## 2 Related Work
Cooperative game theory introduces measures like the Shapley value to assess individual contributions within coalitions and identify scenarios where synergetic effects yield greater collective benefits than independent actions [23]. These insights are particularly relevant for designing strategies that align the interests of diverse stakeholders in cybersecurity contexts, including insider threat scenarios. An adversarial risk analysis approach was adopted by [PERSON] et al. [24] to analyze malicious insider threats and tackle the traceability issue of adversarial insider attacks. A traceability system with respect to insider attackers was proposed by [PERSON] et al. [25] using blockchain. Moreover, machine learning techniques were used to detect malicious insider threats [26; 27; 28; 29; 30; 31], where most of the work focused on reactive measures failing to counter proactive challenges. It can be observed that the existing literature does not consider several aspects (see Table 1) that are necessary for predicting malicious insider behaviors and deriving the best defense strategies against such attacks. It is clear that modeling malicious insider threats without considering all of these aspects has drawbacks in capturing the realistic situation. Notably, previous studies on the behavior of malicious insiders assume complete information about the game structure. However, this assumption is unrealistic since insiders' intentions, such as being malicious or honest, are not entirely known to the data defender. Moreover, to the best of the authors' knowledge, no study has discussed insider threat modeling considering the construction industry. Therefore, in this paper, we propose novel incomplete information game models in the context of the construction industry incorporating the following aspects:  
* Aspect 1 (A1): The value of information/data/resources to an insider. * Aspect 2 (A2): Penalty to a malicious insider when his/her activity and identity are exposed. * Aspect 3 (A3): How the sensitive information/data are compromised (e.g., through authentication or cyberattack). * Aspect 4 (A4): The probability of discovering the malicious activities and the insider's identity. * Aspect 5 (A5): The prior belief/information that the data defender has about an insider. The main contributions of this paper are highlighted below:  
**i. ** The existing literature predominantly examines malicious attacks executed via cyberattacks, often neglecting the potential for insider threats initiated through legitimate authentication processes. This oversight is particularly relevant for the AEC industry, where stakeholders have legitimate access to data within CDEs but may misuse this access for malicious purposes. Our research fills this gap by modeling insider threats that can arise through cyberattacks and authorized access, presenting a more comprehensive view of vulnerabilities in CDEs. **ii. ** The existing literature often assumes complete information regarding insider behavior types, overlooking the ambiguity of legitimate versus malicious intentions within the AEC environment. Our research introduces a Bayesian game model that incorporates incomplete information, accurately reflecting the real-world complexity of insider motivations. By considering both types of insiders, our model offers a novel approach to predicting insider behavior under conditions of uncertainty, enhancing the development of targeted defense strategies against insider threats in CDEs. **iii. ** The rise of digitalization, BIM, and CDEs in the AEC sector has introduced unique cybersecurity challenges that current generalized insider threat models do not sufficiently address. To our knowledge, our research is the first to address insider threats to CDEs in the AEC industry. **iv. ** We validate our models using real project data and simulations, which demonstrate the models' practical applicability in real-world AEC projects.