A Tullock-contest-based approach for cyber security investments