Research Article

CBR-Based Decision Support Methodology for Cybercrime Investigation: Focused on the Data-Driven Website Defacement Analysis

Algorithm 1

Similarity measure module.
Input: TCs(Tested_DB)/ The Tested_DB indicates the cases-centric DB /
RC (Retrieved_Case) ⟵ {}/ RC means one of the retrieved cases. /
W (Weight) ⟵ {}
Output: Similarity_score
(1)TC{} ⟵ TCs
(2)While RC in TCs do
(3)if  = =  then
(4)  Encoding_similarity_value ⟵ 1.0
(5)else
(6)  Encoding_similarity_value ⟵ 0.0
(7)end
(8) {, , }, {, , }
(9)if ( = = ) ∥ ( = = )  ∥ ( = = ) ∥ ( = = ) then
(10)  IP_similarity_value ⟵ 1.0
(11)else if ( = = ) ∥ ( = = ) ∥ ( = = ) then
(12)  IP_similarity_value ⟵ 0.75
(13)else if ( = = ) ∥ ( = = ) then
(14)  IP_similarity_value ⟵ 0.5
(15)else if ( = = ) then
(16)  IP_similarity_value ⟵ 0.25
(17)else
(18)  IP_similarity_value ⟵ 0.0
(19)end
(20)   {, , }, {, , }
(21)if an identical domain then
(22)  Domain_similarity_value ⟵ 1.0
(23)else if ( = = ) ∥ ( = = ) ∥ ( = = ) then
(24)  Domain similarity_value ⟵ 0.8
(25)else if ( = = ) ∥ ( = = ) then
(26)  Domain_similarity_value ⟵ 0.3
(27)else if ( = = ) then
(28)  Domain_similarity_value ⟵ 0.1
(29)else if ( = = ) then
(30)  Domain_similarity_value ⟵ 0.1
(31)else if ( = = ) then
(32)  Domain_similarity_value ⟵ 0.1
(33)else
(34)  Domain_similarity_value ⟵ 0.0
(35)end
(36)  Date_variance ⟵ | ― |/ It converts a date format year, month and day (i.e., yyyy-mm-dd) into a day calculated with numeric. /
(37)if 0 ≤ Date_variance ≤ 365 then
(38)  Date_similarity_value ⟵ 1.0
(39)else if 365 < Date_variance ≤ 1095 then
(40)  Date_similarity_value ⟵ 0.75
(41)else if 1095 < Date_variance ≤ 1825 then
(42)  Date_similarity_value ⟵ 0.5
(43)else if 1825 < Date_variance ≤ 2555 then
(44)  Date_similarity_value ⟵ 0.25
(45)else if 2555 < Date_variance then
(46)  Date_similarity_value ⟵ 0.0
(47)end
(48)if  = =  then
(49)  OS_similarity_value ⟵ 1.0
(50)else
(51)  OS_similarity_value ⟵ 0.0
(52)end
(53)Similarity_score ⟵ (Encoding_similarity_value × ) + (IP_similarity_value × ) + (Domain_similarity_value × ) + (Date_similarity_value × ) + (OS_similarity_value × )
(54)return Similarity score between RC and TC
(55)end while