new: [vishing-model] Simple model to rapidly decay voice scamming, vishing relying on phone-numbers.

README.md

@@ -3,10 +3,13 @@
 Starting from MISP 2.4.114, a decaying feature is available to apply decaying on attributes in your MISP instance. MISP comes with a set of default decaying models which
 can be customised by the users. This repository contains all the default models.
 
+For more information about decaying and expiring attributes/indicators in MISP, the training materials [MISP and Decaying of Indicators](https://www.misp-project.org/misp-training/a.5-decaying-indicators.pdf) is a good start.
+
 ## Models
 
 - [nids-simple-model](./models/nids-simple-model.json) - Simple decaying model for Network Intrusion Detection System (NIDS).
 - [phishing-model](./models/phishing-model.json) - Simple model to rapidly decay phishing website.
+- [vishing-model](./models/vishing-model.json) - Simple model to rapidly decay voice scamming, vishing relying on phone-numbers.
 
 ## How to contribute your decaying model?
 

models/vishing-model.json

@@ -0,0 +1,30 @@
+{
+  "uuid": "1097c0fe-06eb-4741-94d9-8098301d92f4",
+  "name": "Vishing model",
+  "formula": "Polynomial",
+  "authors": [
+    "MISP Project"
+  ],
+  "ref": [
+    "https://arxiv.org/abs/1902.03914",
+    "https://arxiv.org/abs/1803.11052"
+  ],
+  "parameters": {
+    "lifetime": 10,
+    "decay_speed": 2.3,
+    "threshold": 30,
+    "default_base_score": 80,
+    "base_score_config": {
+      "estimative-language:confidence-in-analytic-judgment": 0.25,
+      "estimative-language:likelihood-probability": 0.25,
+      "phishing:psychological-acceptability": 0.25,
+      "phishing:state": 0.25
+    }
+  },
+  "description": "Simple model to rapidly decay voice scamming, vishing relying on phone-numbers.",
+  "attribute_types": [
+    "phone-number",
+    "prtn"
+  ],
+  "version": 1
+}