AI-Based Cybercrime Attribution Using Probabilistic Clustering and Regularized Multi-Output Learning

Cybercrime attribution remains a complex challenge due to the dynamic and ambiguous nature of attacker behavior. This study proposes a probabilistic framework for cybercrime attribution that combines Gaussian Mixture Model (GMM) clustering with regularized soft-label learning to identify latent attacker groups and model uncertainty in behavioral patterns. Using a cybersecurity intrusion dataset, clustering performance was optimized through silhouette analysis and stability evaluation, achieving the best configuration at two clusters (silhouette = 0.415, stability ARI = 0.956). The resulting probabilistic cluster memberships were used to train a multi-output Ridge regression model, which demonstrated strong generalization performance (Test Macro F1 = 0.964, CV F1 = 0.972 ± 0.005) with minimal overfitting. Feature analysis and statistical testing revealed that dynamic behavioral indicators, such as session duration and traffic intensity, significantly differentiate attacker groups, while static indicators contribute less. The findings identify two primary attacker archetypes: high-intensity network attackers and stealthy credential-based attackers. From a cyberlaw perspective, the proposed approach supports confidence-based attribution and enhances the transparency and reliability of digital forensic analysis. However, it emphasizes that probabilistic outputs should be interpreted as supporting evidence rather than definitive identification, highlighting the importance of uncertainty-aware AI systems in legal contexts.