Behavioral and Demographic Data-Driven Cybersecurity Risk Classification Using K-Means Clustering on Active Internet Users

Table 3 shows related research of the study. These studies demonstrate the need for an integrated strategy that combines human-centered tactics with technology solutions for effective cybersecurity. The research shows how advanced machine learning and multilevel clustering techniques can improve risk management, threat detection, and classification while addressing issues with data complexity, scalability, and adaptability [21]. By determining the best clustering methods for risk assessment and provide more evidence for this. In addition to these technical methods, highlight the critical importance of human behavior and cybersecurity awareness, demonstrating that user knowledge and practices have a major impact on vulnerability and organizational risk [22, 23]. Together, these studies suggest that combining robust algorithmic frameworks with targeted awareness and behavioral interventions provides a more comprehensive and effective strategy for mitigating cybersecurity threats across different contexts and industries.

Widespread vulnerabilities continue to exist across industries and demographic groups despite large investments in cybersecurity awareness campaigns and structured training programs, suggesting that conventional assessment techniques, such as extensive surveys and external reports, fail to adequately capture individual behavioral nuances that contribute to risk. Current methods mostly rely on self-reported or demographic data, which can ignore the intricate relationships between users' experiences with threats, behaviors, and knowledge that affect real vulnerability. This makes it more difficult to successfully customize interventions.

Using detailed behavioral and knowledge data, recent developments in machine learning, especially clustering techniques like K-Means, present a chance to distinguish different risk profiles. Nevertheless, there is still little use of these methods in cybersecurity awareness studies. By using K-Means clustering to separate subtle user categories, our study fills this gap and offers a more accurate foundation for focused training and intervention tactics [24]. By going beyond general demographic classifications to capture the intricate interplay of individual behaviors, perceptions, and experiences that underlie cybersecurity vulnerabilities, this method makes it possible to create customized cybersecurity education programs based on data-driven risk profiling. The goal is to identify patterns in how users behave and sort them into clear risk categories, which can then guide the development of more targeted and data-driven cybersecurity education programs.

This study aims to understand how aware people are about cybersecurity by looking at their knowledge, behaviors, and habits when it comes to digital threats. It also uses a machine learning method called K-Means clustering to sort individuals into different risk groups, like high-risk and low-risk, based on how much they know about cybersecurity. Finally, the study wants to see how well this clustering method works in pinpointing those who need focused cybersecurity training and support, with the ultimate goal of making everyone safer and more prepared in the digital world.

3.1 Results

Clustering Technique Validation

The results of the clustering analysis are shown in this part, along with an interpretation of the results in light of the goals of the study. Assessing the effectiveness of different clustering techniques, namely K-Means, Hierarchical Clustering, DBSCAN, and GMM, in classifying users according to their cybersecurity practices is the main goal of this section. K-Means clustering will be given special attention because of its proven superior performance in earlier investigations, which enables a thorough analysis of the distribution of people classified as low-risk versus high-risk.

Table 4 shows the evaluation of clustering methods using both the Silhouette Score and the Davies–Bouldin Index (DBI). While the Silhouette Score measures how well data points fit within their assigned clusters, the DBI assesses cluster compactness and separation, with lower values indicating better-defined clusters. The results indicate that all clustering methods produced relatively weak clustering structures.

Table 4. Silhouette score comparison table

K-Means achieved the highest Silhouette Score (0.1361) and the lowest Davies–Bouldin Index (2.71), indicating relatively better grouping of similar observations despite the low absolute scores. GMM followed, with moderate performance (Silhouette = 0.1178; DBI = 2.95), while Hierarchical Clustering showed notable overlap (Silhouette = 0.0964; DBI = 3.12). DBSCAN failed to identify meaningful clusters in this dataset. These results suggest that, although K-Means performs best among the evaluated algorithms, the dataset does not exhibit strong natural clustering.

K-Means Clustering

K-Means clustering was applied to classify individuals based on their cybersecurity practices. Among the methods evaluated, it showed the highest Silhouette Score and the lowest Davies-Bouldin Index, indicating relatively better grouping of similar observations. The results provide insight into the distribution of low-risk and high-risk individuals in the dataset.

Figure 2 shows the distribution of risk levels (High Risk and Low Risk) among various age groups, is a straightforward visual representation. The change in the ratio of high to low risk as people age is a prominent pattern. The largest number of people are found in the 18-24 age group, which represents young adults. The proportion of "Low Risk" people (about 51) is much higher than that of "High Risk" people (about 29). This implies that the majority of young adults in this age group are classified as low risk, even while some are at higher risk. Though low-risk persons still slightly outnumber high-risk, the gap narrows when we proceed to the 25-34 age range, suggesting a possible increase in the proportion of high-risk individuals. The most notable reversal is shown in the 35-44 age range, when "High Risk" people (about 25) significantly outnumber "Low Risk" people (about 11), indicating that this age range may be linked to a higher vulnerability to risk factors.

Figure 2. Risk level by age group

In the 45–54 age group, although the overall numbers are lower, "High Risk" individuals (approximately 12) still greatly outnumber "Low Risk" individuals (approximately 3). As one moves through the older age groups, the overall counts of both high and low-risk individuals generally decline, but the proportional emphasis frequently remains on "High Risk." This pattern holds true for the 55+ age range, where "High Risk" people (about 4) are still more common than "Low Risk" people (about 2), even though the aggregate numbers are extremely low. Due to the small number of people in both categories, the "Under 18" age group exhibits the fewest individuals, making it difficult to draw firm conclusions about this group. In general, the chart shows diverse risk profiles for each stage of life, with young adults often having lower risk and a significant rise in high-risk persons in middle-aged cohorts, despite declining numbers in elderly groups.

Figure 3 shows that by projecting different age groups and the risk levels that correspond with them onto a two-dimensional space that is defined by Principal Components 1 (PC1) and 2 (PC2), the PCA Plot demonstrates the dimensionality reduction of risk data. Age groups are represented by different colors in the plot, and the danger level is indicated by different markers (triangles for "Low Risk" and circles for "High Risk"). Although the PCA captures some variance, it does not produce completely distinct and isolated groups based only on these two principal components, as evidenced by the lack of a clear, tight clustering of either high-risk or low-risk individuals that strictly separates along the PC1 or PC2 axes. While the "35-44" age group (green circles/triangles) exhibits a larger distribution, especially extending to the top left, the "18-24" age group (pink circles/triangles) appears relatively dispersed across the center-right of the plot. The "Under 18" (purple circles/triangles) and "55+" (light blue circles/triangles) categories seem to have fewer data points and cluster more to the left of the plot, suggesting that their underlying risk profiles, as represented by these components, may be comparable. Instead of a straightforward, linear division based just on age or a single risk factor, the plot's overlap of many age groups and risk levels points to a complex interaction of risk-related factors.

Figure 3. Principal Component Analysis (PCA): Risk level by age group

Figure 4 shows the distribution of "High Risk" (red) and "Low Risk" (green) people among the three gender categories: female, male, and prefer not to say, which is graphically depicted in the graph. The "High Risk" count (about 50) for female participants is substantially greater than the "Low Risk" count (roughly 34), suggesting that a higher percentage of females in this sample are categorized as high risk. On the other hand, the "Low Risk" count (about 47) for males significantly exceeds the "High Risk" count (around 33), indicating that a higher percentage of guys are categorized as low risk. There are hardly any people in the "Prefer not to say" category; even fewer are categorized as "High Risk" and almost none as "Low Risk." Overall, the graph shows a clear distinction in the distribution of risk levels between males and females in this dataset, with males seemingly more likely to be low risk and females more likely to be high risk.

Figure 4. Risk level by gender

Figure 5 shows how people are distributed among two principal components, PC1 and PC2, according to their gender and risk level. Different markers indicate risk level (triangles for low risk, circles for high risk), and different colors indicate gender (pink for female, green for male, and light blue for prefer not to say). It appears that neither gender categories nor risk levels are clearly separated into discrete clusters in this 2D main component space. There is a considerable overlap across all groups, even if "Female" (pink) data points, especially high-risk circles and it seems to be slightly more concentrated on the left side of the plot, while "Male" (green) data points, especially low-risk triangles, show a slight inclination towards the right. The majority of the data points in the "Prefer not to say" category are grouped close to the center. This wide overlap implies that although gender may play a role in determining risk profile differences, as the preceding bar chart shows, the principal components do not completely separate these groups, suggesting that risk is probably influenced by a complex mix of factors other than gender that are not adequately represented by these two components.

Figure 5. Principal Component Analysis (PCA): Risk level by gender

Figure 6 shows that different professions have varying risk distributions. The "Employee (Private)" and "Unemployed" groups, in particular, exhibit a larger incidence of high-risk individuals; private employees have roughly 27 high-risk individuals compared to 19 low-risk, while jobless people have 11 high-risk individuals compared to 4 low-risk. Conversely, "Transportation Related" occupations are notable for having a notably greater proportion of low-risk workers (about 48) than high-risk workers (about 29), indicating a generally lower risk profile even with the high total number. Other professions such as "Call Center Agent" and "Business Owner" similarly exhibit a higher proportion of high-risk workers than low-risk workers. Conclusions are challenging due to the limited representation of some other categories, such as "OFW," "Carpenter," and "Babysitter," but in general, high-risk workers are more common or comparable to low-risk workers in the majority of the occupations included in this dataset.

Figure 6. Risk level by occupation

Figure 7 shows how people are distributed among two principle components, PC1 and PC2, according to their occupation and risk level. Risk levels are shown by markers (triangles for "Low Risk" and circles for "High Risk"), and occupations are distinguished by color. Upon eye inspection, this 2D area does not exhibit a noticeable, significant separation or clustering of different jobs or risk categories. The majority of occupational groups overlap significantly, even though "Transportation Related Job" (purple triangles/circles) is somewhat dispersed across the right side, with a noticeable presence of low-risk individuals (triangles), and "Employee (Private)" (light green triangles/circles) is widely distributed. Given the extensive overlap, it appears that the two main components (PC1 and PC2) are not adequately capturing the differences that may clearly distinguish people based on their risk profile or work. It is clear from the plot that risk profiles are complicated and probably impacted by many factors other than occupation, which are not fully represented or projected onto these two main characteristics.

Figure 7. Principal Component Analysis (PCA): Risk level by occupation

Different patterns and underlying complexities are shown when risk profiles are analyzed by age, gender, and occupation. Compared to the 18–24 age group, which has a primarily low-risk profile, the 35–44 age group consistently shows a higher concentration of high-risk individuals. In terms of gender, women are more likely to be categorized as high-risk, whilst men are more likely to be categorized as low-risk. Occupationally, the transportation sector exhibits a remarkable prevalence of low-risk persons despite its huge total representation, while private employees and the jobless populations show a higher number of high-risk individuals. However, there is substantial overlap between high-risk and low-risk individuals as well as across the different categories themselves across all three PCA plots (age, gender, and occupation), suggesting that these characteristics do not clearly define or distinguish risk profiles on their own. This implies that the entire range of risk is impacted by a more complex interaction of contributing elements than these distinct occupational and demographic groups can account for on their own.

Statistical Analysis

To complement the clustering analysis, the study examined whether demographic factors, age, gender, and occupation, are associated with cybersecurity risk levels (Low Risk vs High Risk). Chi-Square tests of independence were used to determine if observed differences across groups were statistically significant, providing a more rigorous assessment beyond descriptive or visual interpretations.

Risk Level According to Age Group

Table 5 shows the distribution of individuals across different age groups based on their cybersecurity risk levels, which are classified as Low Risk or High Risk. In the youngest group (Under 18), there are few individuals, with only 2 categorized as Low Risk and 4 as High Risk. Among the 18-24 age group, a majority are Low Risk (51) compared to High Risk (29). The 25-34 age group shows a relatively balanced distribution, with 40 Low Risk and 35 High Risk individuals. In the 35-44 age group, more individuals are High Risk (25) than Low Risk (11), indicating increased vulnerability in this bracket. The 45-54 group has more High Risk (12) than Low Risk (3), and the 55+ group has a small sample with 2 Low Risk and 4 High Risk individuals. Overall, this data suggests that younger adults (especially 18-24) tend to be lower risk, while risk levels increase with age, peaking in the 35-44 and 45-54 age groups.

Table 5. Number of low-risk and high-risk individuals based on their age group

The Chi-Square test of independence for Age Group × Risk Level yields the following results:

Chi-Square statistic (χ²): 18.56

Degrees of freedom (df): 5

p-value: 0.0023

Table 6 shows the expected frequencies of individuals in each age group classified as Low Risk or High Risk, based on the statistical analysis (Chi-Square test). The expected values are calculated under the assumption that there is no association between age group and risk level: for instance, under 18 years, 3 individuals are expected to be Low Risk and 3 High Risk; for ages 18–24, 40 each; ages 25-34, 37.5 each; ages 35-44, 18 each; ages 45-54, 7.5 each; and 55+ years, 3 each. These anticipated counts align with the observed data, indicating symmetry in the expected distribution if there were no real association between age and risk level. This reinforces the findings from the Chi-Square tests, suggesting that age may not significantly influence cybersecurity risk in this sample.

Table 6. Age group risk level expected frequency

Since the p-value (0.0023) < 0.05, the researcher rejects the H₀ of independence. This indicates that the age group is significantly associated with risk level, meaning the distribution of low-risk and high-risk individuals varies across age groups.

Risk Level According to Gender

The Table 7 shows the distribution of individuals by gender based on their cybersecurity risk levels, Low Risk or High Risk. Among females, there are 34 categorized as Low Risk and 50 as High Risk, indicating a higher proportion of females are in the High Risk group. Conversely, males have 47 Low Risk individuals compared to 33 High Risk individuals, suggesting males are generally more likely to be in the Low Risk category. The "Prefer not to say" group consists of only 1 person in each risk category, representing a very small sample and not providing significant insight. Overall, the data suggests that, within this sample, females tend to have a higher risk profile than males.

Table 7. Number of low-risk and high-risk individuals based on their gender

The Chi-Square test of independence for Gender × Risk Level produces the following results:

Chi-Square statistic (χ²): 5.47

Degrees of freedom (df): 2

p-value: 0.065

Table 8 shows the expected frequencies of individuals in each gender category, Female, Male, and Prefer not to say that across Low Risk and High Risk classifications, derived from the Chi-Square test of independence. For females, approximately 41.49 individuals are expected to be Low Risk, and 42.51 High Risk; for males, 39.52 Low Risk and 40.48 High Risk; and for the "Prefer not to say" category, about 0.99 Low Risk and 1.01 High Risk. These expected counts are close to the observed data, indicating that, under the null hypothesis of no association, the distribution of risk levels would be fairly balanced across gender groups. The similarity between observed and expected frequencies supports the statistical finding that gender is not significantly associated with risk level in this sample.

Table 8. Gender group risk level expected frequency

Since the p-value (0.065) > 0.05, the researcher rejects the H₀ of independence. This suggests that gender is not statistically significantly associated with risk level in this sample. Although visual inspection may suggest differences between males and females, the Chi-Square test indicates that these differences could be due to chance.

Risk Level According to Gender

Table 9 shows the observed counts of low-risk and high-risk individuals across different occupation groups. For example, "Employee (Private)" has 19 low-risk and 27 high-risk individuals, while "Unemployed" includes 4 low-risk and 11 high-risk cases. The "Transportation Related" occupation shows 48 low-risk and 29 high-risk individuals, indicating a higher prevalence of low-risk profiles within this group. Other occupations such as "Call Center Agent" have 5 low-risk and 7 high-risk, and "Business Owner" includes 3 low-risk and 5 high-risk individuals. Notably, the "Babysitter" group has only 1 individual, classified as high risk, with no low-risk individuals reported. Overall, these counts suggest variation in risk levels across occupations, but further statistical analysis would be necessary to determine whether these differences are statistically significant.

Table 9. Number of low-risk and high-risk individuals based on their occupation

The Chi-Square test of independence for Occupation × Risk Level produces the following results:

Chi-Square statistic (χ²): 11.49

Degrees of freedom (df): 7

p-value: 0.119

Expected frequencies:

Table 10 shows the expected frequencies of low-risk and high-risk individuals for each occupation group, based on the results of the Chi-Square test of independence. For instance, "Employee (Private)" is expected to include approximately 22.72 low-risk and 23.28 high-risk individuals if risk levels are independent of occupation. Similarly, "Unemployed" individuals are expected to be about 7.41 low-risk and 7.59 high-risk, while "Transportation Related" occupations have expected counts of 38.03 low-risk and 38.97 high-risk individuals. These expected values align with the overall proportions in the study, providing a baseline to compare against the observed counts. The comparison helps determine whether the distribution of risk levels across occupations deviates significantly from what would be expected under the null hypothesis of independence.

Table 10. Occupation group risk level expected frequency

Since the p-value (0.119) > 0.05, the researcher rejects the H₀ of independence. This indicates that occupation is not statistically significantly associated with risk level in this dataset. While descriptive charts may suggest differences in risk distribution across occupations, the Chi-Square test suggests that these differences are not statistically significant.

3.2 Discussions

This study investigated the relationship between demographic factors and cybersecurity risk levels using K-Means clustering to group individuals based on cybersecurity practices. K-Means was validated to be more effective in classifying users according to their cybersecurity practices. PCA analysis further demonstrated substantial overlap between high-risk and low-risk clusters across all demographic categories, which indicates weak discriminatory power for gender and occupation.

Using the Chi-square analysis, age is the demographic variable with a statistically significant association with risk level. However, probing visual analysis suggested potential trends such as elevated risk among individuals aged 35-44, lower risk among males, and higher risk among private employees or unemployed respondents.