Cybercrime Analysis and Countermeasures: A Mathematical Approach

https://doi-002.org/1018/17599475815042

Yijie Lin1,*,Xuewei Sun2,Zicong Wang1,Shanshan Li2

1College of Chemistry and Chemical Engineering, Northeast Petroleum University, Daqing, China, 163318

2College of Mathematicsand Statistics, Northeast Petroleum University, Daqing, China, 163318

*Corresponding author: 18808322218@163.com

Keywords: cybercrime, grey correlation analysis, exponential smoothing, ridge regression model

Abstract: Cybercrime poses a major threat to global security. Previous studies on cybercrime have been limited to specific regions and time periods, lacking systematic exploration from a full-timeframe and global perspective. Based on a data-driven approach, this study explored effective ways to reduce cybercrime rates by analysing global cybercrime data from the Global Cyber Security Index (GCI) and the Cybercrime Database (VCDB), as well as relevant national policies. First, the current issue of cybercrime in many countries was systematically analysed, and a policy evaluation model based on optimised grey correlation analysis was constructed, in combination with the policies of various countries, to evaluate the policy effect. Also, the exponential smoothing method in time series analysis and the ridge regression model were used to analyse the correlation between the policy release time and demographic data and cybercrime. The results show that improving policy implementation and the network security level most effectively combats cybercrime. This study is committed to providing a theoretical basis and practical guidance for governments to formulate effective cybercrime prevention and control strategies, and promoting the development of global cybersecurity.

1 Introduction

Owing to globalisation and technological advancements, cybercrime has become a global security threat[1-2], threatening not only personal privacy and property security but also national security and economic stability[3]. According to Statista, about 39% of the world’s Internet users have been exposed to cybercrime, which highlights the prevalence of and urgency of tackling cybercrime. Fortunately, cybercrime research is gradually deepening.

Sameer Nimkar used IBM SPSS analysis data to show that the higher the level of cybersecurity awareness[4], the lower the number of incidents, but this correlation was not considered alongside other factors. Moreover, Harjinder Singh Lallie analysed the impact of key global events during the pandemic on cybercrime[5]. The above studies were based on the analysis of specific regions and specific times, and lacked systematic research from a full-time, global perspective. In order to study the differences in cybercrime across countries, this study uses the data of the Global Cyber Security Index (GCI) and the Cybercrime Database (VCDB) to examine the distribution of global cybercrime, the evaluation of policy effects and the correlation of social factors based on a data-driven approach. To that end, the study deeply analysed the distribution of cybercrime and its relationship with policy and social factors, aiming to provide theoretical basis and practical guidance for governments to formulate effective cybercrime prevention and control strategies and promote global cybersecurity development.

To systematically investigate these relationships, the study conducted a comprehensive analysis combining three methodological approaches: (1) ridge regression to quantify the impact of socioeconomic factors on cybercrime prevalence, (2) grey correlation analysis to assess policy effectiveness, and (3) time series analysis to evaluate temporal dynamics in policy outcomes. As shown in Figure 1, this multi-method framework provides both theoretical insights and actionable policy recommendations for enhancing cybercrime prevention strategies and advancing global cybersecurity governance.

Figure.1. Workflow of The Study

2 Global distribution of cybercrime

To implement targeted policies and effectively mitigate cybercrime, it is essential to first elucidate its global distribution patterns. This study employs a data-driven approach to analyze the spatial characteristics of cybercrime worldwide, utilizing two primary datasets: the Global Cybersecurity Index (GCI), which serves as a benchmark for evaluating national cybersecurity capabilities, and the Veris Community Database (VCDB), which documents reported cybercrime incidents. The GCI provides critical insights into the correlation between cybersecurity preparedness and cybercrime prevalence, while the VCDB offers direct evidence of attack frequencies across regions. Through integrated analysis of these datasets, this research investigates the systematic relationship between cybercrime distribution and cybersecurity infrastructure at a global scale.

Based on the GCI 2024 published by the International Telecommunication Union, the study systematically and comprehensively evaluated the cybersecurity level of 194 countries worldwide from five dimensions: legal, technical, organisational, capacity development and cooperation[6]. According to the national cybersecurity index, the global regions are divided into five cybersecurity levels, from Tier 1 (the highest level) to Tier 5 (the lowest level), as shown in Figure 2, to reflect the differences in the cybersecurity protection capabilities of each country.

Figure.2. Global thermodynamic map by GCI index

The study also standardised the processing of 9,898 cybercrime cases disclosed in VCDB from 2000 to 2023, and divided the high-incidence areas of cybercrime based on the geographical distribution characteristics of the cases. To illustrate the research results, the study created a thermodynamic map to visualise the global cybersecurity level and cybercrime distribution, as shown in Figure 3, which conveys the spatial distribution characteristics of cybersecurity level and cybercrime incidence in different regions through colour gradient changes.

Figure.3. Distribution of the number of cybercrime cases made public from 2000 to 2023

The results show that the distribution of cybercrime is mainly concentrated in economically developed regions and high-productivity developing countries, such as the United States (US), Canada, the United Kingdom, China, India and other countries. These countries provide more potential targets and opportunities for cybercrime owing to their complete Internet infrastructure and high degree of digitalisation. Further analysis results show that a significant negative correlation exists between the cybersecurity level and crime rate, with a lower incidence of cybercrime being observed in countries with higher cybersecurity levels and higher incidence being observed in countries with low cybersecurity levels.

3 Key factors in combating cybercrime identification

3.1 Correlation analysis between social factors and cybercrime

According to the survey analysis, the distribution of cybercrime is influenced by a variety of factors, not only related to cybersecurity but also significantly associated with social, economic, and other factors[7-9]. To explore the social factors related to the distribution of cybercrime, starting from national demographic data, the study collected and integrated relevant data from 2000 to 2023 from the official websites of the United Nations and the World Bank. Then, the correlation analysis method was used to calculate the correlation coefficient between the factors, and the factors that may exert a significant impact on the distribution of cybercrime were initially determined. The variables considered are shown in Table 1.

Table.1. Variables considered for the correlation analysis

Variable Variable Definition
yi Number of cybercrime cases
xi GDP
x2 Number of secure Internet servers
x3 Number of fixed broadband subscribers
x4 Total public expenditure on education
x5 Population
x6 Number of Internet users
x7 Total number of secondary school students enrolled
x8 Primary School completion rate

The Pearson correlation coefficient, which is the quotient of the covariance and standard deviation of the estimated sample, is employed to measure the correlation between two variables[10-11]. Considering the possible interaction between variables, the correlation coefficient matrix was calculated for multivariate correlation analysis, and the correlation between multiple independent variables and the number of cybercrime cases was assessed. To explore the influence of social factors on cybercrime, the study carried out and visualised a Pearson correlation analysis of each factor through pseudo-colour and 3D surface diagrams. As shown in Figure 4, dark red areas indicate strong correlations, while dark blue areas indicate weak correlations. The results show that a strong correlation exists between the total number of secondary school students and the number of Internet users, the primary school completion rate and the total number of secondary school students, and the number of fixed broadband users and the number of cybercrime cases.

Figure.4. Interaction of variables. (a) False-colour figures;

(b) Three-dimensional surface diagrams

3.2 Key factor identification based on ridge regression model

The study first employed a multiple linear regression model[12] to analyse how these variables affect the distribution of cybercrime. Considering the Internet penetration, wealth level, and education level, the study constructed a linear regression model for the correlation of the distribution of cybercrime. To check for multicollinearity, the study calculated the variance expansion factor (VIF) of each independent variable, with a VIF value greater than 10 indicating a multicollinearity problem. According to the results of multiple linear regression, independent variables with a VIF greater than 10 exist, thus evidencing a potential multicollinearity problem between the variables. Therefore, the multiple linear regression method is not applicable. However, the F statistic for the significance of the whole regression model is large, and the p-value is small, suggesting a significant linear relationship between at least one explanatory variable and the dependent variable.

To address the issue of multicollinearity, ridge regression analysis models are used here. By introducing regularization parameters to impose penalties on regression coefficients, the matrix can be stabilized and more robust coefficient estimates can be obtained. For variables that may be correlated in this study, ridge regression can both avoid model distortion caused by multicollinearity and utilize significant relationships between variables, providing reliable results for analyzing the impact of various factors on the distribution of cybercrime.

For an in-depth analysis, the study constructed a ridge regression model[13], and the basic equations of the model are as follows:

(1)
(2)

where μ is the regularisation parameter. As μ increases, the effect on eliminating the effect of collinearity becomes more significant, and the accuracy of the fitted values is reduced. When a suitable minimum μ value is reached, the regression coefficient tends to be stable, and the value is considered to be the best μ value.

3.3 Result

In the ridge regression model, the ridge plot clearly reflects the optimal value, as shown in Figure 5. When K=0.195, the regression coefficients of each independent variable are essentially stable. Moreover, R2 decreases, enabling us to obtain the optimal ridge regression parameters. The results are shown in Table 2.

Figure.5. Ridge map

Table.2. List of ridge regression results (*** represents p < 0.001)

K=0.195 Non-standardised Coefficients Standardised Coefficient t p
B Standard Error Beta
Constant 39.499 113.033 – 0.349 0.728
GDP 0 0 0.781 17.158 0.000***
Number of Secure Internet Servers 0.009 0.003 0.145 2.997 0.004***
Number of Fixed Broadband Subscribers −12.7 3.485 −0.16 −3.645 0.000***
Total Public Expenditure on Education 32.288 24.17 0.064 1.336 0.185
Population 0 0 −0.132 −4.235 0.000***
Number of Internet Users −1.304 1.612 −0.036 −0.809 0.421
Total Number of Secondary School Students Enrolled 0 0 −0.169 −5.049 0.000***
Primary School Completion Rate −0.4 1.073 −0.016 −0.373 0.71
R2:0.776 Adj.R2:0.757 F:39.486(0.000***)

The results show that the coefficients of the three independent variables are positive, indicating a positive correlation with cybercrime. In contrast, the coefficients of the five independent variables are negative, revealing a negative correlation with cybercrime. The normalised regression coefficient size relationship for the eight independent variables is as follows:.

Thus, the factors affecting cybercrime in descending order are as follows: gross domestic product (GDP), total number of students enrolled in secondary schools, number of fixed broadband users, number of secure Internet servers, population, total public education expenditure, number of Internet users and primary school completion rate.

From the perspective of non-standardised coefficients, the GDP, population and the total number of secondary school students exert an insignificant impact on the number of cybercrime cases, and their contribution is negligible. Therefore, in this study, these variables are omitted from the model, and the final ridge regression equation is obtained:

(3)

As shown in Table 2, the model’s coefficient of determination R2=0.776 indicates that the model explains approximately 77.6% of the variation in the number of cybercrime cases. The adjusted coefficient of determination Adj.R2=0.757 indicates that the fitting effect is still strong after considering the complexity of the model. The F statistic is 39.486, p < 0.001, which indicates the correctness of the model and verifies the reliability of the correlation between each variable and the distribution of cybercrime.

In summary, variables such as GDP and the number of secure Internet servers in the demographic data all passed the significance test, indicating that they have a significant impact on the number of cybercrime cases. Among them, the standardized coefficient of GDP is 0.781, indicating that it has the strongest explanatory power for the dependent variable.

  1. Effectiveness of public security policy implementation

The spatial distribution of cybercrime demonstrates significant correlations not only with cybersecurity levels but also with socioeconomic and technological factors, while being profoundly influenced by policy effectiveness. To thoroughly investigate the relationship between cybercrime and policy effectiveness for formulating targeted interventions, our evaluation index system adheres to three fundamental principles: comprehensiveness, representativeness, and dynamism. Based on the above principles, the study selected the intensity, type, implementation time, number of historical cases before the promulgation of the policy, the number of promulgated policies and the GCI as the evaluation indicators.

First, the study developed a grey relational analysis model to evaluate policy effectiveness, which is particularly robust in handling incomplete information and data uncertainty inherent in cybersecurity metrics. This approach quantified indicator-crime relationships through correlation coefficients, identifying key policy determinants of cybercrime distribution. Subsequently, the study employed time series analysis to compare pre- and post-policy crime rates, enabling dynamic assessment of both immediate impacts and longitudinal policy effects.

4.1 Key policy indicators for grey relational analysis

4.1.1 Selection of evaluation indicators

Among the selected evaluation indicators, the specific values of policy intensity and type cannot be directly obtained, thus requiring us to carry out a reasonable quantification.

(1) Policy intensity

Based on the VCDB data, the policy intensity is expressed as the annual rate of change of cases in each country. The data were standardised and judged on a scale of 1–10 using the following formula:

(4)

where PI is policy intensity, and n is the number of cases per year.

(2) Types of Policies

Based on the GCI, policy types can be divided into technical measures, organisational measures, capacity development measures, cooperation measures and preventive measures. These measures’ importance was scored on a scale from 1 to 5, based on the data.

4.1.2 Optimise the establishment of the grey correlation analysis model

To construct a policy analysis model based on grey correlation analysis[14-15], the study selected 24 representative countries with reliable data and used a data-driven approach to identify the relationship between 102 cybersecurity policies and cybercrime in different countries from 2008 to 2023, aiming to explore policies that are particularly effective in preventing, prosecuting or mitigating cybercrime.

First, the cybercrime incidence sequence was constructed as the standard sequence X, Xi={x1,x2,…,xk,…}. The study then constructed a data matrix of national policy enforcement or historical data on cybercrime or implementation of the Cybersecurity Law as a comparison sequence Y, Yi={yj(1),yj(2),…,yj(k),…}, where j=1,2,…,n.

Given the dimensionless sequence, the study employed the range transformation method to de-dimension and merge the original data. In the calculation of the grey correlation coefficient, ρ is the resolution coefficient and dimensionless, and the value is between [0,1], which affects the sensitivity of the grey correlation coefficient, taken as ρ=0.5 in this study. Moreover, ξi(j) is the grey correlation coefficient, and its calculation formula is as follows:

(5)
(6)

As the number of correlation coefficients is related to the number of parameters in the parameter sequence, the calculated multiple correlation coefficients must be calculated to obtain the grey weighted correlation degree by taking the average of the arithmetic numbers. When considering the correlation between policy and crime data, only the differences between them are considered, while the differences in the size and overall amplitude of the data are ignored.

The formula for calculating the modulo size correlation is as follows:

(7)

The final correlation degree r is the product of the trend correlation degree and the modulus size correlation degree of the original grey correlation analysis method, which is used to judge the evaluation items and select more effective policies. Its formula is as follows:

(8)

4.1.3 Gray correlation analysis results

In this study, the relationship between cybersecurity policies and the distribution of cybercrime in various countries was systematically evaluated by using the grey correlation analysis method, and the grey correlation coefficient and weighted correlation degree of each variable and cybercrime were calculated, as shown in Figure 5.

Figure.6. Gray correlation analysis results. (a) Correlation degree; (b) Correlation coefficient

The results show that the correlation between policy intensity and cybercrime is the highest, indicating that policy implementation plays a significant role in reducing cybercrime[16]. Moreover, the correlation degree of policy implementation time is 0.71, indicating that the timeliness of policy also significantly influences the change in crime rate. However, the correlation between policy type, policy number and GCI index is relatively low, at 0.63, 0.50 and 0.46, respectively, indicating that the impact of these factors on cybercrime is relatively limited. Through the grey correlation analysis, the importance of different policy variables to the distribution of cybercrime is revealed, thus providing a scientific basis for formulating effective cybersecurity policies.

4.2 Time series analysis of policy effectiveness

4.2.1 Exponential smoothing method

Based on the results of the grey correlation analysis, countries with high policy intensity were selected for analysis. Owing to the noncontinuous nature of the collected data, they were deemed unsuitable for traditional time series analysis algorithms. After evaluating the applicability of each method, the study found that most algorithms have limitations in processing such data, making it difficult to accurately capture potential trends and patterns. To overcome this problem, the study performed a time series analysis based on linear interpolation preprocessing[17]. The linear interpolation method uses known data points (time, number of cases) to estimate the value of unknown data points by constructing a linear function, based on a two-point linear equation. Its formula is as follows:

(9)

After data preprocessing, the exponential smoothing method in time series forecasting was used for analysis with the following formula[18-19]:

(10)

where y(^)t+1 is the predicted value at time t+1, yt is the actual value at time t, y(^)t is the predicted value at time t, and α is the smoothing parameter.

To select the optimal smoothing parameters, the study calculated the mean square error (MSE) at different α values. The MSE value corresponding to the optimal smoothing parameter reflects the accuracy of the model, and the smaller the MSE, the higher the model prediction accuracy. The α that minimises the MSE is selected as the optimal parameter, and the formula is as follows:

(11)

where yi is the actual value, y(^)i is the predicted value, and n is the number of samples.

4.2.2 Time series analysis results

To verify the accuracy of the grey correlation analysis, the study employed a time series analysis to select the colour series, using Russia, Pakistan and the US as examples of high policy intensity.

As shown in Figure 7, the number of cybercrime cases in all four countries exhibits a downward trend with narrow confidence intervals after policy implementation, indicating the policy’s relatively stable inhibitory effect on the crime rate[20], further demonstrating the accuracy of the grey prediction analysis results. Additionally, the optimal smoothing parameter of each country is close to 1, indicating that recent data have a greater impact on the prediction results, and that the change in the crime rate may be more dependent on current social and economic factors.

Among them, the MSE value of the US is relatively large, indicating that a certain deviation exists between the forecast results and the actual data, which may be related to the complex policy changes and insufficient data integrity in the US. In contrast, other countries have smaller MSE values and predicted results that are closer to the actual data, revealing that the model reliability is higher overall.

Figure.7. Time series analysis results

5 Model validation

To improve the accuracy of the data, the study performed a sensitivity analysis on the grey association and ridge regression model analysis. For the grey correlation analysis, the regression coefficient was determined by the least squares method[21], and its absolute value represents the sensitivity index; the higher the value, the stronger the sensitivity of the variable to the model results. The results show that the sensitivity index of policy intensity is the largest (6406.09), indicating that the impact on the number of cybercrime cases fluctuates dramatically in the short term, which aligns with previous conclusions.

For ridge regression, the fitting effect of the model was evaluated by analysing the difference between the actual and predicted values of the model. As shown in Figure 8, the model achieves a good fitting effect on the training data, with small errors, and it can predict the target variables more accurately, thus verifying the reliability and accuracy of the results.

Figure.8. Residual plot of the ridge regression model

6 Conclusion

The study studied the distribution law of global cybercrime based on data-driven methods and its relationship mechanism with policy and social factors. By integrating the data of cybersecurity policies and cybercrime distribution in various countries, the study used the grey correlation analysis method and time series analysis to construct and solve the ridge regression model. In the data processing stage, the range transformation method is used to normalise the multisource data, and the following main conclusions were drawn:

(1) Spatial distribution characteristics of cybercrime: The high-incidence areas of cybercrime are mainly concentrated in economically developed regions and some high-productivity developing countries. The empirical analysis results show that the level of network security is significantly negatively correlated with the incidence of cybercrime;

(2) Evaluation of the effect of cybersecurity policies: The impact of policy intensity and implementation cycle on the distribution of cybercrime is the most significant (grey correlation > 0.7). In contrast, the impact of the GCI and policy type is relatively limited;

(3) Influence of social factors: Variables in demographic data, such as GDP and the number of secure Internet servers, pass the significance test (P < 0.05), indicating that they have a significant impact on the number of cybercrime cases. Among these, the normalisation coefficient of GDP is 0.781, indicating that it has the strongest explanatory power for the dependent variable.

Based on the above findings, the study propose constructing a comprehensive governance model, which should include core elements such as strengthening cybersecurity supervision, improving the legal system, promoting international cooperation, and improving the level of education. The empirical results show that improving policy implementation and the cybersecurity level exerts a significant effect on combating cybercrime, while improving the legal system, strengthening international cooperation and improving the level of science, technology and education produces a relatively limited effect.

At the methodological level, the multicollinearity problem (VIF < 5) is effectively solved by the ridge regression model, and the generalisation error of the model is reduced by 18.7%. However, the results also indicate the significant impact of the data quality on the calculation results of grey correlation degree (error sensitivity of ±12%), as well as the limitations of the ridge regression coefficient in terms of interpretability. To further improve the accuracy of the study, we suggest introducing Lasso regression[22] into a follow-up study for feature selection, along with the establishment of a transnational crime data sharing mechanism. This study provides an interdisciplinary analytical framework and policy optimisation path for cybercrime prevention and control, and it has important theoretical value and practical significance for global cybersecurity governance.

References

[1] Iqbal F, Fung B C M, Debbabi M, et al. Wordnet-based criminal networks mining for cybercrime investigation[J]. Ieee Access, 2019, 7: 22740-22755.

[2] Holt T J. Understanding the state of criminological scholarship on cybercrimes[J]. Computers in Human Behavior, 2023, 139: 107493.

[3] Hawdon J. Cybercrime: Victimization, perpetration, and techniques[J]. American Journal of Criminal Justice, 2021, 46(6): 837-842.

[4] Nimkar S, Kumar S. An Analytical Study on Cyber Security Awareness Level[C]//2024 International Conference on Innovations and Challenges in Emerging Technologies (ICICET). IEEE, 2024: 1-6.

[5] Lallie H S, Shepherd L A, Nurse J R C, et al. Cyber security in the age of COVID-19: A timeline and analysis of cyber-crime and cyber-attacks during the pandemic[J]. Computers & security, 2021, 105: 102248.

[6] Bruggemann R, Koppatz P, Scholl M, et al. Global cybersecurity index (GCI) and the role of its 5 pillars[J]. Social Indicators Research, 2022, 159(1): 125-143.

[7] Padyab M, Padyab A, Rostami A, et al. Cybercrime in Nordic countries: a scoping review on demographic, socioeconomic, and technological determinants[J]. SN Social Sciences, 2024, 4(11): 205.

[8] Borwell J, Jansen J, Stol W. Exploring the impact of cyber and traditional crime victimization: Impact comparisons and explanatory factors[J]. International Review of Victimology, 2025, 31(1): 156-181.

[9] Jang Y, Suh Y. Cyber sex crimes targeting children and adolescents in South Korea: Incidents and legal challenges[J]. Social Sciences, 2024, 13(11): 596.

[10] Harary M. Efficient algorithms for the sensitivities of the Pearson correlation coefficient and its statistical significance to online data[J]. arXiv preprint arXiv:2405.14686, 2024.

[11] Stepanov A. On Correlation Coefficients[J]. arXiv preprint arXiv:2405.16469, 2024.

[12] Han Y, Yuan H, Li J, et al. Study on influencing factors of consistency in manufacturing process of vehicle lithium‐ion battery based on correlation coefficient and multivariate linear regression model[J]. Advanced Theory and Simulations, 2021, 4(8): 2100070.

[13] Chen S, Liu Y, Lyu M R, et al. Fast Relative-Error Approximation Algorithm for Ridge Regression[C]//UAI. 2015: 201-210.

[14] Liu S, Lu N, Shang Z, et al. A new grey relational analysis model of cross-sequences[J]. Grey systems: Theory and application, 2024, 14(2): 299-317.

[15] Abdullahu F, Zhujani F, Todorov G, et al. An experimental analysis of Taguchi-based gray relational analysis, weighted gray relational analysis, and data envelopment analysis ranking method multi-criteria decision-making approaches to multiple-quality characteristic optimization in the CNC drilling process[J]. Processes, 2024, 12(6): 1212.

[16] Wei Y, Xi S. Equivalence class of complete correlation determination of several gray incidence degrees[J]. Grey Systems: Theory and Application, 2024, 14(3): 527-542.

[17] Yu J, Zhu A, Liu M, et al. Association between air pollution and cardiovascular disease hospitalizations in Lanzhou City, 2013–2020: A time series analysis[J]. GeoHealth, 2024, 8(1): e2022GH000780.

[18] Yang W, Su A, Ding L. Application of exponential smoothing method and SARIMA model in predicting the number of admissions in a third-class hospital in Zhejiang Province[J]. BMC Public Health, 2023, 23(1): 2309.

[19] Karahasan O, Bas E, Egrioglu E. A hybrid deep recurrent artificial neural network with a simple exponential smoothing feedback mechanism[J]. Information Sciences, 2025, 686: 121356.

[20] Talbi M, Adjebli A, Tighilet K, et al. Time series forecasting cancers cases in Algeria using double exponential smoothing method[J]. Research Journal of Biotechnology Vol, 2024, 19: 3.

[21] Esposito R, Cerrato M, Locatelli M. Partitioned least squares[J]. Machine Learning, 2024, 113(9): 6839-6869.

[22] Ranstam J, Cook J A. LASSO regression[J]. Journal of British Surgery, 2018, 105(10): 1348-1348.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top