# A Mamdani Type Fuzzy Inference System to Calculate Employee Susceptibility to Phishing Attacks
## 7 Testing, Evaluation and Results  
The system incorporated 69 rules that were specifically designed to create the logic outcome. The rules that were optimised catered for all employees depending on the six input variables. The rule base followed a logical process such as:  
Example Rule 1:  
* **IF** Employee Experience is Non-technical **AND**
* Security Level is Non **AND**
* Company Policy is Medium **AND**
* Phishing Attack Level is Medium **AND**
* Employee Job Satisfaction is Medium **AND**
* Procrastination is High **THEN**
* Susceptibility is **High**  
The above rule highlights an employee with a high susceptibility rating, the main contributing factor is that the employee is non-technical and the procrastination level is high. The next rule indicates that with strong company guidelines and a technical employee who is productive at work results in a low susceptibility rating. Example Rule 2:  
* **IF** Employee Experience is Technical **AND**
* Security Level is Medium **AND**
* Company Policy is Strong **AND**
* Phishing Attack Level is Weak **AND**
* Employee Job Satisfaction is Medium **AND**
* Procrastination is Low **THEN**
* Susceptibility is **Low**  
The next rule results in a low output, however, it only considers 4 variables, it showcases that when a technical employee with a medium security level clearance is faced with a weak attack the susceptibility is considerably low. Example Rule 3:  
* **IF** Employee Experience is Technical **AND**
* Security Level is Medium **AND**
* Company Policy is Strong **AND**
* Phishing Attack Level is Weak **THEN**
* Susceptibility is **Low**  
The rule below considers the various inputs that all contribute to the susceptibility rating of the employee being weak. This rule is different to the others as it takes into consideration an employee who is a security analyst, however, due to the company having weak guidelines, phishing attacks rating string and the employee at best is below average (job satisfaction + procrastination) thus resulting in a high susceptibility rating. Example Rule 4:  
* **IF** Employee Experience is Security-Analyst **AND**
* Security Level is High **AND**
* Company Policy is Weak **AND**
* Phishing Attack Level is Strong **AND**
* Employee Satisfaction is Medium **AND**
* Procrastination is High **THEN**
* Susceptibility is **High**  
The rule base is built on logic, for instance if a non-technical employee is faced with a strong phishing attack level and the company has weak security policies then the most logical and oblivious outcome would be that the employee is susceptible to phishing attacks. To mimic a workplace environment of having anomalous variables such as, a non-technical employee who is developing their skills by studying for a security basedcertification or similar were ultimately left out of the FIS as the aim of this research was to build a simple system that showcased the susceptibility of the average employee. However, if this research is taken forward then a more sophisticated rule base should be configured whereby employees who fall into an anomalies category could then be accommodated. The initial method taken to create a rule was the utilisation of a random number generator. Random numbers were used to generate more then 150 rules that attempted to hit every single variable in the defined sets. The idea was to produce the most efficient and logical output where, if every value is hit then the output has to be correct. In doing so the random number generator was used to allow for every possibly that the defined combinations could make. However, when examining the quality of the output, the susceptibility of rating for variables were highly illogical and inefficient. For example, a rule that stated a non-technical employee had a low susceptibility rating also contained the variables of a high phishing attack level and was an extremely unproductive worker. Indicative of this the need to change the rule base entirely and address the problem was required. If the rule base did not work then the entire system is unfit.