Cyber Crime Nation Typologies: K-Means Clustering of Countries Based on Cyber Crime Rates

Abstract

IntroductionA disproportionate amount of the cyber crime attacks worldwide are accounted for by a minority of countries (Spamhaus, 2016). Many reports, mostly by cyber security firms, regularly conduct rankings of nations based on being top sources of cyber crime activity and attacks2. Nations are differentiated based on the particular type of cyber crime or offense that they are associated with (APWG, 2014; Ultrascan, 2014; V.I. Labs, 2014).However, most of the reporting is univariate and descriptive, offering a simple unidimensional listing of nations by rank via one metric at a time. The reports also offer little in the way of also ranking nations in the context of non-cyber crime variables, such as economic and technological metrics at the national level. There have been some multivariate macro-level cyber crime studies at the national level, which seek to identify inferential predictors of cyber crime rates between nations (Kigerl, 2013; 2016).Among some of the multivariate studies conducted, the degree of internet connectivity within a nation has been found to consistently predict higher levels of multiple cyber crime types, including fraud, malware, spam, and digital piracy (Kigerl, 2013; 2016). Nations that are the source of spam and digital piracy are also more likely to be wealthier countries, measured in the form of a nation's gross domestic product (GDP). However, the findings are more mixed in regards to GDP's relationship to fraud and malware.Yet these studies say little about how specific nations specialize in cyber crime, or how nations can be grouped under different typologies with varying cyber crime profiles. Predictors linked to cyber crime outcomes are assumed to be equally predictive across nations. The present research cannot describe the distinct differences between nations, only between variables.The present research seeks to address this gap by performing K-means clustering analysis at the national level among 190 countries using seven cyber crime variables capturing fraud, malware, spam, and digital piracy, as well as each nation's GDP and internet use per capita. The results are intended to better understand the differences between individual countries by assigning them to discrete categories, rather than identifying the general relationship of various economic, technological, and legal differences between nations on cyber crime outcomes. Via clustering analysis techniques, nations may be grouped together with similar nations, attempting to identify if certain countries specialize in cyber crime, or act as cyber crime generalists.Cyber crime differences between CountriesThe internet is scattered with many reports and posts about the top cyber crime countries, the biggest source of cyber attacks, and the most likely home of residence for cyber criminals themselves. Multiple cyber security firms regularly release detailed reports on the state of cyber crime activities within their networks, often including a section on countries. Symantec has created an index of cyber crime activity that includes hosting malware, botnets, phishing server hosting, and how many botnet command and control (C&C) servers there are within each nation. The top Five nations on this index include the US, China, Brazil, Germany, and India. Russia is seventh (Fossi, Turner, Johnson, Mack, Adams, et al., 2010).The harms of the various cyber crimes are well advertised in such reports. Email spam is a common attack vector for multiple types of cyber crime (Rao & Reiley, 2012). Today, spam makes up 72% of all emails sent worldwide (Gudkova, 2013). Over half of all internet traffic in general not just that of email traffic, is actually spam (Lachhwani & Ghose, 2012). Loss of human resources due to the nuisance of spam was estimated to be at $22 billion in 2004 (Lachhwani & Ghose, 2012). Some of the top spam sending countries include China, Brazil, the United States, and Russia (Project Honey Pot, 2016). …