## 4 Verification and Validation
### Implementation of the Proposed Model in a Construction Example
Since the sensitivity of each file in a project is different, all parameters related to data defined in the previous sections should also be different. One of these parameters is the defender's payoff due to the discovery of a malicious insider identity or data protection \(\omega\in(0,1)\). It represents the importance of protecting the data to the project or defender. It can also be considered as the criticality of the data for the proper functioning of the project (i.e., avoiding project disruption and maintaining business continuity). Moreover, \(-\omega\) reflects the loss to the defender as a result of not detecting a malicious insider or exposing data to a malicious insider. As the criticality of a file for the project increases, this parameter should also increase (i.e., a high \(\omega\) means that it is important to the defender). Therefore, it is crucial to understand different file types in a construction project to identify their sensitivity levels for different types of projects during different phases. A high-level and non-exhaustive list of file types used in BIM projects is as follows: BIM execution plan (BEP), 3D models--architectural, 3D models--structural, 3D models--MEP, coordination models, cost estimation documents, construction schedules, cost and schedule forecasts, quantity takeoff files, specifications, clash detection reports, bills of quantities (BoQs), requests for information (RFIs), requests for change (RFCs), quality control/quality assurance documents, bidding documents, payment certificates, progress reports, risk assessment documents, autonomous or semi-autonomous machinery control system files, testing and inspection reports, contracts, and other legal documents. The parameter \(\omega\) values for different criticality levels were assigned based on inspiration from the qualitative severity rating scale in the Common Vulnerability Scoring System (CVSS) v3.1 [43]. Since the \(\omega\) value was normalized within the range of \((0,1)\) and the original values from CVSS were within the range of \([0,10]\), the ratings were multiplied by \(0.1\) to obtain the \(\omega\) values. A stacked bar chart showing different criticality levels for data and the corresponding \(\omega\) values are shown in Figure 9.  
Different document types might have different sensitivities based on the type and phase of the project. Therefore, assuming fixed values for each one regardless of the  
Figure 9: Criticality levels for data and the corresponding \(\omega\) values. characteristics of the project would be inaccurate. For example, while the design documents might have high sensitivity in a critical project such as a military base construction during all the phases, they might have much lower sensitivity in a residential project regardless of the project phase. [PERSON] et al. [1] summarized some of the critical assets that can be targeted by attackers in construction projects. They mentioned that during the design phase, proprietary information, such as the details of the operational procedures, could be stolen and sold to other parties for financial gain. The other parameter, the malicious insider's payoff corresponding to the compromising of data (\(\beta\)), presents the importance of the data to the attacker (i.e., the malicious insider). The value of this parameter should be considered independent of the \(\omega\) value since it is determined based on the attacker's motivation rather than the project's priorities. Similar to \(\omega\), \(\beta\) was also normalized between 0 and 1. As its value approached 1, the benefit of compromising data was maximized for the attacker. The same qualitative categorization for the criticality of data and the corresponding values shown in Figure 9 were used for the \(\beta\) value. Therefore, the value of data to the attacker could be low, medium, high, or critical, with \(\beta\) values of 0.2, 0.55, 0.8, and 0.95, respectively. The attackers could have various motivations that determined their targets in the project.