision of agent 1 and j the decision of agent 2, S means that the agent invests in self-protection, and N means that the agent does not invest in self-protection. We examine the symmetric case when the probability of a direct loss is p for both agents, where 0 < p < 1. Knowing that one agent has a direct loss, the probability that a loss is caused indirectly by this agent to the other is q, where 0 ≤ q ≤ 1. Hence q can be seen as a probability of contagion. To completly specify the model, we assume that direct losses and contagions are independent events. The matrix p(i, j) describing the probability of loss for agent 1, in state (i, j), is given in Table 2.

The simplest situation of interdependent risks, involving only two agents, can be analyzed using a game-theoretic framework. We now derive the payoff matrix of expected utilities for agents 1 and 2. If both agents invest in self-protection, the expected utility of each agent is u[w 0 -c]. If agent 1 invests in self-protection (S) but not agent 2 (N ), then

S u[w 0 -c] (1 -pq)u[w 0 -c] + pqu[w 0 -c -ℓ] N (1 -p)u[w 0 ] + pu[w 0 -ℓ] pu[w 0 -ℓ] + (1 -p)(pqu[w 0 -ℓ] + (1 -pq)u[w 0 ])
agent 1 is only exposed to the indirect risk pq from agent 2. Thus the expected utility for agent 1 is (1 -pq)u[w 0 -c] + pqu[w 0 -c -ℓ] and the expected utility for agent 2 is (1 -p)u[w 0 ] + pu[w 0 -ℓ]. If neither agent invests in self-protection, then both are exposed to the additional risk of contamination from the other. Therefore, the expected utilities for both agents are pu[w 0 3 summarizes these results and gives the expected utility of agent 1 for the different choices of the agents.

-ℓ] + (1 -p)(pqu[w 0 -ℓ] + (1 -pq)u[w 0 ]). Table
Assuming that both agents decide simultaneously whether or not to invest in selfprotection, there is no possibility to cooperate. For investment in self-protection (S) to be a dominant strategy, we need

u[w 0 -c] ≥ (1 -p)u[w 0 ] + pu[w 0 -ℓ] and (1 -pq)u[w 0 -c] + pqu[w 0 -c -ℓ] ≥ pu[w 0 -ℓ] + (1 -p)(pqu[w 0 -ℓ] + (1 -pq)u[w 0 ])
With the notations introduced earlier, the inequalities above become:

c ≤ pℓ + π[p] =: c 1 , c ≤ p(1 -pq)ℓ + π[p + (1 -p)pq] -π[pq] =: c 2 .
In most practical cases, one expects that c 2 < c 1 , and the tighter second inequality reflects the possibility of damage caused by other agent. Therefore, the Nash equilibrium for the game is in the state (S, S) if c ≤ c 2 and (N, N ) if c > c 1 . If c 2 < c ≤ c 1 , then both equilibria are possible and the solution to the game is indeterminate. More precisely, the situation corresponds to a coordination game. Overall, we have the following:

• if c < c 2 : the optimal strategy is to invest in self-protection;

• if c 2 < c < c 1 : if the other user in the network do invest in self-protection, then the optimal strategy is to invest in self-protection;

• if c 1 < c: then the optimal strategy is to not invest in self-protection.

IDS and mandatory insurance

We now build on the model and the results above and introduce our more general model in which insurance is available to the agents (the ability to self-protect remaining available, of course). We assume that a full coverage insurance is mandatory. As noted in Section 3.3, if we want to avoid a moral hazard problem, the insurance premium has to be tied to the

INRIA

(I, S) u[w 0 -c -pqℓ + γ] (I, N ) u[w 0 -(p + pq(1 -p))ℓ -γ] (N I, S) u[w 0 -c] (1 -pq)u[w 0 -c] + pqu[w 0 -c -ℓ] (N I, N ) (1 -p)u[w 0 ] + pu[w 0 -ℓ] pu[w 0 -ℓ] + (1 -p)(pqu[w 0 -ℓ] + (1 -pq)u[w 0 ])
amount spent on self-protection. Note that the probability of loss for agent 1 depends on the choice made by agent 2, however it seems necessary (at least from a practical point of view) to link the premium applied to agent 1 to the behavior of agent 1 only. A possible choice (which is profit-making for the insurance) is to choose for each decision of the agent the fair 'worst case' premium as follows,

℘[S] = pqℓ, ℘[N ] = (p + (1 -p)pq)ℓ.
In this case the payoff for the agent is deterministic:

if it chooses S, the payoff is u[w 0 -c - pqℓ]; if it chooses N , the payoff is u[w 0 -(p + (1 -p)pq)ℓ]. Hence the dominant strategy is to invest in self-protection only if c < p(1 -pq)ℓ =: c 3 < c 2 .
As in the single-agent case, we see that even if the premium is related to the amount spent on self-protection, insurance is a negative incentive for protection. To correct this effect, we apply the same strategy as in the single-agent case, namely we engage in premium discrimination. Let γ denote the premium rebate for agents investing in security and the premium penalty for agents not investing. Clearly, in our situation, the new condition for S to be the dominant strategy becomes:

c < p(1 -pq)ℓ + 2γ =: c 3 [γ].
In particular for 2γ = p 2 qℓ, we have c 3 [γ] = c 1 and then for any c < c 1 , the strategy S is dominant. Note that we have assumed a symmetric penalty and rebate but our result easily extends to the general case.

IDS and full coverage insurance

We now consider the situation where the choice is left to the agent as to whether to invest in self-protection and/or in a full coverage insurance. We assume that the premiums are those given above (with penalty/rebate). We summarize the payoff for agent 1 in Table 4, depending on the investment of agent 2 and for the four possible choice of the agent (notations are the same as in Section 3.3). We denote

c 4 [γ] := p(1 -pq)ℓ + π[p + (1 -p)pq] + γ.

RR n°6329

Let us examine the situation depending on the behavior of agent 2. If agent 2 invests in self-protection (denoted by S 2 ), then for c < c 1 , agent 1 chooses to invest in self-protection also and not otherwise.

Consider now the case when agent 2 does not invest in self-protection (denoted by

N 2 ). Then if c < min(c 3 [γ], c 4 [γ]) := c[γ]
, the optimal strategy is (I, S). Note that we have c 4 [γ] ≥ c 2 for all values of γ and we proved above that we can choose γ such that c Figure 3 summarizes the results. As in Figure 2, the grayed area corresponds to the space where the parameter c is such that not investing in self-protection is optimal (N ). Each row corresponds to a different case:

3 [γ] ≥ c 2 . Therefore it is possible to tune γ such that c[γ] ≥ c 2 . 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1
• The first row N I corresponds to the case when no insurance is available;

• The second row I corresponds to the case when a full coverage insurance is compulsory;

• The third row I, γ, S 2 corresponds to the case when a full coverage insurance is available with premium defined as above with γ > 0 and agent 2 is in state S;

• The fourth row I, γ, N 2 is the same as the row above but when agent 2 is in state N .

The pair (I, S) in row 4, for example (resp. the pair (N I, S) in row 3) means that the combination of insurance and self-protection (resp. no insurance and self-protection) is the optimal strategy for those values of c. We have (in decreasing order)

c 1 = pℓ + π[ℓ], c[γ] = min(c 3 [γ], c 4 [γ]), with, c 3 [γ] = p(1 -pq)ℓ + 2γ, c 4 [γ] = p(1 -pq)ℓ + π[p + (1 -p)pq] + γ, c 2 = p(1 -pq)ℓ + π[p + (1 -p)pq] -π[pq], c 3 = p(1 -pq)ℓ.

INRIA

Note in particular that when insurance with discrimination is available, (S, S) becomes a Nash equilibrium for c < c[γ] with c[γ] > c 2 for well-chosen values of γ. In such a case, insurance is an incentive to self-protection. The main features present in the single-agent (Figure 2) are also present in the 2-agent case (Figure 3). However a new feature comes into play because of the interdependent risks, namely the existence of a new threshold c 2 which takes into account the externality modeled by the possible contagion via the other agent. We see that the externalities due to the interdependent risks tend to lower the incentive for investing in self-protection. However, we also see that the effect of the insurance (with discrimination) is unaffected these interdependent risks. As a result the relative efficiency of insurance is higher in the presence of externalities.

Next, we extend the results of this section to the general case of a network of n users.

Interdependent security and insurance on a network

Many phenomena in the Internet can be modeled using epidemic spreads through a network, e.g. the propagation of worms, of email viruses, of alerts and patches, of routing updates, etc. (e.g. see [START_REF] Zou | Code Red worm propagation modeling and analysis[END_REF][START_REF] Vojnovic | On the race of worms, alerts and patches[END_REF] for models of worm propagation). As a result, there is now a vast body of literature on epidemic spreads over a network topology from an initial set of infected nodes to susceptible nodes (see for example [START_REF] Ganesh | The effect of network topology on the spread of epidemics[END_REF]). The 2-agent model intoduced in the previous section, although very basic, fits in that framework: the probability for an agent to be infected initially is p and the probability of contagion is q. It is then natural to consider the following extension: agents are represented by vertices of a graph G = (V, E), and

• if an edge (i, j) ∈ E then contagion is possible between agents i and j with probability q; otherwise the probability of contagion is zero;

• if agent i invests in protection, no direct loss can occur; otherwise direct loss occurs with probability p;

• the contagion process of agent i is independent of the process of agent j and independent of the direct loss process (characterized by p).

As in the previous section, we are considering one-period model. The quantity of interest here is the value of the damages due to the epidemics. We assume that the damage caused by the epidemics is ℓ for all agents that have been infected. The topology of the underlying graph G is arbitrary. Note that G might not correspond to a physical network. For example, when modeling the spread of email viruses, we might choose a graph which reflects the social network of the email users. When modeling insurance against BGP router failures, we might choose a complete graph; indeed, BGP routers belonging to the top level ASes of the Internet form a completely connected graph, and internal BGP routers are often organized in a set of completely connected route reflectorsthus, the beahvior of routers failing and recovering is, in a first approximation, modeled as the spread of an epidemic on a complete graph [START_REF] Coffman | Network resilience: exploring cascading failures within BGP[END_REF].

In the rest of this section, we consider two important classes of topologies: the complete graph and the star-shaped graph.

The complete graph network

We assume here that G is a complete graph with n vertices, namely a graph with an edge between each pair of nodes. By symmetry, it is possible to define P S k , the probability that an agent investing in security experiences a loss when k users (among the n -1 remaining ones) also invest in security. Similarly, we define P N k to denote the probability that a user not investing in security experiences a loss when k other users invest in security. Then we define:

c n k = P N k ℓ + π[P N k ] -P S k ℓ -π[P S k ]. (7)
We have of course P N k ≥ P S k and we assume that the utility function u (which defines the function π) is such that c n k+1 ≥ c n k for all 0 ≤ k ≤ n -1. Note that in the single user case, n = 1, we have c 1 0 = c sp 1 defined in Equation ( 4). In the 2-user case, we have c 2 1 = c 1 and c 2 0 = c 2 defined in Section 4.1.

Results of Section 4 extend in a straightforward manner to the n-users case as follows:

• if c < c n 0 : the optimal strategy is to invest in self-protection;

• if c n k-1 < c < c n k : if at least k users in the network do invest in self-protection, the optimal strategy is to invest in self-protection;

• if c n n-1 < c: the optimal strategy is to not invest in self-protection. It is natural to define the following function:

k n [c] = inf{k, c n k > c}.
k n [c] is an important threshold value, because of the following:

• if the number of initial users investing in self-protection is less than k n [c], then all users will chose not to invest in self-protection;

• if the number of initial users investing in self-protection is greater than k n [c], then all users will chose to invest in self-protection.

Concerning the effect of an insurance, we only consider the case where the insurance company engages in premium discrimination. It is then easy to extend the results above with the function c n [γ] such that if c < c n [γ], then the optimal strategy is to invest in self-protection regardless of the behavior of the other users. Furthermore, c n [γ] is a nondecreasing function of γ that tends to infinity as γ tends to infinity.

In summary, we have the following simple situation: in presence of insurance, the optimal strategy for all users is to invest in self-protection as soon as the cost of self-protection is low enough c < c n [γ].

INRIA

The situation is simple, but artificially so, because we are considering a purely symmetric case.

Let us now consider the more general case of heterogeneous users, when the cost of selfprotection is different for different users (but the effect of self-protection is not changed). Intuitively, users with low cost will tend to invest in prevention while those with high cost will not. We now derive the threshold ĉ for which users with cost less than ĉ invest in self-protection whereas others do not. We denote by F n [c] the fraction of users with selfprotection cost lower than c. Let s j denote the different possible values for the cost of self-protection. The function F n is piecewise constant and increases at each s j by the fraction of nodes having a cost of s j .

Consider now the following dynamic process where all the users of the network are initially in state (N ), i.e. they have not invested in self-protection. First consider the users with minimal cost, say s 0 . If s 0 < c n 0 , then nF n [s 0 ] users switch and invest in self-protection. If s 0 > c n 0 , all users stay in state (N ) and the process terminates. Next, consider the users still in state (N ) with minimal cost s 1 . If s 1 < c n nF n [s0] , then all those users will switch and invest in self-protection. Note that the condition above can be written as k[s 1 ] < nF n [s 0 ]. Iterating the procedure, we see that the threshod is characterized by the following equation

ĉ = min{s j-1 , F n [s j-1 ] < k n [s j ] n }. (8)
In order to analyze the impact of insurance on the dynamics of the process above, we approximate the n users by a continuum of heterogeneous users. Showing that this meanfield approximation is appropriate for large values of n is outside the scope of this paper and requires a scaling of the probabilities p and q as n tends to infinity. However we present the following heuristic argument. We denote by F When adding assurance, the same argument as above holds, but this time we can start with an initial condition where all users with cost less than c[γ] invest in self-protection. Hence the final equilibrium will be given by ĉ

[γ] = min{c > c[γ], F [c] = k[c]}.
Note that for any value of γ, we have ĉ[γ] ≥ ĉ which shows that more users choose to invest in self-protection in presence of insurance. Furthermore, if

F [c] = k[c] (9)
has only one solution, then ĉ[γ] = max{c[γ], ĉ}.

The results above show that insurance increases the adoptability of self-protection investments for all users in the network. We finish this section by showing that the increase in adoptability can be quite dramatic, non-linearly so as a function of γ.

Assume now that the population is divided into classes of users with roughly the same cost for self-protection and consider the case when users corresponding to the class with the smallest cost invest in self-protection. If the size of that population (of users in the class with the smallest cost) is small, it might not be sufficient to stimulate the second class2 to invest in self-protection too. Then the dynamics of the 'contagion process' for self-protection described earlier is stopped and only a small fraction of the total population has invested in security in the end. It turns out that insurance can be of significantly help to boost the contagion process, as we explain next. Note that the function F is approximately a step function and Equation [START_REF] Cheswick | Firewalls and Internet Security: Repelling the Wily Hacker[END_REF] might have more than one solution, see Figure 4. The scenario described above corresponds to the case when the system is stuck

ĉ c[γ] ĉ[γ] F [c]
Figure 4: Non linearity of insurance at the low value ĉ. We see that if we tune the parameter γ in order for c[γ] to reach the second fixed point, then the system will naturally increase its level of self-protection up to the next fixed point ĉ[γ] >> c[γ] > ĉ as described on Figure 4. In other words, insurance gives exactly the right incentive to a small portion of the population that would have not invested without insurance, so that the switch to self-protection of that fraction of the population induces a larger fraction of the population to invest also. In summary, insurance provides incentives for a small fraction of the population to invest in self-protection, which in turn induces the rest of the population to invest in selfprotection as well, leading to the desirable state where all users in the network are self-protected. Furthermore, the parameter γ provides a way to multiply the benefits of insurance, by lowering the initial fraction of the self-protected population needed to reach the desirable state.

The star-shaped network

The study of star-shaped networks is of interest for several reasons. First, star-shaped networks exhibit a new tipping point phenomenom not observed in fully connected networks. Also, the spreading behavior of a large class of power law graphs, of particular interest given their relevance to Internet topology graphs [START_REF] Doyle | The "robust yet fragile" nature of the Internet[END_REF], is determined by the spreading behavior of stars embedded within them [START_REF] Ganesh | The effect of network topology on the spread of epidemics[END_REF]. Consider a star-shaped network, with n + 1 nodes, where the only edges are (0, i), with i = 1, . . . , n. The same analysis as in previous section applies but we have to deal separately with the root and the leaves.

First consider the root. The probability of a loss when exactly k leaves invest in selfprotection is given (depending on the state (S) or (N ) of the root) by

P N k = p + (1 -p)(1 -(1 -pq) n-k )), P S k = (1 -(1 -pq) n-k )).
One can then do the same analysis as in previous section and compute the function k n [c] that would give the threshold for the number of leaves required to invest in self-protection in order for the root to also invest. Note that as n tends to infinity, the probability of loss tends to one as soon as the number of leaves not investing in self-protection tends to infinity. In this case, the agent at the root is sure to be contamined by a leaf regardless of its choice regarding investment in self-protection. As a result, it will not invest in self-protection.

We next consider the leaves. An important remark is that for a leave to be infected the root must also be infected. First assume that the root is in state (N ). The probabilities of loss when there are k other leaves investing in self-protection are:

P N k = p + (1 -p)qP N k [n], P S k = qP N k [n],
where P N k [n] is the quantity computed above but for a network of size n. Now assume that the root is in state (S), the corresponding probabilities are given by (with the same notations)

P N k = p + (1 -p)qP S k-1 [n], P S k = qP S k-1 [n].
It is easy to see that P N k -P S k ≤ P N k -P S k , and as a result, we have

cn+1 k ≤ cn+1 k , (10)
where the parameters cn+1 k and cn+1 k are defined as in Equation ( 7) with the appropriate probabilities. The incentive for a leaf to invest in self-protection is higher when the root already invested in self-protection. We observe a tipping point phenomenom. More generally, we expect that nodes with low connectivity (i.e. low degree) will imitate the node with the highest connectivity they are connected to. The heuristic argument (which is captured in our model by [START_REF] Chen | Software diversity for information security[END_REF]) is that the node with the largest connectivity an agent is connected to will be the main source of contagion (in term of probability). Hence, if that node invests in self-protection, it substantially decreases the probability of contagion of the agent and, as in the 2-agent case, that action increases the reward of investing in self-protection.

Discussion

The results presented in this paper show that insurance provides significant benefits to a network of users facing correlated, interdependent risks. Essentially, insurance is a powerful mechanism to promote network-wide changes and lead all users of the network to the desirable state where they all invest in self-protection. The benefits of insurance are such that we believe that the development of insurance products and markets, and the large scale deployment of insurance in the Internet is likely, if not inevitable.

However, we have found that mentioning "Internet insurance" rapidly attracts comments about the uniqueness of the Internet environment, and in particular questions around the estimation of damages. The assumption is that estimating damages in the Internet is so difficult and fraught with peril that insurance is not inevitable at all, but rather destined to remain a niche or an oddity. We first note that reliably estimating damages is indeed an important task because it controls the profit (or the ruin) of the insurer and the incentives for agents to invest in self-protection. Also, it is true that quantifying risks for a good or an optimal premium value is difficult because the assets to be protected are intangible (such as a company stock price), because damages might be visible only long after a threat or an attack was identified (e.g. "easter egg" with timed virus or exploit in a downloaded piece of software), because risk changes can occur quickly (zero day attacks), and because evaluating the insurability (and the level of protection) of new and existing customers is likely to be a complex and time intensive task. However, the insurance industry has been dealing with those problems for decades or centuries in other areas of life -if warships can be insured in time of war (as indeed they can), it is difficult to argue convincingly that Internet risks and damages absolutely cannot be insurable.

Questions about damage estimation might also be the wrong questions. A better question might be how to help insurers do a better job, i.e. how the current Internet might be used to help insurers do a better job of estimating damages, and how to evolve the Internet or create a new design that will make that job even easier. One way suggested by the discussion above on estimating damages would be to develop metrics and techniques for that purpose. Another, related way is to develop metrics for the security related issues of interest. Some interesting propositions have been made in that sense, for example the "cost to break" metric described in [START_REF] Schechter | Quantitatively differentiating system security[END_REF], but we believe this is an important area ripe for further research (see also [START_REF] Aspnes | Towards better definitions and measures of Internet security[END_REF]). Note that metrics of interest are not limited to "core security" metrics such as cost to break, but need to be developed for all relevant activities facing threats and risks; for example, metrics quantifying risks and damages to insure against BGP router failures (mentioned in Section 5).

INRIA

The deployment of insurance raises architectural issues. In particular, insurance relies heavily on authenticated, audited, or certified assesments of various kinds to avoid fraud and other issues such as the moral hazard examined ealier in the paper. This argues, along with security metrics, for effective and efficient ways to measure and report those metrics. It might also require better traceability of events. But it will certainly impact other mechanisms and protocols in other, subtle ways. Consider for example a peering point between operators, some of which are insured, others of which are not. It is very reasonable to imagine that, in such a situation, policies would be developed to route traffic from insured peers (or neighbors in general) differently than traffic from un-insured peers -a latter-day QoS routing (where QoS means Quality of Security, of course).

Overall, we believe that Internet insurance, in addition to providing the benefits shown in the paper, offers a fertile area of reflection and research. It is a timely area, as well, given the recent activities around clean-slate Internet design. We propose to add to the slate a broader definition of risk management, which includes the transfer of risk in addition to only the mitigation of risk, and explore the benefits and consequences of that broader definition.

Conclusion

It is a fact that some security technologies are ignored while others are widely adopted (SSH vs. telnet, HTTP vs. HTTPS, etc). The decision to adopt a particular security technology is highly sensitive to the cost of adaption of that technology [START_REF] Chan | Modeling adoptability of secure BGP protocols[END_REF]. One of our main contributions in this paper is to develop and solve simple models that explain why economically rational entities would prefer a relatively insecure system to a more secure one, that show that the adoption of security investments follows a threshold or tipping point dynamics, and that insurance is a powerful incentive mechanism to "push the mass of users over the threshold". Our second main contribution is to ask the question: if economics plays an essential role in the deployment of security technologies then why deny ourselves the use of economics tools? Our purpose here is not to shift the problem of network security to the marketplace but to give a new perspective on Internet security. Finally, we argue that network algorithms and network architecture might be designed or re-evaluated according to their ability to help implement desirable economic policies (such as the deployment of insurance) and help achieve desirable economic goals.

Figure 2 :

 2 Figure 2: Full coverage vs self-protection -single user case

INRIA Table 2 :

 2 Probability of states S N S p[S, S] = 0 p[S, N ] = pq N p[N, S] = p p[N, N ] = p + (1 -p)pq 4 Interdependent security and insurance: the 2-agent case

Figure 3 :

 3 Figure 3: Full coverage vs self-protection

  [c] the distribution function of the users and by k[c] the limit of k n [c]/n, both of which now continuous. Then Equation (8) reduces to ĉ = min{c, F [c] = k[c]}.

Table 1 :

 1 Utility with insurance and self-protection -single user case (I, S) u[w 0

INRIA

Table 3 :

 3 Expected payoff matrix for agent 1 agent 2: S agent 2: N

Table 4 :

 4 Expected payoff matrix with insurance and self-protection agent 2: S agent 2: N

RR n°6329

The concavity of u, i.e. risk-aversion is essential here.INRIA

i.e. the next set of users with the second smallest cost of self-protection INRIA


Carlos Alberto Raposo
email: raposo@ufsj.edu.br

Mauricio Sepulveda
email: mauricio@ing-mat.udec.cl

Ducival Octavio Vera
email: overa@ubiobio.cl

Carvalho Pereira

Mauro Lima Santos

Mauricio Sepúlveda

Villagrán ‡ Ducival
email: ducival@oi.com.br

Carvallo Pereira

Solution and Asymptotic Behavior for a Nonlocal Coupled System of Reaction-Diffusion

Keywords: Coupled system of reaction-diffusion, The Faedo-Galerkin method, Asymptotic Behavior, Numerical Methods. Mathematics Subject Classification: 35K57, 35B35

come   L'archive ouverte pluridisciplinaire

Introduction

We consider the reaction-diffusion coupled system in parallel way via parameter α > 0 of the form

u t -a(l(u)) ∆u + f (u -v) = α (u -v) in Ω × (0, T ) (1.1) v t -a(l(v)) ∆v -f (u -v) = α (v -u) in Ω × (0, T ) (1.2) u = v = 0 in ∂Ω × (0, T ) (1.3)
u(x, 0) = u 0 (x) in Ω (1.4) v(x, 0) = v 0 (x) in Ω (1.5) where u = u(x, t) and v = v(x, t) are real valued functions. Ω is a bounded domain of R n , ∂Ω is the boundary of Ω of class C 2 . f : R → R and a : R → R are Lipschitz continuous functions with a(ξ) ≥ m > 0. l : L 2 (Ω) → R is a continuous linear form.

For the last several decades, various types of equations have been employed as some mathematical model describing physical, chemical, biological and ecological systems. Among them, the most successful and crucial one is the following model of semilinear parabolic partial differential equation, called the reactiondiffusion system

∂u ∂t -D ∆u -f (u) = 0, (1.6)
where f : R n → R n is a nonlinear function, and D is an n × n real matrix of diffusion. This reactiondiffusion model is obtained by combining the system of nonlinear ordinary differential equations called the reaction system du dt -f (u) = 0, (1.7)

and the system of linear partial differential equation called the diffusion system ∂u ∂t -D ∆u = 0.

(1.8)

In 1998, L. A. F. Oliveira [START_REF] Oliveira | On reaction-diffusion system[END_REF] considered the reaction-diffusion system where D was a n × n real matrix and f : R n → R n is a C 2 function. He studied the exponential decay for some cases. Except for some publications on the subject, such as the searching for traveling waves solutions and some problem in ecology and epidemic theory, most of authors assume that diffusion matrix D is diagonal, so that the coupling between the equations are present only on the nonlinearity of the reaction term f. However, cross-diffusion phenomena are not uncommon (see [START_REF] Capasso | Global attractivity for reaction-diffusion system. The case of nondiagonal matrices[END_REF] and references therein) can be treated as equations like in which D is not even diagonalizable. In 1997, M. Chipot and B. Lovat [START_REF] Chipot | Some remarks on nonlocal elliptic and parabolic problems, Nonlinear Analysis[END_REF] studied the existence and uniqueness of the solutions for non local problems u t -a Ω u(x, t) dx ∆u = f (x, t) in Ω × (0, T ) (1.9) u(x, t) = 0 on ∂Ω × (0, T ) (1.10) u(x, 0) = u 0 (x) on Ω (1.11) where Ω is a bounded open subset in R n n ≥ 1 with smooth boundary ∂Ω. T is some arbitrary time. a is some function from R into (0, +∞). This problem arises in various situations, for instance u could describe the density of a population(for instance of bacteria) subject to spreading. The diffusion coefficient a is then supposed to depend on the entire population in the domain rather than on the local density i. e. moves are guided by considering the global state of the medium. They proven the following result:

Theorem 1.1. Let T 0 > 0, u 0 ∈ L 2 (Ω), u 0 ≥ 0, u 0 ≡ 0. Let a be a continuous function positive in a neighborhood of Ω u 0 dx. Then for f ∈ L 2 ([0, T ] : H -1 (Ω)) there exists 0 < T ≤ T 0 and u solution to (1.9)-(1.11) such that u ∈ L 2 ([0, T ] : H 1 0 (Ω)) ∩ C 0 ([0, T ] : L 2 (Ω)), u t ∈ L 2 ([0, T ] : H -1 (Ω)), < u t , v > + a Ω u dx (∇u • ∇v) =< f, v > ∀ v ∈ H 1 0 (Ω), a. e. t ∈ [0, T 0 ]
where (∇u • ∇v) = Ω ∇u • ∇v dx.

In 2005, S. D. Menezes [START_REF] Menezes | Remarks on weak solution for a nonlocal parabolic problem[END_REF], give a simple extension of the result obtained by M. Chipot and B. Lovat [START_REF] Chipot | Some remarks on nonlocal elliptic and parabolic problems, Nonlinear Analysis[END_REF], considering a = a(l(u)), f = f (u) continuous functions. Indeed, they studied the existence, uniqueness and periodic solution for the following parabolic problem

u t -a(l(u))∆u + f (u) = h in Ω × (0, T ) (1.12) u(x, t) = 0 on ∂Ω × (0, T ) (1.13) u(x, 0) = u 0 (x) on Ω (1.14)
where Ω is a bounded open subset in R n , n ≥ 1 with smooth boundary ∂Ω. T is some arbitrary time.

l : L 2 (Ω) → R is a nonlinear form, h ∈ L 2 (0, T : H -1 (Ω))
and T > 0 is some fixed time. This problem is nonlocal in the sense that the diffusion coefficient is determined by a global quantity. This kind of problems, besides its mathematical motivation because of presence of the nonlocal term a(l(u)), arises from physical situations related to migration of a population of bacteria in a container in which the velocity of migration -→ ν = a ∇u depends on the global population in a subdomain Ω ′ ⊂ Ω given by a = a( Ω ′ u dx). For more information [START_REF] Chipot | Some remarks on nonlocal elliptic and parabolic problems, Nonlinear Analysis[END_REF] and reference therein.

This article is concerned with to prove the existence, uniqueness and the exponential decay of the system (1.1)-(1.5) using the energy method. The method of energy consists of to use appropriate multipliers to build a functional of Lyapunov, in this direction we prove that for this types of materials where the energy, that can flow from one part to another, is strong enough to produce exponential decay for the solution of the coupled system.

This paper is organized as follows. Before the main result, in section 2 we briefly outline the notation and terminology to be used subsequently. In the section three we prove the existence and uniqueness of solution, in the section four we prove the exponential decay of solution of the system. Finally, numerical evidence corroborating our theoretical results is given in section five. In this paper, we prove the following two theorem:

Theorem 1.2. Let (u 0 , v 0 ) ∈ L 2 (Ω) × L 2
(Ω) and 0 < T < +∞, where the time T depends only |u 0 | L 2 (Ω) and |v 0 | L 2 (Ω) . If (2.6)-(2.9) holds, then there is at most one solution of (1.1)-(1.5) in L 2 (0, T :

H 1 0 (Ω)) ∩ C([0, T ) : L 2 (Ω)) × L 2 (0, T : H 1 0 (Ω)) ∩ C([0, T ) : L 2 (Ω)) with initial data (u(x, 0), v(x, 0)) = (u 0 , v 0 ).
Theorem 1.3. Let (u, v) be a solution of system (1.1)-(1.5) given by the theorem 1.2, then there exist positives constants C and η, such that

E(t) ≤ C E(0) e -η t .
(1.15)

Preliminaries

In this work we consider the reaction-diffusion coupled system in parallel way via parameter α > 0 as

u t -a(l(u)) ∆u + f (u -v) = α (u -v) in Ω × (0, T ) (2.1) v t -a(l(v)) ∆v -f (u -v) = α (v -u) in Ω × (0, T ) (2.2)
u = v = 0 in ∂Ω × (0, T ) (2.3) u(x, 0) = u 0 (x) in Ω (2.4) v(x, 0) = v 0 (x) in Ω (2.5)
where Ω is a bounded domain of R n , ∂Ω is the boundary of Ω of class C 2 . f : R → R is a Lipschitz continuous function, that is, there exists M 1 > 0 such that

|f (s) -f (t)| ≤ M 1 |s -t|, ∀ s, t ∈ R. (2.6)
a : R → R is a Lipschitz continuous function, that is, there exists M 2 > 0 such that

|a(s) -a(t)| ≤ M 2 |s -t|, ∀ s, t ∈ R. (2.7) with a(ξ) ≥ m > 0, ∀ ξ ∈ R (2.8)
and

l : L 2 (Ω) → R is a continuous linear form.
(2.9)

In the system, the distributed spring coefficient is coupled by the terms α (u -v) and α (v -u). In this sense the Energy can flow from one part to another through this parameter α.

By < • , • > we will represent the duality pairing between X and X ′ , X ′ being the topological dual of the space X, We represent by H m (Ω) the usual Sobolev space of order m, by H m 0 (Ω) the closure of Throughout this paper c is a generic constant, not necessarily the same at each occasion(it will change from line to line), which depends in an increasing way on the indicated quantities.

C ∞ 0 (Ω) in H m (Ω),
We take the initial conditions as following

(u 0 (x), v 0 (x)) ∈ L 2 (Ω) × L 2 (Ω).
(2.10)

We denote the potential energy associated to this system by

E(t) = 1 2 Ω |u| 2 + |v| 2 dx.
(2.11)

Existence and Uniqueness of a local solution

In this section, we will prove that for (u 0 , v 0 ) ∈ L 2 (Ω) × L 2 (Ω) there exists a unique solution of (2.6)-(2.9) in L 2 (0, T :

H 1 0 (Ω)) ∩ C([0, T ) : L 2 (Ω)) × L 2 (0, T : H 1 0 (Ω)) ∩ C([0, T ) : L 2 (Ω))
where the time T depends only |u 0 | L 2 (Ω) and |v 0 | L 2 (Ω) . We make use of Faedo-Galerkin approximation for to prove the existence of weakly solutions. We write the system (2.1)-(2.5) in the following form,

u t -a(l(u)) ∆u = -f (u, v) + g(u, v) in Q = Ω × (0, T ) (3.1) v t -a(l(v)) ∆v = f (u, v) -g(u, v) in Q = Ω × (0, T ) (3.2) u = v = 0 on ∂Ω × (0, T ) (3.3) u(x, 0) = u 0 (x) in Ω (3.4) v(x, 0) = v 0 (x) in Ω (3.5)
where we denote

f (u, v) ≡ f (u -v) and g(u, v) ≡ α (u -v). Theorem 3.1(Existence). Let (u 0 , v 0 ) ∈ L 2 (Ω) × L 2 (Ω) and 0 < T < +∞. If (2.6
)-(2.9) holds, then there exists (u, v) solution of (3.1)-(3.5) such that

(u, v) ∈ L 2 (0, T : H 1 0 (Ω)) ∩ C([0, T ) : L 2 (Ω)) × L 2 (0, T : H 1 0 (Ω)) ∩ C([0, T ) : L 2 (Ω)) (3.6) (u t , v t ) ∈ L 2 (0, T : H -1 (Ω)) × L 2 (0, T : H -1 (Ω)) (3.7) d dt (u, h 1 ) + a(l(u)) Ω ∇u • ∇h 1 dx = - Ω f (u, v) h 1 dx + Ω g(u, v) h 1 dx (3.8)
for all h 1 ∈ H 1 0 (Ω), where (3.8) must be understood as an equality in D ′ (0, T ).

d dt (v, h 2 ) + a(l(v)) Ω ∇v • ∇h 2 dx = Ω f (u, v) h 2 dx - Ω g(u, v) h 2 dx (3.9)
for all h 2 ∈ H 1 0 (Ω), where (3.9) must be understood as an equality in D ′ (0, T ).

Proof. i) Approximate problem: Let {w j } j∈N be a Hilbertian basis of H 1 0 (Ω) (cf. H. Brezis, [ 3]
). For each j = 1, 2, 3, . . . represent by V j , the subspace of H 1 0 (Ω) generated by {w 1 , w 2 , . . . , w j }. The approximate problem, associated with (3.1)-(3.5), consists of to find u j , v j ∈ V j such that

(u ′ j , h 1 ) -a(l(u j ))(∆u j , h 1 ) = -(f (u j , v j ), h 1 ) + (g(u j , v j ), h 1 ), ∀ h 1 ∈ V j (3.10) (v ′ j , h 2 ) -a(l(v j ))(∆v j , h 2 ) = (f (u j , v j ), h 2 ) -(g(u j , v j ), h 2 ), ∀ h 2 ∈ V j (3.11) u j (0) = u 0j → u 0 strongly in L 2 (Ω) (3.12) v j (0) = v 0j → v 0 strongly in L 2 (Ω) (3.13) Let h 1 = w i (x) and h 2 = w i (x) for i = 1, . . . , j, then in (3.10)-(3.13) we have for θ kj , φ kj ∈ C ∞ (Ω) j k=1 θ ′ kj (t)w k (x), w i (x) -a l j k=1 θ kj (t)w k (x) ∆ j k=1 θ kj (t)w k (x), w i (x) = -f j k=1 θ kj (t)w k (x), j k=1 φ kj (t)w k (x) , w i (x) + g j k=1 θ kj (t)w k (x), j k=1 φ kj (t)w k (x) , w i (x)
and

j k=1 φ ′ kj (t)w k (x), w i (x) -a l j k=1 φ kj (t)w k (x) ∆ j k=1 φ kj (t)w k (x), w i (x) = f j k=1 θ kj (t)w k (x), j k=1 φ kj (t)w k (x) , w i (x) -g j k=1 θ kj (t)w k (x), j k=1 φ kj (t)w k (x) , w i (x)
that is,

θ ′ kj (t) -λ k a(l(u j )) θ kj (t) = -(f (u j , v j ), w i ) + (g(u j , v j ), w i ) (3.14) φ ′ kj (t) -λ k a(l(v j )) φ kj (t) = (f (u j , v j ), w i ) -(g(u j , v j ), w i ). (3.15)
ii) Approximate solutions: We will just work with the equation (3.14). For (3.15) the result is similar. For i, k = 1, . . . , j in (3.14), we have the following system

     θ ′ 1j θ ′ 2j . . . θ ′ jj      =    λ 1 a(l(u j )) 0 . . . 0 λ j a(l(u j ))         θ 1j θ 2j . . . θ jj      -      (f, w 1 ) (f, w 2 ) . . . (f, w j )      +      (g, w 1 ) (g, w 2 ) . . . (g, w j )      that is, X ′ = F (X, t) (3.16) X(0) = X 0 (3.17)
where F (X, t) = A X + B and X 0 = [α 1j , α 2j , . . . , α jj ] T . The system (3.16)-(3.17) is equivalent to system of ordinary differential equations of first order. Let us show that the system (3.16)-(3.17) is in the conditions of Carathéodory's theorem.

Claim. For fixed X, we will show that A and B are measurable in t.

In fact, we observed that the matrix A is formed for the elements λ k a(l(u j )) with k = 1, 2, . . . , j.

Since l is a lineal and continuous form and the operator a is continuous, then the composition a(l(u j )) is also continuous; therefore λ k a(l(u j )) is continuous for k = 1, 2, . . . , j and then A is measurable in t.

On the other hand, let us observe that B is formed by the elements (f (u j , v j ), w i ) and (g(u j , v j ), w i ), with i = 1, 2, . . . , j. Since f and g are continuous and w i ∈ H 1 0 (Ω), we concludes that B is continuous and therefore measurable.

Claim. For fixed t, we will show that F is continuous in X.

In fact, notice that B is continuous in X, because B is constant in relation to X. For continuity of A X, is enough we verify that A is continuous in X. Let k X = θ kj (k = 1, 2, . . . , j) be the projection R j -→ R and σ(X) = k X w k . For each t fixed, as

u j (t) = j k=1 θ kj (t) w k , we can consider the function X -→ a(l(u j )) = a l j k=1 θ kj (t) w k = a l j k=1 k X w k .
Since A is lineal combination of continuous functions, proceeds that A is continuous in X, hence the function F (X, t) is continuous in X.

Claim. Let K be a compact of D = E × [0, T ], where E = {X ∈ R j×1 : ||X|| R j×1 ≤ δ, δ > 0}.
We will show that exists a real function m r (t), integrable in [0, T ], so that

||F (X, t)|| R j×1 ≤ m r (t), ∀ (X, t) ∈ D.
In fact, we denote by || • || p q the norm of maximum in R pq . But F (X, t) = A X + B, then

||F (X, t)|| j×1 ≤ ||A|| j×j ||X|| j×1 + ||B|| j×1 . Since X ∈ E, we have ||X|| j×1 ≤ δ. Then ||F (X, t)|| j×1 ≤ δ ||A|| j×j + ||B|| j×1 .
Notice that λ k a(l(u j )) are continuous functions, hence

||A|| j×j ≤ C (C > 0).
On the other hand, for the matrix B we have

|(f (u j , v j ), w i )| ≤ |f (u j , v j )| |w i | = |f (u j , v j )|, |(g(u j , v j ), w i )| ≤ |g(u j , v j )| |w i | = |g(u j , v j )|. Thus ||F (X, t)|| j×1 ≤ δ C + |f (u j , v j )| + |g(u j , v j )| ≡ m r (t), where m r (t) is integrable in [0, T ].
Hence, the system (3.16)-(3.17) satisfies the conditions of Carathéodory, and then exists {u j (t), v j (t)} ∈ [0, t j ) × [0, t j ), t j < T 0 .

We now have to establish an estimate that permits to extend the solution {u j (t), v j (t)} to the whole interval [0, T ].

From now on, {C i } i=1...7 , will denote positive constants, independents of j and t.

iii) A priori estimates: We put h 1 = u j and h 2 = v j in the equations (3.10) and (3.11) respectively, we have

(u ′ j , u j ) -a(l(u j )) (∆u j , u j ) = -(f (u j , v j ), u j ) + (g(u j , v j ), u j ) (3.18) (v ′ j , v j ) -a(l(v j )) (∆v j , v j ) = (f (u j , v j ), u j ) -(g(u j , v j ), u j ). (3.19)
Using the boundary condition and the first Green's identity we have

(-∆u j , u j ) = Ω (-∆u j ) u j dx = Ω ∇u j • ∇u j dx = |∇u j | 2 = ||u j || 2 .
Then, we can write (3.18) as 1 2

d dt |u j | 2 + a(l(u j )) ||u j || 2 = -(f (u j , v j ), u j ) + (g(u j , v j ), u j ). (3.20)
In a similar way we can write (3.19) as 1 2

d dt |v j | 2 + a(l(v j )) ||v j || 2 = (f (u j , v j ), u j ) -(g(u j , v j ), u j ). ( 3
d ds |u j | 2 + |v j | 2 ds + t 0 a(l(u j )) ||u j || 2 + a(l(v j )) ||v j || 2 ds = 0,
that is,

|u j (t)| 2 + |v j (t)| 2 + 2 t 0 a(l(u j )) ||u j || 2 + a(l(v j )) ||v j || 2 ds = |u j (0)| + |v j (0)|.
In the last identity, using (2.6) and (2.8) we obtain

|u j (t)| 2 + |v j (t)| 2 + 2m t 0 ( ||u j || 2 + ||v j || 2 ) ds ≤ |u j (0)| 2 + |v j (0)| 2 . (3.22) Since u j (0) → u 0 and v j (0) → v 0 strongly in L 2 (Ω) follows that |u j (0)| 2 + |v j (0)| 2 ≤ C. Hence |u j (t)| 2 + |v j (t)| 2 ≤ C.
From where follows that u j (t) and v j (t) are bounded in L ∞ (0, T : L 2 (Ω)). Thus,

t 0 (||u j || 2 + ||v j || 2 ) ds ≤ C,
then u j (t) and v j (t) are limited in L 2 (0, T : H 1 0 (Ω)).

From (3.10)-(3.11), we have that

u ′ j = a(l(u j ))∆u j -f (u j , v j ) + g(u j , v j ) ∈ H -1 (Ω) v ′ j = a(l(v j ))∆v j + f (u j , v j ) -g(u j , v j ) ∈ H -1 (Ω).
Notice that -a(l(u j )) ∆u j defines an element of H -1 (Ω), given by the duality -a(l(u j )) ∆u j , h 1 = a(l(u j ))

Ω ∇u j • ∇h 1 dx, ∀ h 1 ∈ H 1 0 (Ω).
In a similar way we have

-a(l(v j )) ∆v j , h 2 = a(l(v j )) Ω ∇v j • ∇h 2 dx, ∀ h 2 ∈ H 1 0 (Ω).
Using the fact that -a(l(u j )) ∆u j , -a(l(v j )) ∆v j ∈ H -1 (Ω), the dual of H 1 0 (Ω), then they are lineal and continuous forms and therefore both are bounded.

Since u j , v j ∈ L 2 (0, T : L 2 (Ω)), then Ω |f (u j , v j )| dx ≤ Ω β |u j -v j | dx ≤ Ω β (|u j | + |v j |) dx ≤ C Ω |u j | 2 dx 1/2 + Ω |v j | 2 dx 1/2 and Ω |g(u j , v j )| dx = Ω α |u j -v j | dx ≤ Ω α ( |u j | + |v j | ) dx ≤ C Ω |u j | 2 dx 1/2 + Ω |v j | 2 dx 1/2 . Therefore f (u j , v j ), g(u j , v j ) ∈ L 2 (0, T : L 2 (Ω)) ֒→ L 1 (0, T : L 2 (Ω))
and we concludes that u ′ j , v ′ j are bounded in L 2 (0, T : H -1 (Ω)). iv) Passage to the limit: We have that

u j , v j are bounded in L ∞ (0, T : L 2 (Ω)) ∩ L 2 (0, T : H 1 0 (Ω)), (3.23) u ′ j , v ′ j are bounded in L 2 (0, T : H -1 (Ω)). (3.24)
Now, due the corollary of Banach-Alouglu (See [START_REF] Rudin | Functional Analysis[END_REF], p. 66), we can extract subsequences of u j k ≡ u j and v j k ≡ v j (which we denote with the same symbol) so that

u j ⋆ ⇀ u weak star in L ∞ (0, T : L 2 (Ω)) (3.25) v j ⋆ ⇀ v weak star in L ∞ (0, T : L 2 (Ω)) (3.26) u j ⇀ u weak in L 2 (0, T : H 1 0 (Ω)) (3.27) v j ⇀ v weak in L 2 (0, T : H 1 0 (Ω)). (3.28) Consequently T 0 (u j , h 1 ) dt -→ T 0 (u, h 1 ) dt, ∀ h 1 ∈ L ∞ (0, T : L 2 (Ω)) (3.29) T 0 (u j , h 1 ) dt -→ T 0 (u, h 1 ) dt, ∀ h 1 ∈ L 2 (0, T : H 1 0 (Ω)) (3.30) T 0 (v j , h 2 ) dt -→ T 0 (v, h 2 ) dt, ∀ h 2 ∈ L ∞ (0, T : L 2 (Ω)) (3.31) T 0 (v j , h 2 ) dt -→ T 0 (v, h 2 ) dt, ∀ h 2 ∈ L 2 (0, T : H 1 0 (Ω)) (3.32) For (3.24) it proceeds u ′ j ⇀ u ′ weakly in L 2 (0, T : H -1 (Ω)) (3.33) v ′ j ⇀ v ′ weakly in L 2 (0, T : H -1 (Ω)). (3.34)
On the other hand,

H 1 0 (Ω) c ֒→ L 2 (Ω) ֒→ H -1 (Ω)
. By Lions-Aubin's compactness Theorem [START_REF] Lions | Quelques méhodes de résolution des problemes aux limites non linéaires[END_REF] follows that

u j -→ u strongly in L 2 (0, T : L 2 (Ω)) (3.35) v j -→ v strongly in L 2 (0, T : L 2 (Ω)). ( 3
(u j (t), w(t)) dt -→ T 0 (u(t), w(t)) dt, ∀ w ∈ L 1 (0, T : L 2 (Ω)) T 0 (v j (t), w(t)) dt -→ T 0 (v(t), w(t)) dt, ∀ w ∈ L 1 (0, T : L 2 (Ω)).
We choose w = θ h 1 with θ ∈ D(0, T ), h 1 ∈ L 2 (Ω) and we will show that for all θ ∈ D(0, T ) and for all

h 1 ∈ L 2 (Ω), T 0 [ (g(u j , v j ), h 1 ) -(g(u, v), h 1 ) ] θ(t) dt -→ 0.
Let T be a positive number such that supp(θ) ⊂ [0, T ], then

T 0 [ (g(u j , v j ), h 1 ) -(g(u, v), h 1 ) ] θ(t) dt = T 0 (g(u j , v j ) -g(u, v), h 1 ) θ(t) dt.
Hence, by straightforward calculations

T 0 (g(u j , v j ) -g(u, v), h 1 ) θ(t) dt ≤ T 0 Ω |g(u j , v j ) -g(u, v)| |h 1 | |θ(t)| dx dt = T 0 Ω |α (u j -v j ) -α (u -v)| |h 1 | |θ(t)| dx dt = T 0 Ω |α (u j -u) -α (v j -v)| |h 1 | |θ(t)| dx dt ≤ T 0 Ω ( α |u j -u| + α |v j -v| ) |h 1 | |θ(t)| dx dt.
Using L 2 (0, T : L 2 (Ω)) ֒→ L 1 (0, T : L 2 (Ω)) and the Cauchy-Schwartz inequality we obtain

T 0 (g(u j , v j ) -g(u, v), h 1 ) θ(t) dt ≤ C T 0 Ω |u j -u| 2 dx 1/2 Ω |h 1 | 2 dx 1/2 dt + C T 0 Ω |v j -v| 2 dx 1/2 Ω |h 1 | 2 dx 1/2 dt.
Applying the Cauchy-Schwartz inequality and considering the convergence (3.35) we obtain

C T 0 Ω |u j -u| 2 dx 1/2 Ω |h 1 | 2 dx 1/2 dt ≤ C T 0 Ω |u j -u| 2 dxdt 1/2 T 0 Ω |h 1 | 2 dxdt 1/2 < ε.
In a similar way using the convergence (3.36) we have

C T 0 Ω |v j -v| 2 dx 1/2 Ω |h 1 | 2 dx 1/2 dt ≤ C T 0 Ω |v j -v| 2 dx dt 1/2 T 0 Ω |h 1 | 2 dx dt 1/2 < ε.
Therefore we have

T 0 (g(u j , v j ) -g(u, v), h 1 ) θ(t) dt < ε.
Performing similar calculations we can to prove that

T 0 (f (u j , v j ) -f (u, v), h 1 ) θ(t) dt < ε.
We will show now, that for every θ ∈ D ([0, T ]) and for every

h 1 ∈ L 2 (Ω) a(l(u j )) T 0 Ω ∇u j • ∇h 1 θ(t) dt -→ a(l(u)) T 0 Ω ∇u • ∇h 1 θ(t) dt. (3.37)
It is enough we prove that

a(l(u j )) -→ a(l(u)) in L 2 (0, T ), ∀ T > 0. (3.38)
Since a is continuous, we will show that l(u j ) -→ l(u) strongly in L 2 (0, T ).

(3.39)

In fact, because

T 0 |l(u j ) -l(u))| 2 dt = T 0 |l(u j -u)| 2 dt ≤ C 6 T 0 |u j -u| 2 dt < ε.
This last one result, is consequence of the convergence (3.35).

These convergence implies that we can take limits in the approximate problem (3.11)-(3.15), and then to verify the conditions (i), (ii), (iii) and (iv) of the Theorem. Now, we will make verify of the initial data and we prove the uniqueness of solutions. Using the result of regularity we have that

u, v ∈ C 0 (0, T : L 2 (Ω)) (3.40)
In this form, makes sense we calculate u(0) e v(0). Let us consider θ ∈ C 1 (0, T : R), with θ(0) = 1 and θ(T ) = 0. Since the convergence (3.29) we have

T 0 (u ′ j , z) θ dt -→ T 0 (u ′ , z) θ dt, z ∈ L 2 (Ω). (3.41)
Performing integration by parts in (3.41) we have

-(u j (0), z) - T 0 (u j , z) θ ′ dt -→ -(u(0), z) - T 0 (u, z) θ ′ dt. (3.42)
Using the convergence (3.29) in (3.42) we have (u j (0), z) -→ (u(0), z), for all z ∈ H 1 0 (Ω). But u j (0) converges strong for u 0 in L 2 (Ω), consequently weak in L 2 (Ω). Therefore (u j (0), z) -→ (u 0 , z), for all z ∈ H 1 0 (Ω). From uniqueness of the limit we have (u(0), z) -→ (u 0 , z), for all z ∈ H 1 0 (Ω). Thus, u(0) = u 0 . In a similar way we can prove that v(0) = v 0 .

To finish this section we will show the uniqueness of solution.

Theorem 3.2(Uniqueness). Let (u 0 , v 0 ) ∈ L 2 (Ω) × L 2 (Ω) and 0 < T < +∞, where the time T depends only

|u 0 | L 2 (Ω) and |v 0 | L 2 (Ω) . If (2.6)-(2.9) holds, then there is at most one solution of (3.1)-(3.5) in L 2 (0, T : H 1 0 (Ω)) ∩ C([0, T ) : L 2 (Ω)) × L 2 (0, T : H 1 0 (Ω)) ∩ C([0, T ) : L 2 (Ω)) with initial data (u(x, 0), v(x, 0)) = (u 0 , v 0 ). Proof. Assume that (u 1 , v 1 ), (u 2 , v 2 ) in L 2 (0, T : H 1 0 (Ω)) ∩ C([0, T ) : L 2 (Ω)) × L 2 (0, T : H 1 0 (Ω)) ∩ C([0, T ) : L 2 (Ω)) are two solutions of (3.1)-(3.5) with u t , v t in L 2 (0, T : H -1 (Ω)) × L 2 (0, T : H -1 (Ω))
, so all integrations below are justified and with the same initial data, in fact (u 1 -u 2 )(x, 0) ≡ 0 and (u 2 -u 2 )(x, 0) ≡ 0. Then

d dt u 1 -a(l(u 1 )) △u 1 = -f (u 1 , v 1 ) + g(u 1 , v 1 ) d dt v 1 -a(l(v 1 )) △v 1 = f (u 1 , v 1 ) -g(u 1 , v 1 )
and

d dt u 2 -a(l(u 2 )) △u 2 = -f (u 2 , v 2 ) + g(u 2 , v 2 ) d dt v 2 -a(l(v 2 )) △v 2 = f (u 2 , v 2 ) -g(u 2 , v 2 ).
Then

d dt (u 1 -u 2 , h 1 ) + a(l(u 1 )) Ω ∇u 1 • ∇h 1 dx -a(l(u 2 )) Ω ∇u 2 • ∇h 1 dx = -(f (u 1 , v 1 ) -f (u 2 , v 2 ), h 1 ) + (g(u 1 , v 1 ) -g(u 2 , v 2 ), h 1 ), ∀ h 1 ∈ H 1 0 (Ω) d dt (v 1 -v 2 , h 2 ) + a(l(v 1 )) Ω ∇v 1 • ∇h 2 dx -a(l(v 2 )) Ω ∇v 2 • ∇h 2 dx = (f (u 1 , v 1 ) -f (u 2 , v 2 ), h 2 ) -(g(u 1 , v 1 ) -g(u 2 , v 2 ), h 2 ), ∀ h 2 ∈ H 1 0 (Ω). Using that g(u 1 , v 1 ) -g(u 2 , v 2 ) = α (u 1 -u 2 ) -α (v 1 -v 2 ) and that f (u, v) = f (u -v) we have d dt (u 1 -u 2 , h 1 ) + a(l(u 1 )) Ω ∇u 1 • ∇h 1 dx -a(l(u 2 )) Ω ∇u 2 • ∇h 1 dx = -(f (u 1 -v 1 ) -f (u 2 -v 2 ), h 1 ) + α (u 1 -u 2 , h 1 ) -α (v 1 -v 2 , h 1 ), ∀ h 1 ∈ H 1 0 (Ω) d dt (v 1 -v 2 , h 2 ) + a(l(v 1 )) Ω ∇v 1 • ∇h 2 dx -a(l(v 2 )) Ω ∇v 2 • ∇h 2 dx = (f (u 1 -v 1 ) -f (u 2 -v 2 ), h 2 ) -α (u 1 -u 2 , h 2 ) + α (v 1 -v 2 , h 2 ), ∀ h 2 ∈ H 1 0 (Ω).
On the other hand, let

h 1 = u 1 -u 2 and h 2 = v 1 -v 2 we obtain d dt |u 1 -u 2 | 2 + a(l(u 1 )) Ω ∇u 1 • ∇(u 1 -u 2 ) dx -a(l(u 2 )) Ω ∇u 2 • ∇(u 1 -u 2 ) dx = -(f (u 1 -v 1 ) -f (u 2 -v 2 ), u 1 -u 2 ) + α |u 1 -u 2 | 2 -α (v 1 -v 2 , u 1 -u 2 )
and

d dt |v 1 -v 2 | 2 + a(l(v 1 )) Ω ∇v 1 • ∇(v 1 -v 2 ) dx -a(l(v 2 )) Ω ∇v 2 • ∇(v 1 -v 2 ) dx = (f (u 1 -v 1 ) -f (u 2 -v 2 ), v 1 -v 2 ) -α (u 1 -u 2 , v 1 -v 2 ) + α |v 1 -v 2 | 2 .
Hence

d dt |u 1 -u 2 | 2 + a(l(u 1 )) ||u 1 || 2 + a(l(u 2 )) ||u 2 || 2 + [ a(l(u 1 )) -a(l(u 2 ) ] Ω ∇u 1 • ∇u 2 dx ≤ |f (u 1 -v 1 ) -f (u 2 -v 2 )| |u 1 -u 2 | + α |u 1 -u 2 | 2 + α |v 1 -v 2 | |u 1 -u 2 | and d dt |v 1 -v 2 | 2 + a(l(v 1 )) ||v 1 || 2 + a(l(v 2 )) ||v 2 || 2 + [ a(l(v 1 )) -a(l(v 2 ) ] Ω ∇v 1 • ∇v 2 dx ≤ |f (u 1 -v 1 ) -f (u 2 -v 2 )| |v 1 -v 2 | + α |u 1 -u 2 | |v 1 -v 2 | + α |v 1 -v 2 | 2 .
Using (2.6)-(2.9) and the Young inequality we have

d dt |u 1 -u 2 | 2 + m ||u 1 || 2 + m ||u 2 || 2 ≤ M 1 | l(u 1 ) -l(u 2 ) | ||u 1 || ||u 2 || + M 3 |(u 1 -u 2 ) -(v 1 -v 2 )| |u 1 -u 2 | + α |u 1 -u 2 | 2 + α 2 |v 1 -v 2 | 2 + α 2 |u 1 -u 2 | 2 ≤ M 1 C 1 |u 1 -u 2 | ||u 1 || ||u 2 || + M 3 |u 1 -u 2 | 2 + M 3 |u 1 -u 2 | |v 1 -v 2 | + 3 2 α |u 1 -u 2 | 2 + α 2 |v 1 -v 2 | 2 ≤ m 2 ||u 1 || 2 + M 2 1 C 2 1 2m ||u 2 || 2 |u 1 -u 2 | 2 + M 3 |u 1 -u 2 | 2 + M 3 2 |u 1 -u 2 | 2 + M 3 2 |v 1 -v 2 | 2 + 3 2 α |u 1 -u 2 | 2 + α 2 |v 1 -v 2 | 2 ≤ m 2 ||u 1 || 2 + M 2 1 C 2 1 2m ||u 2 || 2 |u 1 -u 2 | 2 + 3 2 (M 3 + α) |u 1 -u 2 | 2 + 1 2 (M 3 + α) |v 1 -v 2 | 2 and d dt |v 1 -v 2 | 2 + m ||v 1 || 2 + m ||v 2 || 2 ≤ M 2 | l(v 1 ) -l(v 2 ) | ||v 1 || ||v 2 || + M 3 |(u 1 -u 2 ) -(v 1 -v 2 )| |v 1 -v 2 | + α 2 |u 1 -u 2 | 2 + α 2 |v 1 -v 2 | 2 + α |v 1 -v 2 | 2 ≤ M 2 C 2 |v 1 -v 2 | ||v 1 || ||v 2 || + M 3 |v 1 -v 2 | 2 + M 3 |u 1 -u 2 | |v 1 -v 2 | + 3 2 α |v 1 -v 2 | 2 + α 2 |u 1 -u 2 | 2 ≤ m 2 ||v 1 || 2 + M 2 2 C 2 2 2m ||v 2 || 2 |v 1 -v 2 | 2 + M 3 |v 1 -v 2 | 2 + M 3 2 |v 1 -v 2 | 2 + M 3 2 |u 1 -u 2 | 2 + 3 2 α |v 1 -v 2 | 2 + α 2 |u 1 -u 2 | 2 ≤ m 2 ||v 1 || 2 + M 2 2 C 2 2 2m ||v 2 || 2 |v 1 -v 2 | 2 + 3 2 (M 3 + α) |v 1 -v 2 | 2 + 1 2 (M 3 + α) |u 1 -u 2 | 2 Then d dt |u 1 -u 2 | 2 + m 2 ||u 1 || 2 + m ||u 2 || 2 ≤ M 2 1 C 2 1 2m ||u 2 || 2 |u 1 -u 2 | 2 + 3 2 (M 3 + α) |u 1 -u 2 | 2 + 1 2 (M 3 + α) |v 1 -v 2 | 2 (3.43) and d dt |v 1 -v 2 | 2 + m 2 ||v 1 || 2 + m ||v 2 || 2 ≤ M 2 2 C 2 2 2m ||v 2 || 2 |v 1 -v 2 | 2 + 3 2 (M 3 + α) |v 1 -v 2 | 2 + 1 2 (M 3 + α) |u 1 -u 2 | 2 (3.44) Adding (3.43) with (3.44) we obtain d dt ( |u 1 -u 2 | 2 + |v 1 -v 2 | 2 ) + m 2 ||u 1 || 2 + m ||u 2 || 2 + m 2 ||v 1 || 2 + m ||v 1 || 2 ≤ M 2 1 C 2 1 2m ||u 2 || 2 |u 1 -u 2 | 2 + M 2 2 C 2 2 2m ||v 2 || 2 |v 1 -v 2 | 2 + 2 (M 3 + α) |u 1 -u 2 | 2 + 2 (M 3 + α) |v 1 -v 2 | 2 = M 2 1 C 2 1 2m ||u 2 || 2 + 2 (M 3 + α) |u 1 -u 2 | 2 + M 2 2 C 2 2 2m ||v 2 || 2 + 2 (M 3 + α) |v 1 -v 2 | 2
We define

ϕ(t) = M 2 1 C 2 1 2m ||u 2 || 2 + 2 (M 3 + α) , ξ(t) = M 2 2 C 2 2 2m ||v 2 || 2 + 2 (M 3 + α) .
Thus,

d dt |u 1 -u 2 | 2 + |v 1 -v 2 | 2 ≤ ϕ(t) |u 1 -u 2 | 2 + ξ(t)|v 1 -v 2 | 2 .
Let R(t) = sup{ϕ(t), ξ(t)}, then R > 0 and

d dt |u 1 -u 2 | 2 + |v 1 -v 2 | 2 ≤ R(t) |u 1 -u 2 | 2 + |v 1 -v 2 | 2 . (3.45)
Integrating (3.45) over t ∈ [0, T ] and using that u 1 (0) = u 2 (0) and v 1 (0) = v 2 (0), we obtain

|u 1 -u 2 | 2 + |v 1 -v 2 | 2 ≤ t 0 R(t) ( |u 1 -u 2 | 2 + |v 1 -v 2 | 2 ) dx. Let ρ(t) = |u 1 -u 2 | 2 + |v 1 -v 2 | 2 , then ρ(t) ≤ t 0 R(s) ρ(s) ds. (3.46)
Applying Gronwall's inequality, we obtain

ρ(t) ≤ 0. Therefore ρ ≡ 0, i. e., |u 1 -u 2 | 2 + |v 1 -v 2 | 2 = 0.
Using the regularity of the solutions, the uniqueness follows.

Exponential stability

In this section we show that the total energy (2.11) associated to system (2.1)-(2.5) decay exponentially to zero as t tends to infinity. In what follows we will prove our main result:

Theorem 4.1. Let (u, v) be a solution of system (1.1)-(1.5) given by the theorem 3.1 and theorem 3.2. We suppose that m > 2 c p (M 1 + α) > 0, where c p corresponds to the constant of the Poincaré inequality.. Then there exist positives constants C and η, such that

E(t) ≤ C E(0) e -η t . (4.1)
Proof. Multiplying equation (2.1) by u and integrating over x ∈ Ω we have 1 2

d dt Ω |u| 2 dx + a(ℓ(u)) Ω |∇u| 2 dx = - Ω f (u -v) u dx + α Ω (u -v) u dx.
Multiplying equation (2.2) by v and integrating over x ∈ Ω we have 1 2

d dt Ω |v| 2 dx + a(ℓ(v)) Ω |∇v| 2 dx = Ω f (u -v) v dx -α Ω (u -v) v dx.
Adding the expressions above and using (2.8) we have case the parameter ε is a very small parameter and it plays a practical computational role to avoid the numerical overflow on the diffusion when the extinction of the population occurs, that is when u ≈ 0 or v ≈ 0. We consider a parameter m 0 to the numerical study of an extinsion case of population and for a persistence case of population. In fact, the exponential decaying of the energy (4.1), can be interpreted as the extinsion of two populations u and v. That is occurs when the hypothesis m > c p (M 1 + α) of the Theorem 4.1, is verified. If m is too small, the decaying of the energy is not guarantee and a population persistence can be occur as we see in Figure 2. The initial condition is given by u 0 (x) = δ sin(πx), with δ = 1.95 (see [START_REF] Ackleh | Existence-uniqueness and long time behavior for a class of nonlocal nonlinear parabolic evolution equations[END_REF]), and v 0 (x) = -u 0 (x) = -δ sin(πx). In this example, a negative v 0 has not a physical or biological sense, if u and v represent densities of population, but we want to focus in the importance of the hypothesis of the Theorem 4.1, showing numerically that the exponential decaying of the energy does no occur when the hypothesis is not verified. We choose the parameter ε = 10 -6 for the nonlocal diffusion function (5.5), and we choose r = 1.0 and k = 10.0 for the reaction function (5.6). The discretization is given by J = 10 4 and K = 10 4 ; we solve the linear system (5.1)-(5.3) using Thomas algorithm programming in Fortran90.

We consider here 2 simulations, the first one with m 0 = 1.0 (see Figure 1), and the second one with m 0 = 0.1 (see Figure 2). The population persistence phenomenom does not occur with a choice of a big amplitude δ for the initial condition as it occurs in [START_REF] Ackleh | Existence-uniqueness and long time behavior for a class of nonlocal nonlinear parabolic evolution equations[END_REF]. In fact we made simulations with different δ values and the exponential decaying is always observed.

  .21) Adding the equations (3.20) with (3.21) and integrating of 0 to t, we obtain

|u| 2 +

 2 |v| 2 dx + m Ω |∇u| 2 + |∇v| 2 dx ≤ Ω |f (u -v)| |u -v| dx + α Ω |u -v| 2 dx.

Figure 1 :

 1 Figure 1: Extinction of the population density u(x, t) (left) and v(x, t) (right) at time T = 0.2.

Figure 2 :

 2 Figure 2: Persistence of the population density u(x, t) (left) and v(x, t) (right).

Acknowledgment

MS has been supported by Fondecyt project # 1070694 and Fondap in Applied Mathematics (Project # 15000001). OVV acknowledge support by Dirección de Investigación de la Universidad del Bío-Bío. DIPRODE projects, # 061008 1/R. Finally, OV and MS acknowledge support by CNPq CONICYT Project, # 490987/2005-2 (Brazil) and # 2005-075 (Chile).

Using (2.6) follows that

Applying the Poincaré inequality and the Young inequality, we obtain

Now choosing m > 2 c p (M 1 + α) > 0 follows that there exists C > 0 such that

From we concludes that there exists η > 0 such that

The proof follows.

Numerical Results

In this section we consider a particular case of the nonlocal reaction diffusion equations (2.1)-(2.5) in one dimensional space (n = 1), Ω = (0, 1), and l :

Then we approximate the solution of the system using implicit finite differences. The numerical scheme reads as following

for i = 1, . . . , J -1 and k = 0, . . . , K, where δt = T /K, δx = 1/J, x i = iδx, i = 0, . . . , J and t k = kδt, k = 0, . . . , K. In (5.1)-(5.3), u k i denotes the approximation of u(t k , x i ). In order to solve the system (5.1)-( 5.3), we consider the initial condition approximated by

and v 0 i = v 0 (x i ), for i = 0, . . . , J.

(5.4)

For each k = 0, . . . , K, the scheme (5.1)-(5.3) is equivalent to a linear system with a tridiagonal matrix of R (J-1)×(J-1) which is positive definited and then there exists a unique solution of (5.1)-(5.4).

In order to compare the numerical behaviour of the solution with theoretical and numerical behaviour of the solution for one equation (scalar case), we take the same nonlinear reaction terms with similar parameters and initial conditions of Ackle and Ke [START_REF] Ackleh | Existence-uniqueness and long time behavior for a class of nonlocal nonlinear parabolic evolution equations[END_REF]. Nonlinear reaction and nonlocal diffusion are given by a(ξ) := max ε,

f (w) -αw := rw(κ -w), for all w,

where ε, m 0 , r and κ are constant and positive parameters. We remark that in the numerical example of Ackle and Ke [START_REF] Ackleh | Existence-uniqueness and long time behavior for a class of nonlocal nonlinear parabolic evolution equations[END_REF], the authors consider a nonlocal diffusion given by the expression 1

. In our