## 4 Verification and Validation
### Implementation of the Proposed Model in a Construction Example
#### 4.2.1 Overview of the Hypothetical Scenarios  
In these scenarios, a construction cost estimator from the main contractor, who is a malicious insider, requests access to two different files stored in the centralized repository (i.e., CDE) of the project during the construction phase. The project is a smart hospital building construction project, and the cost estimator typically has access to both files. Since the project is a smart building, it will be equipped with IoT devices once the construction is completed. Moreover, medical equipment will be installed at the last stage of the construction phase as it is a hospital building. The details of the IoT devices and medical equipment are stored in the CDE of the project. The two files requested by the cost estimator (i.e., insider) are the cost and schedule forecast file and the structural design file. To demonstrate the impact of different security levels of projects on the best strategies of the insider and defender, two different scenarios assuming two different overall security levels for the same project are considered. In Scenario 1, the security level of the project was assumed to be \"high\" (see Table 3). As mentioned in the previous sections, two probability values were used while computing the Bayesian Nash Equilibrium (BNE): the probability that a malicious insider who launches authentication is detected \((p_{1})\) and the probability that the malicious insider who launches a cyberattack is detected \((p_{2})\). Since the probability that the malicious insider who launches a cyberattack is detected \((p_{2})\) is dependent on the overall security level of the project, \(p_{2}\) was chosen as the corresponding value for \"high\" in Table 3, which was 0.7. Moreover, since \(p_{1}\) is assumed to be always higher than \(p_{2}\) in the \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Malicious Insider Expertise Level** & **Project Security Level** & **File Accessibility Level** & **Rating Scale** & **Rating Average** \\ \hline Novice & Very low & Very high & 0 & 0.2 & **0.1** \\ \hline Advanced beginner & Low & High & 0.2 & 0.4 & **0.3** \\ \hline Competent & Medium & Medium & 0.4 & 0.6 & **0.5** \\ \hline Proficient & High & Low & 0.6 & 0.8 & **0.7** \\ \hline Expert & Very high & Very low & 0.8 & 1 & **0.9** \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Expertise, security, and accessibility levels and the corresponding qualitative values. proposed game models, \(p_{1}\) was assumed to be 0.8 for Scenario 1. In Scenario 2, the overall security level of the project was assumed to be \"medium\" (see Table 3). Therefore, \(p_{2}\) was assumed to be 0.49 (nearly equal to 0.5) based on the qualitative rating corresponding to \"medium\" in Table 3. Similar to the first scenario, \(p_{1}\) was assumed to be slightly higher than \(p_{2}\), which was 0.55 in this case. A summary of both scenarios for the same smart hospital construction project is presented in Table 4.  
At the beginning of the project, the initial probability of being a malicious insider (\(\delta_{\text{initial}}\) ) for the cost estimator was assumed to be 0.2 since it is a trusted role in the project. However, at the time of the data request, the probability of being a malicious insider (\(\delta_{\text{current}}\) ) was assumed to be higher, 0.8, due to unusual traffic from the cost estimator's computer detected by the IDS. The unusual traffic shows that high volumes of data were transferred from the project repository to an unknown IP address. In this scenario, the cost estimator who requests access to the files is a malicious insider with financial motivation. He/she is a career criminal, based on [PERSON]'s [PERSON] (1988) cyber attacker categories previously presented, and is assumed to have an expertise level of advanced beginner, based on the [PERSON] model [PERSON] (1988).