Behavioral Spear Phishing Risk Simulation Tool

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;                                                                                                                               ;;
;;  Behavioral Spear Phishing Risk Simulation Tool, by Kim Kaivanto, November 2013                                               ;;
;;  Simulates 100 agents, whose responses to spear phishing emails are calculated, illustrated and recorded.                     ;;
;;  The vertical height of the world represents the duration of the spear-phishing attack in weeks.                              ;;
;;                                                                                                                               ;;
;;  Agents may be M0s (classical Signal Detection Theory (SDT), i.e. normatively rational, risk-neutral decision makers          ;;
;;                M1s ('behavioral' CPT-SDT decision makers)                                                                     ;;
;;                M2s ('behavioral' decision makers who employ CPT-SDT *and* are vulnerable to peripheral-route persuasion       ;;
;;                                                                                                                               ;;
;;  Requires the 'R-Extension' package available here http://r-ext.sourceforge.net/                                              ;;
;;                                                                                                                               ;;
;;  Height of world indicates duration, in weeks, of the spear-phishing attack (default 3 rows = 3 weeks                         ;;
;;                                                                                                                               ;;
;;  Once max-iter is reached and the run is complete, type the following in the command center: show phished-per-iter-list       ;;
;;  The resulting vector may be highlighted, copied and saved as a text file for analysis in a statistical software package      ;;
;;                                                                                                                               ;;
;;  Code licenced by Kim Kaivanto, http://www.lums.lancs.ac.uk/profiles/kim-kaivanto/                                            ;;
;;  under a Creative Commons Attribtion-Noncommercial-Share Alike 3.0                                                            ;;
;;  Unsupported License (see http://creativecommons.org/licenses/by-nc-sa/3.0/                                                   ;;
;;  If this model is used in original or modified form for research, please cite                                                 ;;
;;  (i) the code source on modelingcommons, as well as                                                                           ;;
;;  (ii) the published paper:                                                                                                    ;;
;;       Kaivanto K (2014) "The Effect of Decentralized Behavioral Decision Making on System-Level Risk",                        ;;
;;       Risk Analysis 34(12), pp. 2121--2142. DOI: 10.1111/risa.12219                                                           ;;
;;       available at the URL http://onlinelibrary.wiley.com/doi/10.1111/risa.12219/                                             ;;
;;                                                                                                                               ;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;


extensions [r] 

globals [
  iter                           ;; iteration count tracker
  phi                            ;; CPT value function exponent
  prob-of-phish                  ;; prior probability that an email will be a spear-phishing email
  phished-per-iter-list          ;; a list variable of length max-iter that records the number of security breaches (total) within each iteration
  ]
;; controlled by slider:
;;    prob-periph-pers              probability that peripherral-route persuasion is 'successful', causing the individual to use his/her 'lower' ROC curve
;;    no-of-spearphish-per-week     how many, out of the 250 emails per week, are spear phishing emails
;;    d-prime-vigilant              d' of the normal ROC curve
;;    d-prime-low                   d' when compromised by peripher-route persuasion (see prob-periph-pers above)
;;    max-iter                      maximum number of iterations to run, ranges from 1 to 10,000 
;;
;; controlled by drop-down menu:
;;    class-of-users                mzeros for M0s, mones for M1s, mtwos for M2s
;;                                  for detailed explanation of user classes see:
;;                                  Kaivanto (2013) "The Effect of Decentralized Behavioral Decision Making on System-Level Risk"

breed [ mzeros mzero ]  ;; Benchmark, normative rationality
breed [ mones mone ]    ;; CPT-SDT
breed [ mtwos mtwo ]    ;; CPT-SDT + psychology of deception (peripheral-route persuasion, visceral emotion, time pressure, contextual cues)

turtles-own [
  d-prime
  phished?      ;; in the current iteration, has the agent clicked on a phishing email? 
  theta-opt     ;; optimal cutoff threshold under the classical SDT (mzeros) or under the CPT-SDT (mones and mtwos)
  alpha         ;; false positive likelihood associated with the agent's theta-opt
  power         ;; true positive likelihood associated with the agent's theta-opt
  ]


;;           SETUP

to setup
  clear-all
  ask patches [ set pcolor black ]
  set iter 0
  set phished-per-iter-list (list)
  set prob-of-phish ( no-of-spearphish-per-week / 250 )
  if ( class-of-users = "mzeros" ) 
    [ create-mzeros 100 
        [ 
          defaults 
          calculate-mzeros-theta-opt
          set phished? false
        ] 
    ]
  if ( class-of-users = "mones" ) 
    [ create-mones 100  
        [ 
          defaults 
          calculate-mones-mtwos-theta-opt
          set phished? false
        ] 
    ]
  if ( class-of-users = "mtwos" ) 
    [create-mtwos 100 
      [ defaults 
        ifelse (( random 100) < prob-periph-pers ) 
          [ set d-prime d-prime-low ] [ set d-prime d-prime-vigilant ]
        calculate-mones-mtwos-theta-opt
        set phished? false
      ] 
    ]
  reset-ticks
end 

;;            defaults for use in SETUP of agents 

to defaults
    set color gray
    set heading 0
    set xcor (who) 
    set ycor min-pycor 
    set phi 0.88
    set d-prime d-prime-vigilant   ;; the default value for mzeros and mones, and the starting default for mtwos
end 

to calculate-mzeros-theta-opt
      set theta-opt ((1 / d-prime)*(ln C-FP - ln (C-FN - C-TP) + ln (1 - prob-of-phish ) - ln prob-of-phish + (((d-prime)^(2)) / 2))) 
end 

to calculate-mones-mtwos-theta-opt
      set theta-opt ((1 / d-prime)*((phi)*(ln (C-FP)) - ln (((C-FN)^(phi)) - ((C-TP)^(phi))) + ln ( 1 - prob-of-phish ) - ln prob-of-phish + (((d-prime)^(2)) / 2)))
end 

;;

to go
  ask-concurrent turtles [ sdt ] ;; 
;; 
  if ( all? turtles [ ycor = max-pycor ] ) and ( iter = max-iter )
    [ tick
      set phished-per-iter-list lput ( count turtles with [ phished? ] ) phished-per-iter-list
      if  pause?  [ user-message (word "End of iteration #" iter ". End of run.") ]
      histogram-plot
      user-message (word "Finished!")      ;;;;;;;;;
      stop ]
;;
  if ( all? turtles [ ycor = max-pycor ] ) and ( iter < max-iter )
    [ 
      tick
      if  pause?  [ user-message (word "End of iteration #" iter ".") ]
      ask patches [ set pcolor black ]
      ask-concurrent turtles [ set ycor min-pycor ]
      set phished-per-iter-list lput ( count turtles with [ phished? ] ) phished-per-iter-list
      ask-concurrent turtles [ set phished? false ]
      ask-concurrent turtles [ sdt ] ;; 
    ]  
;;
  if (all? turtles [ ycor = max-pycor - 1 ])
    [
      tick
      ask-concurrent turtles [ forward 1 ]
      set iter iter + 1
    ]  
;;
  if ( all? turtles [ ycor < max-pycor - 1])
    [ 
      tick
      ask-concurrent turtles [ forward 1 ]
    ]
end 

to sdt
  ifelse phished? 
  [
    set pcolor lime
  ]
  [
    r:put "thetastar"  theta-opt 
    r:put "dprime" d-prime
    r:eval "power <- pnorm( dprime - thetastar )"
    r:eval "alpha <- pnorm( 0 - thetastar )"
    set alpha (r:get "alpha") 
    set power (r:get "power")
    ifelse ((random-float 1 ) <= power) 
    [ set phished? false 
      set pcolor lime
    ] 
    [ set phished? true 
      set pcolor red
    ]
  ]   
end 

to histogram-plot
  r:setPlotDevice
  r:put "phishperiter" phished-per-iter-list
  r:eval "hist(phishperiter, xlim=c(0,80), ylim=c(0,50),breaks=16)"
end