CBR-Based Decision Support Methodology for Cybercrime Investigation: Focused on the Data-Driven Website Defacement Analysis

Table 3

Characteristics and metadata of several different clusters derived from the clustering processing.

Cluster number	Ratio (%)	Description	Representative hacker (group)
0	7.84	The group uses Central European languages. They principally attacked against the profit organization and Linux-based OS in Western Europe.	JaMaYcKa, Super2li
1	8.16	The group uses Arabic and Cyrillic. They principally attacked against the organization that manages the network and Linux-based and Unix-based OS. Their attack region is distributed throughout Southern Europe, South America, Eastern Europe, and Southeast Asia.	BI0S
2	10.36	The group uses Central European languages. They principally attacked against the organization that manages the network and nonprofit organizations in Western Europe.	JaMaYcKa
3	9.33	The group uses Central European languages. They principally attacked against the profit organization and Windows-based OS in Western Europe.	1923Turk
4	25.36	The group uses Arabic and Chinese. They principally attacked against the profit organization and Windows-based OS in Western Europe.	EL_MuHaMMeD, federal-atack.org
5	1.73	The group uses Central European languages. They principally attacked against the profit organization and Unix-based OS in Southern Europe and Eastern Europe.	d3b∼X, SuSKuN
6	5.24	The group uses Central European languages. They principally attacked against the profit organization, the educational institution, the government and state agencies, and also Windows-based OS in East Asia.	1923Turk
7	15.93	The group uses Arabic, Chinese, and Turkish. They principally attacked against the profit organization and Linux-based OS in Western Europe.	Rya, iskorpitx
8	9.11	The group uses Central European languages. They principally attacked against the profit organization and Windows-based OS in Western Europe.	1923Turk
9	3.63	The group uses Central European languages. They principally attacked against the profit organization and Linux-based OS in South America and Eastern Europe.	Hmei7
10	1.39	The group uses Central European languages. They principally attacked against Windows-based OS in South America and Southeast Asia. Their attack target is mostly the educational institution and the government and state agencies.	BHS, F4keLive
11	1.92	The group uses Arabic and Central European languages. They principally attacked against the profit organization and Windows-based OS in Southern Europe.	EL_MuHaMMeD, linuXploit_cre