3.1 Dataset selection and preprocessing

This study employs two publicly available and industry-representative cybersecurity datasets: the CICIDS 2017, released by the Canadian Institute for Cybersecurity, and the UNSW-NB15, developed by the University of New South Wales. The objective is to enhance model generalizability through cross-validation across multi-scenario data characteristics. CICIDS 2017 contains approximately 2.8 million traffic records and 80 feature fields, covering typical attack scenarios such as DDoS, phishing, and malware. Notably, its labeled features for emerging application-layer attacks provide strong temporal relevance. In contrast, UNSW-NB15 comprises 2,540,044 records and 49 features, spanning nine attack categories, including fuzzers, backdoors, shellcode, and worms. Its hybrid attack structure offers a robust benchmark for evaluating model performance under complex threat environments. The two datasets complement each other in terms of attack type coverage: CICIDS 2017 emphasizes behavioral representations of modern network threats, while UNSW-NB15 preserves characteristic patterns of traditional attacks. A unified preprocessing pipeline—including data cleaning, feature selection, and sample balancing—was applied to both datasets. This ensures the temporal and contextual representativeness of the training data while providing multidimensional support for analyzing the relationship between user behavior shifts and the evolution of cyberattack patterns within the context of capital influx.

To ensure a fair comparison, a standardized process of data cleaning, normalization, and feature selection is conducted on both datasets.

Removal of Redundant Data: Duplicate and redundant records are eliminated to ensure each data point is unique and representative [26], as shown in Eq. (1):

(1)

In Eq. (1), and represent the original and cleaned datasets, respectively, and refers to redundant data.

Addressing Missing Values: Missing values encountered during network data collection are handled by mean imputation and deletion of records with excessive missing fields, ensuring data continuity and consistency [27]. This is described by Eq. (2):

(2)

In Eq. (2), denotes the padding value for a missing data point; represents the existing numeric values of a feature, and is the count of non-missing samples.

Normalization: To maintain consistency in the numerical ranges of features, normalization is performed by scaling all feature values [28]. This enhances the effectiveness of SVM training and is calculated using Eq. (3):

(3)

In Eq. (3), represents the original eigenvalue; stands for the characteristic mean; is the standard deviation; refers to the normalized value.

Feature Selection: Principal Component Analysis (PCA) and random forest-based feature importance analysis are applied to automatically identify features most relevant to vulnerability prediction [29]. The main goals of feature selection are to reduce dimensionality, improve training speed and prediction accuracy, and mitigate overfitting [30].

Key features retained after this process include attack types, traffic patterns, packet sizes, and transmission latency. CICIDS 2017 retains 25 essential features, while UNSW-NB15 retains 22. Both datasets are partitioned into training, validation, and test sets with a 70%/15%/15% split to ensure model evaluation robustness across diverse attack types and network environments.

To guarantee reliable results and generalization capability, the dataset is split into three subsets: training for model development, validation for hyperparameter tuning, and testing for performance evaluation. The specific ratio used is 70% training, 15% validation, and 15% testing, maintaining data independence during experiments and facilitating accurate assessments of model stability and real-world applicability.

Addressing Class Imbalance: Cybersecurity datasets often suffer from significant class imbalance, where normal traffic substantially outnumbers attack instances. This imbalance risks overfitting models to normal traffic and neglecting minority attack classes. To mitigate this, several techniques are employed:

1. 1). Undersampling and Oversampling: Attack samples are oversampled and normal traffic undersampled to achieve a more balanced distribution.
2. 2). Synthetic Minority Over-sampling Technique (SMOTE): This technique generates new synthetic minority samples to balance the dataset further [31], as described in Eq. (4):

(4)

In Eq. (4), refers to the newly generated minority sample; and are existing minority samples; means a randomly generated value between 0 and 1.

1. 3). Weighted Loss Function: During model training, higher weights are assigned to minority class samples to reduce bias toward majority classes and improve attack detection capability. The weighted loss function is given by Eq. (5):

(5)

In Eq. (5), denotes the sample weight; refers to the loss function; and represent the true and predicted labels, respectively.

3.2 Analysis of cyber-attack types

Common types of cyber-attacks are presented in Fig 1 [32]:

Download:

• PNG
  larger image
• TIFF
  original image

Fig 1. Common types of cyber-attacks.

https://doi.org/10.1371/journal.pone.0327476.g001

As shown in Fig 1, DDoS attacks flood target servers with massive volumes of fabricated requests originating from numerous distributed sources. This renders the servers inaccessible to legitimate users and disrupts normal service functionality. These attacks typically utilize a large number of compromised devices to send repeated requests, leading to severe network congestion. The total volume of DDoS attack traffic is expressed in Eq. (6):

(6)

denotes the total DDoS traffic, is the number of requests sent by the th infected device, and n is the total number of participating devices.

Phishing attacks primarily aim to acquire sensitive user information, such as usernames, passwords, and financial data, by impersonating legitimate websites or communication channels such as emails [33]. These attacks exploit social engineering techniques to deceive users into disclosing private information, often through fraudulent hyperlinks. Malware refers to malicious software designed to steal data or damage systems, typically delivered through viruses, Trojans, or ransomware. Data breaches involve unauthorized access to sensitive user information and can result from external cyber intrusions or malicious insider actions.

While DDoS attacks mainly compromise service availability, phishing, data breaches, and malware pose more serious threats by directly violating users’ data privacy [34]. Such breaches can lead to grave consequences, including identity theft and financial loss, ultimately eroding user trust in online platforms. When cyber-attacks result in large-scale data leaks or monetary damage, users tend to lose confidence in the affected platforms and may switch to alternative platforms with better security assurances. Cyber-attacks also intensify users’ psychological insecurity, particularly when such incidents occur frequently or are not addressed promptly. The impact of malware and data breaches on users’ perceived safety is especially significant, as users may reduce their online activities or alter behavior patterns to avoid perceived risks.

According to platform capitalism theory, online platforms rely heavily on vast volumes of user behavioral data as core resources for value generation. However, when cyber-attacks cause data leaks or service interruptions, user behavioral patterns shift in response. These changes primarily manifest in the following ways:

1. (1). User Churn: Repeated cyber-attacks and data breaches diminish user trust, leading to large-scale user attrition [35]. In the context of platform capitalism, user churn directly impairs platforms’ profitability and their ability to accumulate behavioral data.
2. (2). Defensive User Behavior: Amid rising threats from phishing and malware, users exhibit more cautious behavior. They may reduce personal information sharing on platforms or avoid sensitive actions such as online payments to safeguard privacy.
3. (3). Decreased Platform Dependency: Data breaches and repeated attacks elevate users’ security concerns. In response, users may lower their reliance on a single platform and diversify their digital engagement across multiple platforms or services to mitigate potential security risks.

3.3 Design of the improved SVM model

SVM is a widely used machine learning model for classification and regression tasks, particularly effective in handling high-dimensional data. SVM identifies an optimal classification boundary (hyperplane) that maximizes the margin between classes, making it extensively applicable to intrusion detection, malicious traffic identification, and vulnerability prediction in the field of cybersecurity [36].

A standard SVM optimization problem is expressed as Eq. (7):

(7)

In Eq. (7), denotes the normal vector of the separating hyperplane, and represents the offset term. The objective is to maximize the margin between different classes in the sample space.

Despite its strengths, traditional SVM has notable limitations in cybersecurity applications. Specifically, it struggles with high-dimensional nonlinear data and relies on fixed kernel functions that lack adaptability. In cybersecurity scenarios, network traffic data often exhibit complex nonlinear distributions. For instance, the boundary between benign and malicious traffic may be vague or highly dynamic. The traditional SVM model typically adopts a static kernel function, such as the Radial Basis Function (RBF), to perform nonlinear mapping, as shown in Eq. (8):

(8)

In Eq. (8), and are input samples, and is the kernel parameter. Although the RBF kernel provides good local sensitivity, it only performs well under certain nonlinear conditions and lacks the flexibility to adapt to diverse or evolving data patterns. Consequently, the model’s performance deteriorates when predicting vulnerabilities in complex environments.

In particular, the fixed nature of the kernel parameter limits the model’s ability to respond to dynamic changes in data distributions—a critical drawback in cybersecurity tasks where feature distributions vary significantly across attack types and time periods. This variability leads to instability in model generalization and prediction accuracy.

To overcome these issues, this study proposes an enhanced model—TASVM. This model introduces dynamic kernel parameter adjustment, an attack-aware factor, and a kernel-switching mechanism to improve adaptability to varying attack types and data complexities. The workflow of the proposed method is illustrated in Fig 2.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 2. The workflow of the proposed method.

https://doi.org/10.1371/journal.pone.0327476.g002

As shown in Fig 2, TASVM is designed within the statistical learning framework of SVM, incorporating key modeling considerations such as data distribution awareness, attack risk sensitivity, and structural asymmetry handling. According to kernel learning theory, when the input data exhibit nonlinear or heterogeneous characteristics, the representational capacity of the kernel function critically determines the model’s decision boundary and generalization ability. In a conventional RBF kernel, the bandwidth parameter γ controls the model’s sensitivity to local variations. However, in dynamic environments, a fixed γ fails to reflect real-time shifts in traffic behavior. Drawing on the concept of local smoothing estimation, TASVM dynamically adjusts the kernel shape based on the local variance of input variables. This approach enables the model to respond more effectively to rapidly changing or streaming data. Furthermore, the model introduces an attack-aware factor α_c, inspired by weighted SVM, into the kernel parameter adjustment process. This factor enhances decision boundary precision for high-risk attack categories by tightening the margin based on perceived threat levels. Such adaptive weighting improves the model’s discrimination capability, particularly in scenarios where critical vulnerabilities must be detected with higher sensitivity. To address cases in which the input data distribution is highly skewed or sparse, TASVM incorporates a kernel-switching mechanism. When data skewness exceeds a predefined threshold, the model switches from an RBF kernel to a Sigmoid kernel to better capture the global structure under sparse boundary conditions. This decision is based on higher-order statistical features of the input space, allowing the model to maintain performance in diverse threat environments. The kernel-switching strategy thus improves the model’s morphological adaptability and robustness in vulnerability prediction.

The TASVM model inherits the dynamic kernel parameter mechanism. It monitors the standard deviation of input samples in the current time window in real time and adjusts the kernel function parameter accordingly, as shown in Eq. (9):

(9)

Here, denotes the standard deviation of the input data in the current time window, reflecting the degree of data dispersion. This approach enables the kernel width to be automatically adjusted based on the changing data distribution. When the standard deviation is small, the model increases sensitivity to fine-grained variations. Conversely, when data volatility is high, the kernel width broadens to avoid overfitting. This dynamic adjustment enhances the model’s responsiveness to fluctuations in input patterns.

To further improve the model’s classification performance under varying attack categories, this study introduces a Threat-aware Kernel Adaptation (TKA) mechanism. This mechanism builds upon the dynamic kernel parameter γ(t) by incorporating a category-sensitive factor α_c, allowing the model to fine-tune the kernel’s response range based on the risk weight of the target attack class. The enhanced kernel parameter is defined in Eq. (10):

(10)

In Eq. (10), is the standard deviation of samples in the current time window, and represents the adjustment factor associated with the predicted attack type. The value of is determined based on the FPRs and the hazard levels of different attack types in the training dataset. For example, DDoS attacks are assigned a higher to reflect their severe impact, while attack types with high FPRs, such as phishing, are penalized accordingly to improve model precision.

In terms of kernel structure, this study integrates an Adaptive Kernel Selection (AKS) mechanism. This mechanism enables the model to switch between the RBF kernel and the Sigmoid kernel depending on the skewness of the input data distribution. When the data distribution exhibits significant asymmetry, a more flexible kernel function is applied to capture the global structure more effectively. The kernel selection strategy is defined as Eq. (11):

(11)

In Eq. (11), S represents the skewness of the input data in the current time window, and θ denotes the threshold that determines whether to switch kernels.

The complete training process of the TASVM model consists of the following steps:

1. (1). Data preprocessing: Standardizes and selects core features from the original dataset to eliminate scale differences and retain essential attributes relevant to attack classification.
2. (2). Parameter initialization: Initializes the penalty coefficient C and initial kernel parameter 𝛾₀.
3. (3). Sliding window monitoring: Continuously computes σ(t) and skewness S of incoming data during model training.
4. (4). Kernel function adjustment: Dynamically updates the kernel parameter based on σ(t) and attack type, and switches the kernel function based on skewness S.
5. (5). Model training and cross-validation: Trains the SVM model using the updated kernel function, and optimizes hyperparameters C and r through five-fold cross-validation.
6. (6). Real-time prediction and feedback: In the testing phase, the model continuously monitors the distribution of incoming data and dynamically updates the kernel function and prediction strategy.

The final TASVM objective function, incorporating a slack variable for soft-margin classification, is formulated as Eq. (12):

(12)

In this expression, denotes the high-dimensional feature space obtained through dynamic kernel mapping, and represents the slack variable accounting for misclassification errors.

This study investigates how shifts in user groups—driven by capital influx—affect vulnerability prediction in cyberspace. To address this challenge, a TASVM model is proposed, which improves the identification of nonlinear cyberattacks through dynamic and adaptive kernel optimization. The model’s effectiveness is validated using benchmark datasets. The hyperparameter configuration employed in the study is summarized in Table 1.

Download:

• PNG
  larger image
• TIFF
  original image

Table 1. Hyperparameter configuration.

https://doi.org/10.1371/journal.pone.0327476.t001

As shown in Table 1, the TASVM model integrates dynamic kernel parameter adjustment, attack-aware weighting, and an adaptive kernel switching mechanism to improve vulnerability prediction in cyberspace. The model is evaluated using two datasets, following standardized preprocessing and five-fold cross-validation procedures.

Within the TASVM framework, the attack-aware coefficient is dynamically calculated based on both the severity level of each attack type and its historical FPR. The coefficient is computed as follows: =base weight×(1 + 0.2 × FPR adjustment factor). This formulation enhances the model’s responsiveness to high-risk attacks by initially assigning weights according to threat severity and subsequently fine-tuning them based on the ratio of the individual attack’s FPR to the overall average. This allows the model to tighten decision boundaries around more critical or error-prone categories. The skewness threshold θ is determined from the feature skewness distribution in the training set, with an initial value of 1.5. A sliding window mechanism is used to track the mean skewness over time. If the observed skewness deviates by more than 20% from the baseline across three consecutive windows, the threshold θ is adaptively updated. This adjustment triggers kernel switching, allowing the model to respond to evolving data distributions and better detect complex or sparse attack patterns.

4.1 Performance comparison of models

The proposed improved SVM model demonstrates a significant performance enhancement in vulnerability prediction compared with traditional SVM, random forest, neural network, and decision tree models. The comparative results are illustrated in Fig 3. For consistency across evaluations, a unified binary classification setting is adopted in this experiment. All types of malicious traffic are grouped under a single “attack” category, forming a binary label of “attack vs. normal” alongside benign traffic. Both benchmark datasets—CICIDS 2017 and UNSW-NB15—are trained and tested under this binary classification scheme. Evaluation metrics, including accuracy, precision, recall, and F1-score, are calculated based solely on the binary output, without considering individual attack-type performance. As such, macro and micro averaging are not employed.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 3. Performance comparison of models.

https://doi.org/10.1371/journal.pone.0327476.g003

As shown in Fig 3, the improved SVM model achieves an accuracy of 96.5%, representing a substantial improvement of 11.2 percentage points over the traditional SVM model, which records an accuracy of 85.3%. This improvement is primarily attributed to the enhanced capability of the dynamic adaptive kernel function in handling nonlinear data and capturing the distinctive features of various cyberattack types. Additionally, the model exhibits strong performance in terms of precision (95.2%), recall (94.8%), and F1-score (95.0%), indicating a well-balanced classification ability with reduced false positives and false negatives. While alternative models such as random forests and neural networks also perform competitively in vulnerability prediction tasks, their scores across all evaluation metrics remain lower than those of the improved SVM. This performance gap underscores the superior adaptability and generalization capability of the proposed TASVM model in complex cyberspace threat scenarios.

In addition to predictive accuracy, prediction speed is a critical factor in assessing a model’s practical applicability. Experimental results show that the improved SVM model achieves an average prediction time of 9.9 milliseconds, which represents a 22.2% improvement over the 12.1 milliseconds recorded by the traditional SVM. This gain further validates the efficiency of the dynamic adaptive kernel mechanism, enabling the model to maintain low latency even when handling high-dimensional and dynamically distributed input data.

4.2 Comparative analysis of different attack types

This study conducts comparative experiments using two representative intrusion detection datasets—CICIDS 2017 and UNSW-NB15. The classification of attack types in Figs 4 through 6 is as follows. DDoS attacks are sourced from CICIDS 2017 and include categories such as DoS-Hulk and GoldenEye; phishing attacks correspond to the WebAttack–BruteForce label in CICIDS; and malware attacks are derived from the UNSW-NB15 dataset, specifically from labels including Shellcode, Backdoor, and Worms, which are consolidated into a generalized “malware” category. Each attack type is evaluated against normal traffic using binary classification to assess the model’s capability in detecting real-world threats. Figs 4–6 respectively illustrate the detection rates, FPRs, and adaptability of different models across these attack categories. Notably, the “adaptability” metric in Fig 6 measures the model’s performance stability under dynamic conditions, particularly when the class distribution shifts between training and testing phases. It is calculated as the ratio of the model’s post-finetuning performance to its initial performance. A higher adaptability score indicates stronger generalization capability and resilience against unfamiliar or mutated attack patterns. This metric differs from conventional accuracy, focusing instead on model robustness under distributional drift.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 4. Detection rates of different models across attack types.

https://doi.org/10.1371/journal.pone.0327476.g004

Download:

• PNG
  larger image
• TIFF
  original image

Fig 5. FPRs of different models across attack types.

https://doi.org/10.1371/journal.pone.0327476.g005

Download:

• PNG
  larger image
• TIFF
  original image

Fig 6. Adaptability of different models to dynamic attack scenarios.

https://doi.org/10.1371/journal.pone.0327476.g006

As shown in Figs 4–6, the improved SVM model consistently outperforms baseline models across all attack categories. For DDoS attacks, the improved model achieves a detection rate of 98.3%, a substantial increase from the 86.5% achieved by the traditional SVM. In the cases of phishing and malware attacks, the detection rates are 95.6% and 94.7%, respectively, both surpassing the performance of competing models.

Regarding FPRs, the improved SVM model demonstrates significant reduction compared to traditional approaches. For DDoS attacks, the model records an FPR of 2.1%, compared to 5.3% for the conventional SVM. Similarly, for phishing and malware scenarios, the model achieves low FPRs of 3.2% and 4.0%, respectively, indicating enhanced discriminatory power between malicious and benign traffic.

In terms of adaptability, the proposed model achieves an outstanding score of 96.5%, outperforming the traditional SVM (83.2%) and other comparison models. This result underscores the effectiveness of the dynamic adaptive kernel function, which autonomously adjusts kernel parameters in response to real-time variations in the input data, thereby enhancing robustness under evolving attack conditions.

Beyond technical performance, it is important to recognize that different cyberattack types not only compromise system integrity but also substantially impact user behavior. Under the influence of capital influx and platform expansion, users exhibit heightened expectations for service quality and security. In such contexts, cyberattacks can significantly undermine users’ trust and perceived safety, amplifying the need for precise and resilient detection mechanisms.

4.3 Analysis of user behavior changes and platform-related factors

To further explore the potential impact of platform expansion on user behavior and cybersecurity risks under conditions of capital influx, this study conducts a supplementary analysis focusing on behavioral features that reflect user activity within network traffic. While the proposed model is trained jointly on the CICIDS 2017 and UNSW-NB15 datasets, the behavioral analysis is primarily based on CICIDS 2017, which includes detailed structural information such as timestamps, connection frequencies, and attack labels. This granularity makes it particularly suitable for modeling user behavior and tracking the evolution of attack patterns at the platform level.

User request volumes and corresponding attack events are extracted across different hourly intervals. Based on this temporal segmentation, a trend chart is constructed to illustrate platform load fluctuations and associated attack dynamics, as shown in Fig 7.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 7. Hourly variations in user request volume and attack events.

https://doi.org/10.1371/journal.pone.0327476.g007

As depicted in Fig 7, during peak activity hours—from early to late morning—user connection requests increase sharply. Simultaneously, the frequency of attacks rises markedly, with malware and DDoS attacks occurring in parallel with the surge in user activity. This concurrent rise indicates that attackers may exploit periods of high system load, when resource constraints and reduced monitoring efficiency provide opportunities for malicious intrusion. Notably, during the peak window (06:00–10:00), the number of attack events increases by approximately 70.2% compared to off-peak periods, with a pronounced concentration of malware and phishing attacks.

To further assess user behavioral responses under varying attack pressures, this study compares user activity across time windows characterized by high and low attack intensity. The analysis focuses on two behavioral dimensions: average user session duration (measured in seconds) and average number of user actions (such as page switches and data requests). The results are summarized in Fig 8:

Download:

• PNG
  larger image
• TIFF
  original image

Fig 8. Comparison of user behavior features during high and low attack periods (Unit: seconds/actions).

In Figure 8, gray squares represent the average session duration (seconds), uniformly scaled by ×10⁻¹; red squares denote the average number of user actions.

https://doi.org/10.1371/journal.pone.0327476.g008

Fig 8 reveals that during high attack frequency periods, average session duration drops significantly, while the number of user actions also declines and becomes more dispersed. This indicates a shift toward “defensive” user behavior. During attack-intensive intervals, the median session duration decreases by nearly 20%, and the interquartile range for user actions widens, suggesting behavioral bifurcation: some users rapidly disengage, likely due to perceived risk or degraded service quality, while others—potentially high-risk or automated users—continue frequent interaction. Moreover, both user traffic density and attack sample volume rise considerably during peak usage periods. Specifically, the proportion of DDoS attacks increases by approximately 16.3% during high user activity intervals. These findings offer empirical evidence supporting a “capital influx → user growth → attack exposure” chain, highlighting how increased platform traffic driven by expansion may inadvertently elevate vulnerability to cyberattacks, thereby influencing both attack strategies and user behavior patterns.

4.4 Significance Analysis

To satisfy the requirements of statistical validation, this study performs significance testing on the performance differences between the proposed TASVM model and the traditional SVM. A 5-fold cross-validation procedure, repeated 20 times, is applied to both the CICIDS 2017 and UNSW-NB15 datasets. Results from a paired-sample t-test indicate that the TASVM model achieves significantly higher accuracy than the traditional SVM. On the CICIDS 2017 dataset, the TASVM model attains an accuracy of 96.5%, compared to 85.3% for the traditional SVM, yielding t(19) = 5.82, p < 0.001. A similar pattern is observed on the UNSW-NB15 dataset, with t(19) = 4.37, p < 0.001. The 95% confidence intervals and standard deviations for key performance metrics are summarized in Table 2.

Download:

• PNG
  larger image
• TIFF
  original image

Table 2. Significance analysis results.

https://doi.org/10.1371/journal.pone.0327476.t002

As shown in Table 2, the TASVM model—featuring integrated dynamic kernel parameter adjustment, attack-aware coefficients, and kernel function switching—achieves statistically significant improvements in vulnerability prediction across both datasets. Compared to the traditional SVM, the TASVM model increases prediction accuracy by 11.2%, enhances prediction speed by 22.2%, and delivers greater stability and reduced false positive rates in identifying common attack types such as DDoS, phishing, and malware. In addition, behavioral analysis confirms a positive correlation between high attack frequency and changes in user activity during peak load periods. These findings support the hypothesized causal chain of “capital inflow → user growth → attack exposure,” providing not only a practical modeling framework and empirical validation for improving cyber risk prediction, but also a theoretical foundation for enhancing platform-level security governance. In real-world multi-dimensional attack scenarios, the proposed AKS mechanism dynamically senses shifts in data distribution and attack characteristics to activate corresponding response strategies. When data skewness exceeds a threshold of θ = 1.5—typically triggered by compound or coordinated attacks—the mechanism automatically switches to a sigmoid kernel, which is more effective at modeling sparse decision boundaries. Simultaneously, the kernel parameter weights are adjusted according to the attack-aware coefficient (α_c), enabling reinforcement of the decision boundary in high-risk dimensions. In multi-dimensional attack testing conducted on the CICIDS 2017 dataset, the AKS mechanism raises the detection accuracy for composite attacks to 95.6%, representing an 8.3% improvement over static kernel-based methods. Furthermore, it maintains F1-scores above 94% in cross-type attack evaluations on the UNSW-NB15 dataset, demonstrating the feasibility and robustness of the proposed approach in complex and dynamic threat environments.