CBR-Based Decision Support Methodology for Cybercrime Investigation: Focused on the Data-Driven Website Defacement Analysis

Table 5

Follow-up investigation on the top three hackers with website defacement cases most similar to the DS case and SPE case. The case vector value means the hacker’s attack rate.

Domain	DS case			SPE case
	Hmei7	d3b_X	StifLer	Oaddah	M@TRiX	EL_MuHaMMeD
Com	78.32	85.81	100.00	100.00	86.27	82.98
Edu	1.62	0.96	—	—	1.76	1.91
Net	3.40	3.20	—	—	5.46	5.74
Gov	12.16	6.51	—	—	1.06	—
Year	Hmei7	d3b_X	StifLer	Oaddah	M@TRiX	EL_MuHaMMeD
2002	—	—	—	—	10.74	—
2003	—	—	—	—	89.08	—
2006	—	—	—	—	—	—
2007	0.09	—	—	—	0.18	—
2008	—	—	—	—	—	—
2009	3.15	—	—	—	—	99.57
2010	0.09	—	—	—	—	—
2011	0.34	—	—	—	—	—
2012	3.40	—	—	100.00	—	—
2013	34.86	39.17	100.00	—	—	—
2014	58.08	59.77	—	—	—	0.43
2015	—	1.07	—	—	—	—