From cec0156dae00b93dce7087fd2313b7fe71420e92 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Tue, 7 Jan 2020 15:48:44 +0100
Subject: [PATCH] new: [vishing-model] Simple model to rapidly decay voice
 scamming, vishing relying on phone-numbers.

---
 README.md                 |  3 +++
 models/vishing-model.json | 30 ++++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+)
 create mode 100644 models/vishing-model.json

diff --git a/README.md b/README.md
index b8613d8..b0a409f 100644
--- a/README.md
+++ b/README.md
@@ -3,10 +3,13 @@
 Starting from MISP 2.4.114, a decaying feature is available to apply decaying on attributes in your MISP instance. MISP comes with a set of default decaying models which
 can be customised by the users. This repository contains all the default models.
 
+For more information about decaying and expiring attributes/indicators in MISP, the training materials [MISP and Decaying of Indicators](https://www.misp-project.org/misp-training/a.5-decaying-indicators.pdf) is a good start.
+
 ## Models
 
 - [nids-simple-model](./models/nids-simple-model.json) - Simple decaying model for Network Intrusion Detection System (NIDS).
 - [phishing-model](./models/phishing-model.json) - Simple model to rapidly decay phishing website.
+- [vishing-model](./models/vishing-model.json) - Simple model to rapidly decay voice scamming, vishing relying on phone-numbers.
 
 ## How to contribute your decaying model?
 
diff --git a/models/vishing-model.json b/models/vishing-model.json
new file mode 100644
index 0000000..6491c76
--- /dev/null
+++ b/models/vishing-model.json
@@ -0,0 +1,30 @@
+{
+  "uuid": "1097c0fe-06eb-4741-94d9-8098301d92f4",
+  "name": "Vishing model",
+  "formula": "Polynomial",
+  "authors": [
+    "MISP Project"
+  ],
+  "ref": [
+    "https://arxiv.org/abs/1902.03914",
+    "https://arxiv.org/abs/1803.11052"
+  ],
+  "parameters": {
+    "lifetime": 10,
+    "decay_speed": 2.3,
+    "threshold": 30,
+    "default_base_score": 80,
+    "base_score_config": {
+      "estimative-language:confidence-in-analytic-judgment": 0.25,
+      "estimative-language:likelihood-probability": 0.25,
+      "phishing:psychological-acceptability": 0.25,
+      "phishing:state": 0.25
+    }
+  },
+  "description": "Simple model to rapidly decay voice scamming, vishing relying on phone-numbers.",
+  "attribute_types": [
+    "phone-number",
+    "prtn"
+  ],
+  "version": 1
+}