Social media platforms have enabled large-scale influence campaigns, designed by threat actors to manipulate public opinion. These campaigns use coordinated accounts to spread fake information or amplify information (e.g., disinformation, astroturfing), swaying opinions and paralysing decision-making. To mitigate these impacts, nongovernmental and governmental entities train in simulated informational environments emulating social network platforms and their exchanges. During the trainings, the animation team must implement specific informational Tactics Techniques and Procedures (TTPs) to achieve customized educational objectives. The simulation of TTPs requires credible social networks, which must notably contain diverse user types (bots, trolls, casual users, influencers, etc.) and recreate social interactions to generate both normal behaviours and malicious behaviours. This paper introduces a framework designed to generate personalized social networks graphs for training sessions, tailored specifically to the needs of the trainers. This framework allows the modelling of referenced influence operations in order to reproduce specific attacks such as astroturfing or corrupted influencers to increase the training credibility, the pedagogical impact, and capitalising on existing knowledge. We illustrate the coherence of these simulations through two case studies, which aim at reproducing astroturfing attacks and corrupt influencers tactics. We show that our simulation of these tactics coherently reproduces the documented attacks, and we assess the results through topology metrics and information difusion metrics.
The democratisation of social media platforms during the 21st century have enabled large-scale influence campaigns, designed by threat actors to manipulate the public opinion. These campaigns use coordinated accounts to spread fake information or to greatly amplify information operations (e.g disinformation campaigns, astroturfing), in order to sow chaos, and to paralyse decision-making.
Attackers have been continuously improving their methods to take advantage of online social networks, greatly boosting their efectiveness and impact. In response, defenders have organised their Tactics, Techniques, and Procedures (TTPs) through frameworks, such as the DISARM framework 1.
Moreover, in an efort to mitigate and detect these campaigns, entities such as journalists (e.g. fact-checking service), brand monitoring services, company security teams, and government agencies are following training sessions to stay ahead and efectively combat influence operations.
In this context, an animation team (trainers) creates a scenario that depicts the educational goals of the training and decides which targeted informational strategies (i.e. TTPs) need to be implemented in a controlled setting. These TTPs are to be detected and mitigated by the player team (trainees).
To efectively simulate these techniques, it is essential to replicate a credible social network ecosystem. The ecosystem should encompass a variety of user types, such as bots, casual users, influencers, and trolls. Furthermore, the simulation should also accurately model the mechanisms of information difusion, in order to shape how the diverse topics discussed in a platform interact with each others, and to enable the possibility to have viral topics. This modelling is crucial to provide an understanding of the mechanisms exploited by the red team (attackers) for their attacks.
In this paper, we describe a framework that aims to simulate documented attacks such as astroturfing, botnets attacks, or butterfly attacks 2, increasing training sessions likelihood and credibility. The framework generates credible social network graphs along a customizable information difusion model. The social graph is created taking into account user parameters such as network composition (distribution between user types), density of the network (how much the users are connected), and interactions probability matrix (how often a type of user interacts with another). We summarize our contributions as follows: • We use the DISARM Matrix to identify useful Tactics, Techniques and Procedures (TTPs) for training sessions, enhancing its educational impacts and providing feedback on the topological efects and changes on the information difusion caused by the TTPs. • To simulate these attacks, our framework generates a customizable social graph with end-user inputs such as user account types, network density, and community linkages. It then simulates information difusion on the generated graph, modelling interactions between regular users and malicious accounts on micro-blogging platforms like X and Mastodon. • We validated our approach by simulating two TTPs and measured their impact on the social network graph from both topological and information difusion perspectives. Furthermore, we also verified the impacts of the attacks on the trending hashtags panel of a self-hosted Mastodon instance, to verify the coherence of our simulation with a real social network recommendation system.
Reproducing credible social network dynamics is essential to provide users with an adequate training
platform. However, creating these graphs is a non-trivial task. Social graphs are composed of various
types of users exhibiting diverse online behaviours. The users difer in how they connect with each
other [
In observed social graphs, the distribution of user connections (i.e., the number of followers) follows
a power-law function [
This phenomenon, often referred to as the "long tail" distribution, means that a few nodes (users) dominate the network’s connectivity, while most nodes have limited connectivity. This power-law distribution is a fundamental property of most real-world networks, including online social networks: it significantly shapes their structure and dynamics.
Information difusion in social graphs describes the process by which information spreads through a network of interconnected users, driven by user behaviours and network topology.
On this task, literature is usually organised around two approaches, Predictive and Explanatory
models[
Predictive models aim at predicting the future state of the network after a spark of information appears
in the graph. For example, predicting the weight of a piece of information, after a specific user has shared
it, is useful for monitoring the network [
The explanatory branch includes works trying to mimic nature in itself, with epidemic models
[
When a user reaches a defined probability threshold for information spreading, they transition to the state of burning, i.e, the user becomes active. Conversely, if the threshold is not met, the user adopts the state of burnt, indicating that they do not further propagate the information.
Modelling information difusion grants the possibility to emulate informational events such as new topics emerging in the simulated world, and to reproduce influence operation techniques during the training sessions.
Attackers have developed various operating procedures to enhance their eficiency and impact by
leveraging online social networks. Defenders model these operating procedures through Tactics,
Techniques, and Procedures (TTPs). Diverse frameworks organise these TTPs, which are diverse in
which attackers they want to model [
Using the framework, we group the relevant tactics as follows:
• Massive Content Creation: This involves coordinated inauthentic behaviours3, astroturfing [
Among these classes, tactics such as the massive use of inauthentic accounts often exhibit specific
temporal activity [
Disinformation operations significantly alter the structure and dynamics of the social graph, including distorting patterns of influence, artificially inflating the visibility of certain narratives, and disrupting the organic flow of information. These changes may allow defenders to focus their means on important attacks, and metrics analysing in real-time the network are a necessity.
As an example, some metrics measures the topological density of certain communities, detecting
abnormal "co-follows, co-retweet, and co-favourite" networks in short time spans5. These abnormalities
are detected using metrics such as the betweenness centrality of the accounts, their degree centrality,
and the exploitation of communities detection and qualification [
Threat actors also coordinate in time, interacting in the social network within short time frames [
Measuring this exposure is quite important, as spending high amounts of time and resources to mitigate failed or limited attacks may not be worth it, due to the limited defender resources. To assess the full impact of the attacks within social networks, a combination of these metrics is required.
This paper relies on a controllable social network generation framework, taking as input user parameters such as the user account type repartition, intra-community density and how connected are each community. The framework also features an information difusion model, integrating key variables representing the user experience on social networks. Finally, we illustrate the framework usefulness by highlighting the possibility (1) to reuse prior documented attacks and their TTPs to capitalise on existing knowledge and (2) to enhance the immersiveness and credibility of training sessions.
Our research focuses on tactics that not only alter the topological structure of social graphs but also manipulate the information space. By leveraging the DISARM framework, two critical tactics have been identified that are pivotal to reproduce with our framework: • Establish Social Assets: This tactic involves the deployment of coordinated inauthentic behaviours, including the creation of bots, trolls, or malicious communities. These entities are strategically used to infiltrate existing networks through methods such as massive engagement or butterfly attacks. • Establish Legitimacy: This involves the fabrication of fake experts or opinion leaders to exert influence over communities. Additionally, it encompasses techniques such as corrupting influencers within genuine communities, and astroturfing to create a false consensus, thereby swaying public opinion.
These attacks fundamentally alter the social graph’s topology by creating new, often deceptive,
relations or connections between communities. Moreover, the behaviour of the accounts involved in
these coordinated attacks deviates significantly from that of the normal accounts [
Our framework aims to bridge this gap by integrating insights from documented attacker behaviours
(how they connect, at what time they interact) [
This approach not only enhances the credibility of the training sessions but also equips defenders with a deeper understanding of the potential threats. In order to reproduce these techniques, tactics, and procedures in a dynamic social graph, the framework relies on a graph generation module that produces special user types configurations (trolls, bots, influencers...) controlled by the trainer. These distributions aim at producing tailored user communities to produce specific setups used in the training.
In platforms such as X (formerly Twitter), the connection between users (nodes of the graph) is defined by the "follow" relationship. This relationship may or may not be reciprocal, significantly impacting the dissemination of information within the network.
In fact, users tend to see more content shared by the accounts they follow, shaping their information exposure and interaction patterns. Furthermore, interactions on X include posting (where a node emits a text post, initiating a thread), replying (contributing to the thread), retweeting (sharing the post or the reply with followers), and favouring (indicating support or approval to a post or a reply).
In observed social graphs, the distribution of user connections (i.e., the number of followers) follows
a power-law function [
In this context, our framework first defines power-law functions parameters for each type of user
identified across literature [
Once these power-laws are defined, the framework proceeds as follows: 1. Follow probabilities: A probability matrix of dimension _ * _ is created, according to the source users types and target users types.For example, casual users have a low probability to follow bots accounts, or casual users have a high chance to follow an influencer. 2. Follower assignation: Each node iteratively follows others with a given edge probability. Then, edges are sampled, where is drawn from a power-law distribution. 3. Alignment with end-user density parameter: Random edges are pruned to match the user-specified community density, defined as the ratio of existing edges to all possible edges in a complete graph. 4. Topic assignation: A topic distribution - a set of pre-defined topics each associated with a scale from 0 to 1 indicating a user’s interest in that topic - is assigned to all nodes. While the topics remain consistent across all nodes, the level of interest for each topic is set-up for individual communities, with small variations from node to node belonging to the same community.
The system applies this algorithm for generating multiple sets of nodes sharing the same topics, called here communities (as seen in Figure 2a). Malicious communities and accounts such as the ones used in astroturfing, or butterfly attacks are created using the same algorithm.
An illustration of this community generation module can be seen in Figure 2a where the framework produces 3 communities (0, 1, 2) of 100 nodes each with a diverse user distribution (see Figure 1).
In real social networks, users have the ability to engage with new topics that may not be of interest for their community. In addition, to reproduce the tactics used by attackers (e.g. astroturfing), it is crucial to develop methods to connect separate communities within the network.
Understanding what are the topics amongst diverse communities, how they interact and who are the main contributors is essential to detect influence operations.
In our system, users can define the inter-community density between diferent communities. This parameter dictates the proportion of connections or edges that exist between two distinct communities, with respect to the maximum connections possible in a complete graph.
To attribute these edges, the system adheres to the same rules that were used during the generation of individual communities. These rules involve assigning relationships based on user types, as detailed in the community generation process (see Section 3.2.1). Following this approach, users from diferent communities become interconnected. This linkage facilitates the difusion of information across the entire parametrised graph, enabling a dynamic and interactive network structure.
(a) Example of generated communities of users,
coloured by user type. (b) Same communities as in Subfigure 2a. End-user parametrises the communities 0, 1, and 2 to connect with specific inter-density parameters. It triggers the creation of bridges between communities, enabling accounts interacting over other communities’ topics of interest.
In our example, the end-user configures an inter-community matrix that establishes connections between communities, using one to five percent of the total possible edges from one community to another (see Figure 2b). This allows diverse communities to influence each others through their following accounts, mimicating the real social networks.
To efectively model a dynamic social network, one needs to reproduce a coherent information difusion model. This model captures the temporal evolution of interactions and the spread of information among individuals, reflecting real-world behaviours and network dynamics accurately. By incorporating factors such as the frequency of interactions, the influence of key individuals, and the varying strengths of relationships, the model can simulate how information propagates through the network over time. Additionally, it should account for external influences and changing network structures to provide a comprehensive understanding of the underlying mechanisms driving information difusion in social networks.
In this subsection, we instantiate an information difusion model, taking into accounts all the past presented variables (user account types, follower network, topic distribution), and new ones such as the circadian pattern (the rhythm of activity during a day, taking into account sleep hours and work hours).
Our information difusion model draws inspiration from the forest-fire adaptation [
Moreover, this paper incorporates various interaction types commonly seen in real social networks, such as posts, replies, retweets, and favourites. These interactions are assigned probabilities that are specifically tailored to each user type.
Initialisation The algorithm begins with the end-user specifying a simulation period (e.g., 3 days from August, the 6th), that will be iterated hour by hour over the period during the simulation. When the end-user wants to model a specific TTP, it is possible to start it at a specific time, allowing users to measure the before/after of the simulation.
For our simulation, the framework processes the chosen topics in parallel, essential to model the crosstopic exposure impact. For each topic, our algorithm starts by selecting k influential nodes, based on: • Topology: degree centrality and betweenness centrality of the node; • Interest of the topic: the system weights the influence by the node interest over the topic. These accounts become active (burning in forest-fire model), and are then allowed to proceed with content creation.
Post Creation For each step of the simulation, the active nodes over the given topic are selected. Then, for each node, the module sequentially calculates a probability of 1. Being logged-in (based on the circadian rythm), allowing the user to post and see new contents. 2. If the user is logged in, the user has a probability to create a post (based on the variables in subsection 3.3.1).
If there is a post created, a max breadth and max depth of the future conversation to be generated is sampled from the user type (the same as the one used to sample the number of follows). To clarify, for influential nodes (such as opinion experts, luminaries...), the future conversations will be deeper (chains of conversations) and broader (the number of replies for each reply will be greater). Engagement Creation For this part, we categorise as engagement each of the interactions belonging to the set {favourite, retweet, reply}.
After a user creates a post, the module has an approach to greedily sample from the entire network to favour interaction diversity. However, for computational reasons, the system removes 98% of the sampled nodes which do not follow the initial poster. This allows users which do not directly follow another user to interact with their content, similar to what happens in real social networks. In this initial step, the burnt nodes are also removed.
For each of the remaining nodes, the framework calculates the probability of interaction with the poster. This results in an interaction type (favourite, retweet, reply).
After replying, the algorithm samples a random probability to continue the conversation recursively on this message, provided depth and breadth constraints are still satisfied, which enables back-and-forth exchanges.
Finally, each new interaction in the graph (post, reply, favourite, retweet) updates the user’s topic distribution, reinforcing their interest on the given topic, and lowering their interest on others. This variation allows the players to track the efect of continuous exposure to topics.
As an illustration, Figure 3 shows that, in a three days simulation, the number of messages per
conversation follows a power-law distribution akin to what is observed on real social networks such
as X [
Network updates Social networks are dynamic, with new creations of links between users (new follows), and links being removed (unfollow). To mimic this mechanism, the following heuristics are introduced at each step of the simulation for both actions. • For follow actions, if user is exposed to at least ∈N posts or replies from user , and user a has reacted ∈N times to them, the user has shown a non-negligible interest for this user. Hence, at the end of a step, a follow link is created from user to user . • For unfollow actions, if user has not reacted to the last ∈N posts he saw from user , user unfollows the user .
In this section, we presented a framework which allows to recreates a tailored social network experience, creating communities, links between communities, and modelling the difusion of information.
To demonstrate the credibility of our simulation framework, this paper presents the simulation of two distinct Tactics, Techniques, and Procedures (TTPs).
In this section, the described system is assessed with the simulation of two examples of frequent Tactics, Techniques, and Procedures (TTPs) documented in the literature.
These TTPs can easily be implemented by an end-user, mainly consists in following six steps: Steps to generate communities to simulate a Specific TTP using the proposed system 1. Step 1: Chose the specific TTP to implement
Ex: ttp = "astroturfing" 2. Step 2: Define malicious community distribution and number of accounts to produce.
Ex: type_distribution={"Bot":0.2, "Troll":0.1 ...} total_nodes=500 3. Step 3: Define malicious circadian pattern (probability to be logged in the platform for each hour of the day)
Ex: {"0h":0.4, "1h":0.3,"2h":0.5,"3h":0.3 ...} 4. Step 4: Define topic distribution and decide what adversarial narrative to push to the network.
Ex: topic_distribution = {"Elections":0.4, "Security":0.2 ...} narrative = "France should increase military budget ..." 5. Step 5: Define intra and inter-community densities.
Ex: Intra-density = 0.3
Inter-density = {"community_0":{"community_1":0.1 ...} 6. Step 6: Decide the time where the attackers start to be active
Ex: ttp_start_time = datetime(year=2025, month=8,day=7, hour=12)
4.1. T0099.001: "Astroturfing"
4.1.1. Sources
This type of attack is widely documented, and thoroughly analysed in [
As presented in the SocialForge data generation system [
Reflecting these factions, two account communities are created per faction, with the former having "normal" communities, and the latter having communities belonging to an astroturfing campaign.
The total of generated accounts is 650, where ~20% - 131 accounts - (as observed in [
For the composition of the communities, the astroturfing communities contains a greater proportion of bots and trolls, as illustrated in Table 1.
In the training scenario, factions should push narratives, defined as strategic ideas to push to a target audience. For France, the narrative is "France should increase military budget to reduce the threats on its vital interests". For the adversarial communities, it is the contrary, as the narrative is: "French people don’t want the French government to increase defence spendings. They should focus on internal problems and not push towards war". 6https://www.sgdsn.gouv.fr/files/files/Publications/20250204_NP_SGDSN_VIGINUM_Rapport_public_Elections_roumanie_ risques_france_VFF.pdf
These factions aim at pushing the narratives at all costs, including linking the provided topics to these narratives.
In addition to the topology of the communities and the semantics used in the messages, both
communities difer in the time patterns of their activities on social platforms (i.e., diferent circadian
cycles). For example, normal communities follow the natural sleep and work rhythm, with reduced
activity during the night and work hours. However, as shown in [
To have a comparison ground, and to assess the attack’s impact on the social network simulation, the attackers start their campaign only from the middle of the simulation, after one day and twelve hours.
A measure of the coherence of the provided simulation is composed by a set of metrics composed of: 1. Typical social networks metrics such as the distribution of the engagement (number of retweets, favourites, and replies) over time, and topological influence scores. 2. Modularity score before and after the attack, from the Louvain Algorithm. This is used to measure how the communities have merged, showing that the astroturfing are meshing with the normal communities. 3. Narrative exposure to the other communities, measuring how the astroturfing narrative is heard by the other communities.
Furthermore, to validate the simulation system, we retrieve the trending hashtags of a self-hosted Mastodon 7 instance before and after the campaign. This aims at capturing the idea whether the campaign is wide-spread, and whether the recommendation system reflects the manipulation.
In fact, as reported in Viginum’s report about Romania’s elections, accounts part of an astroturfing campaigns manipulate recommendation systems by posting huge amounts of content that share specificities (e.g., keywords). As such, the astroturfing accounts are provided with a list of ten keywords that should appear later in the "trending" section of Mastodon. 4.1.3. Results Social network metrics The simulation highlights the diferences in circadian activity patterns between normal communities and astroturfing communities, as shown in Figure 4. The key findings are: • Normal communities activity follows a typical circadian rhythm, peaking during standard waking hours. • Astroturfing communities , however, exhibit heightened activity during of-peak hours (e.g., late at night or early in the morning), outside of the usual active periods of normal communities.
These results align with the observations of [
Relation dynamism during the simulation During the simulation, the "follow" relationship is updated based on past interactions with a user. Figure 5 shows that the account follow / unfollow is relatively stable, until the astroturfing attack starts at 12:00 on the second day. After that, there is a drastic increase in the number of follows, with the astroturfing massively following the normal account communities.
Automatic metrics such as modularity (given by the Louvain Algorithm) also show a drastic decrease from 0.60 to 0.20. This decrease means that communities are less segmented from a topological point of view and there is greater proximity between them.
Narrative exposure One of the metrics an attacker wants to track is how much their adversarial narrative has reached to the target, and in case of an astroturfing campaign, that their target is trapped within an echo chamber over the attackers’ narrative, giving the target a false sense of consensus.
This exposure enhances the efectiveness of the attack, aiming at causing kinetic impacts (tangible real-world damage, altering beliefs, eroding public trust, etc.), which grows likelier as the number of reached user increases. Figure 6 illustrates that during the of-hours, normal communities are flooded with messages from the astroturfing communities. As shown in the figure, a large percentage of the interactions are done by or towards astroturfing accounts. During normal hours, we see that these interactions account for 40% to 60%, which is consistent with a short time frame attack goal.
Moreover, as shown in Table 7a, the simulation influenced the trending hashtags, making their message available to the whole platform. In real life, the reach of this modification can be as great as the number of users in the networks; possibly millions.
However, simply increasing the total reach does not linearly augment the probabilities of altering
the target behaviour, reaching operational objectives (i.e., causing kinetic impacts). In fact, as reported
in [
For this part, the focus will be on how corrupted influencers can influence entire communities. To do so, the initial setup presented at Subsection 4.1 is restored, with the removal of the astroturfing communities in order to keep only the "normal" communities.
Among them, 14 (~2.6% of the accounts from the network) of the existing influencers are randomly selected (from Luminary, Celebrities, Opinion Leaders and Experts) to be the corrupted influencers, reproducing what happened in Romania’s elections (based on Viginum technical report). Finally, their topic interest is set to privilege "Elections", aiming to share their point of view across the whole graph. For the entire topic distribution, the initialisation setup can be seen in Table 2.
In order to track the reach of the messages pushed by the corrupted influencers, a first step is to
monitor the co-retweet, co-favourites and replies network across the simulation, similarly as in [
Akin to the precedent astroturfing TTP, the corrupted influencers become active only after a 36 hours delay, i.e., the second day at noon. 4.2.3. Results For this TTP, the goal is to observe how influencers, which are central in the graph, can influence the entire network towards specific topics. In real life, these influencers can be paid, used as useful idiots, or persuaded to spread propaganda over foreign states narratives.
With this limited number of influencers, Table 3 shows that shortly after the start of the attack, a large portion of the network starts to interact with them, highlighting their reach capabilities.
Over the first day, almost all nodes in the other communities interacted at least once with the influencers’ messages. This result means that these accounts can drive the chosen topics and make it trending over the platform, and give it a reach it did not have before. These interactions will drive up the interest rate of the specific chosen topic, which will cause additional engagement increase. Through Subfigure 8a, the average interest of the normal accounts grows way faster than the other interest rates after the start of the attack.
This increase in interest rate mechanically increases the number of interactions on these topics, as shown with Subfigure 8b. This subfigure also shows that while the number of interactions over Elections topic increases greatly after the start of the attack (the number of interaction mainly stays low before the attack), other topics are not impacted and stay at the same levels before and after the attack. This shows that the influencers drive the other communities over this particular topic, highlighting their impact.
These results show that a small number of influencers can influence entire communities, as highlighted in real life with Viginum’s report about the Romanian elections. The cognitive process of narrative (a) Rate of interest over topics across time. For the simu- (b) Number of interactions -posts, replies, favourites, lation, the threshold of activation is fixed at 0.60 retweets - (log scale) over topics across time. conversion was not modelled. In practice, however, influencers can persuade individuals to adopt their cause, potentially leading to kinetic decision-making.
We showed in this paper that our simulation is credible with the objectives of training against reproduced TTPs. However, we did not take into account all the social efects within the social networks.
Namely, for the decision to follow and unfollow, we did not introduce polarity over topics. In fact, one can be really interested in a topic but in an opposite way of others. This two-faced coin can be primordial in reproducing coherent follow updates (as aligned users tend to follow themselves more frequently than unaligned ones). Similarly, evolution in topic interest is also based on more socioeconomic variables, as well as cultural characteristics from individuals.
Furthermore, we simulated only five topics over a three days simulation, but real social networks contain way more parallel topics of discussion. Cross-interest between topics is also way higher in the real life, with topics impacting each others massively. We illustrated this capacity with light drops of interest on the second TTP, especially with the topic Immigration.
Moreover, reproducing credible full-scale attacks is far from trivial, as defenders do not have the full overview over what the attackers did, and especially what they wanted to do.
Finally, we did not evaluate the quality of the text generation in this work, but text is very important for conveying information in a specific manner. Attackers understand that importance, and play on sentiments such as fear or surprise to elicit reactions from users, maximising the impact of their campaigns.
In this paper, we presented a system used to simulate credible social networks, used to train specialised analysts against influence operations.
These analysts require the simulation of specific Tactics, Techniques, and Procedures (TTPs) to capitalise on existing knowledge and mitigate their impact. Enabling this simulation, we presented in this work a system generating realistic dynamic and controllable social graphs, allowing an end-user to parametrise TTPs to be reproduced. The system encompasses three distinct modules: the initial community generation, the community linking, and the information dissemination modules. The first module generates user accounts (nodes in a graph) of diferent types and their follower distribution, according to end-user parameters. The second module serves the purpose of defining how communities are linked, influencing how the simulation will unfold. Finally, the last module aims to simulate information difusion in a graph, adding multiple variables tailored to the specific needs of training against influence operations.
To illustrate the coherence of the simulation, we have compiled two distinct case studies. The first one simulated an astroturfing campaign that involved two bot-heavy communities attacking two normal communities. The second example is used to illustrate and analyse how paid influencers can influence entire communities, similar to COVID-19 pandemic disinformation campaigns. Through our results, we show that our simulations are coherent with the literature observations of reported attacks, and that the simulation is credible with respect to real platforms. This credibility allows trainers to use this system to enhance the trainees’ immersion and thus, the training efect.
During the preparation of this work, the authors used Mistral in order to perform grammar and spelling checks. After using these tools/services, the authors reviewed and edited the content as needed and take full responsibility for the publication’s content.