## 3 Methodology
### Simultaneous Move Game Model  
Insider threats are difficult to deal with in comparison to external threats due to the privilege that insiders have. An insider is motivated to compromise data for different purposes (e.g., financial gain, espionage). A malicious insider can achieve this activity by using his/her privilege through authentication to gain access to the data. This is termed as the misuse of access [38]. In this case, however, there is a probability that the malicious act and his/her identity are discovered because all the detailed information of the insider who has accessed the data is revealed to the data defender during the authentication process. As a result, the malicious insider can face a heavy penalty (cost) if his/her activity and identity are revealed. Thus, to prevent his/her identity and malicious activity from being known,the insider can make use of a cyberattack technique such as defense bypass [38] (e.g., SQL injection attack [39]) to access the data. We assume that the probability of exposing the malicious activity and insider's identity under authentication (misuse of data) is greater than that of malicious action/identity being discovered under cyberattack. However, launching a cyberattack to obtain the data is costly compared to a misuse of access attack through an authentication process. Therefore, there are two schemes for a malicious insider to implement this activity: gain access to the data through authentication or a cyberattack. An insider can exploit his/her privilege to obtain important information, such as vulnerabilities of the computing facilities (e.g., cloud computing used to host the CDE), by scanning, reconnaissance, or infiltration. The data defender believes that there is a malicious insider in the project team with a positive probability. This shows that releasing data to authorized insiders whenever a data access request is made can cause data compromise (e.g., tampering, theft, leakage). Therefore, when an insider (whose type can be legitimate or malicious) sends a data access request, the data defender is faced with a situation as to whether to accept the request and release the data or reject the request and not release the data. As a result, the following two cases arise:  
1. If the data are released to an insider who happens to be malicious, the data will be misused (e.g., trading them for financial purposes, sending them to the enemy) by the malicious insider. 2. On the other hand, if the data request is rejected, there is a probability of rejecting a legitimate insider request. Though the data are protected in this situation, the project team would be unable to achieve the expected outcome/goal in the project work due to the information (data) necessary for the project being withheld. That is, the workflow will be interrupted, for example, during the design phase. Thus, considering the above scenario, the questions that need to be addressed are as follows: What will be the best strategies for the defender to protect the data in the scenario of incomplete information about an insider who can act as legitimate or malicious? How likely is it that an attack is being carried out by an insider of the project team or, equivalently, how secure are the data stored in the database of the CDE/BIM? To address this problem, we formulated an incomplete information game model to capture the interactions between an insider (legitimate or malicious) and the defender. The analysis of the proposed model will give us insights into how an insider in the project would behave as the game solutions predict the behavior of an insider and the best decisions for the defender. Now, we consider the interactions between insiders (stakeholders) of a construction project and the data defender who defends data stored in a CDE. In this model, an insider sends a data access request to the defender. The defender is not certain about whether the request comes from a legitimate or malicious insider.