<b>The weaving of cyber defenses: data-driven cybersecurity policy</b>
Creators: name: Yi, Shanshan
Publisher: name: figshare
Year: 2025
Subjects: classificationCode: 460402
subject: Data and information privacy
classificationCode: 460407
subject: System and network security
classificationCode: 460403
subject: Data security and protection
classificationCode: 460499
subject: Cybersecurity and privacy not elsewhere classified

description: With the increase of cybercrime around the world, there is an urgent need to develop effective security policies. In order to solve this problem, we collected a variety of data and developed several mathematical models, which led to some informative conclusions.For Task 1, we first use data from the VCDB and FireHOL blocklist databases to de-fine indicators such as Cybersecurity Incident Rate(CIR), cybercrime IP, and Cybercrime Success Rate (CSR) from the perspectives of attack targets, initiators, and resistance. We found that cybercrime rates are highest in North America, Europe, and Asia-Pacific. The top six regions for cybercrime IP are the U. S., China, Australia, Japan, South Africa, and the U. K., while countries like the U. S., Austria, and Belgium have lower crime success rates. Next, we validated our findings using cybersecurity indices(GCI,NCSI,CEI) and identified countries/ regions that may cover up or delay reporting cybercrime by defining a ratio in-dicator(PR). Finally, we used a GMM clustering mode to categorize countries into high, medium, and low cybersecurity levels, revealing that high-risk countries generally perform worse on indicators such as the GINI index, Internet usage, and GDP growth.For Task 2, we developed the Cybersecurity Policy Effectiveness Identification (CPEI)model, consisting of 2 sub-models, PELT-SI and LDA-PC. The PELT-SI model detects crisis cycle stages by identifying change points, while the LDA-PC model classifies policies by key themes. We then applied the CPEI model to analyze U. S. policy trends at different stages. The results showed that supply-side policies dominated in the" pre-crisis, "" stable, " and" in-crisis"stages (54.22%,58.76%,72.90%, respectively), while environmental policies took the lead in the" post-crisis" stage(52.38%). A two-way ANOVA confirmed significant policy differences across these stages. Finally, we analyzed the policy trends of Suriname and compared with those in the United States.For Task 3, we developed the PXGSE model, using 15 indicators across social, economic, political, and technological dimensions to explore the drivers of cybercrime. Pearson cor-relation analysis revealed significant links between factors such as Internet penetration (0.81), government efficiency (0.71), international cooperation (-0.69), and Gini coefficient(0.75) with cybercrime rates. After applying PCA to reduce data redundancy, we used LPO-XGBoost to analyze feature importance, finding that factors like income inequality and AI innovation increase cybercrime rates, while political factors like regulatory quality reduce them. Finally, we established the S-SEM model to quantify the direct and indirect effects of these factors on cybercrime. It is found that while the direct impact of social factors on cybercrime is small(0.23), the indirect impact through technological factors is large (0.82).Finally, we conducted sensitivity analysis on PELT-SI and SEM models, confirming their stability and robustness, and provided a memo with key findings and recommendations.