STOCHASTIC MODELING AND OPTIMIZATION OF PROTECTION AGAINST MULTI-STAGE PHISHING CAMPAIGNS

Abstract

Phishing remains one of the primary vectors for gaining initial access to information systems, and the success of such attacks depends largely on user behavior. Traditional binary metrics such as "click" versus "no click" fail to capture the multi-stage trajectory in which a user moves through states including message delivery, engagement, suspicion, interaction, compromise, or safe exit. This study aims to develop and numerically verify a probabilistic process model of a multi-stage phishing scenario, enabling the assessment of compromise probability, the expected number of steps to scenario completion, and the sensitivity of the outcome to defensive interventions. The model is constructed using an absorbing Markov chain with a finite state space; a transition matrix is formulated, and transient and absorbing states, the fundamental matrix, the absorption probability matrix, and the vector of expected step counts are defined. For an illustrative credential-phishing scenario, the compromise probability () and the expected number of steps () were derived analytically. The internal numerical correctness of the implementation was verified using the Monte Carlo method over  trajectories, with 95% confidence intervals constructed; the results are consistent with the analytical solution. The Monte Carlo method was employed solely for numerical verification rather than as an empirical validation of the model. To analyze security measures, the study considers stochastically admissible changes to transition probabilities corresponding to improvements in email authentication, user training, and the implementation of phishing-resistant multi-factor authentication. A cost-constrained selection of measures was performed using a greedy procedure based on the criterion of risk reduction per unit cost and compared with an exhaustive search. It is shown that the greedy solution does not always coincide with the globally optimal one. The scientific novelty lies in representing the user's behavioral trajectory as a Markov chain and formalizing the relationship between security interventions, changes in transition probabilities, and the final risk of compromise.