Machine learning and game theory for cybercrime risk assessment in online platform management systems

Abstract

A proactive framework for cybercrime risk assessment, incorporated using machine learning algorithms and game theory, analyzes platform content moderation effectiveness. With machine learning algorithms, including K-means clustering, ridge regression, interaction analysis, and optimization of Nash equilibrium in 27 quarterly platform analyses, this research proposes four categories of content risks differentiated by systematic differences in levels of threat. The strongest predictor in this sample (β = 0.63) for effectiveness is AI capabilities, accounting for 56.2% of explained variations, although effectiveness is substantially diminished by complexity in moderated content. Optimal automation rates vary from 78% for low complexity to sophisticated approaches at only 29%, offering 55% cost savings and a 54.5% decrease in breaches for low complexity, but risking higher degrees of threat for complex moderated contents. This study suggests that technological development is imperative to supplement resource development for platforms in content moderation approaches.

Introduction

Cybercrime is a rapidly increasing threat to international cyber environments, although current risk analysis approaches to cybercrime remain largely reactive, being only enforced after forensic analysis of incidents of breach, as well as relying in part upon reporting by victims of cybercrime¹. Current methods present intrinsic flaws in responding to cyber-based threats at unprecedented rates of speed and scale². Ransomware attacks, for example, demonstrate that historical data analysis approaches identify cybercrime risks only after harmful consequences³. Given the transition of criminal actions into cyber environments, using social, commerce, and sharing platforms to simultaneously endanger millions of people, the fallibility of reactive models is increasingly apparent^4,5. This transition also points to digital platforms themselves as a largely untapped source of timely operational data for proactive risk assessment.

Digital platforms present a strategically important but far-from-explored area for predictive cybercrime threat analysis. As for classical cybersecurity issues, threat analysis is conducted after system violations, whereas platform-specific filtering systems provide an opportunity for threat detection at the level of data creation itself, effectively blocking malicious data from reaching end-consumers in advance. This is owing to platforms’ lead time, as well as increasing transparency reporting obligations, which present systematic data from operations for analysis⁶. Despite this potential, no existing framework systematically leverages platform operational data, including content moderation outputs, AI detection capabilities, and human review processes, for integrated cybercrime risk assessment.

Even in machine learning-based applications for threat classification in cybersecurity issues, as well as game theory-based approaches for resource allocation in adversarial environments, available research is mostly focused either on securing an organization as a whole or dealing with vulnerabilities at a network level^7–10. Despite growing attention to platform-based cybercrime, the literature lacks a systematic framework for classifying cybercrime content into risk-stratified categories based on multidimensional attributes such as technical complexity, propagation potential, financial severity, legal consequences, and detection difficulty. Consequently, while network-level and organizational-level determinants of detection have received considerable attention, the operational factors at the platform level that shape detection effectiveness remain largely unexamined. Nor is it clear, either theoretically or empirically, how platforms should allocate automated and human review resources across content categories that differ in complexity and adversarial pressure.

Accordingly, this study seeks to answer three research questions. RQ1 asks how cybercrime content can be systematically categorized into distinct risk strata using multidimensional attributes. RQ2 asks which platform operational factors are associated with detection effectiveness for cybercrime-related content. RQ3 asks what the optimal allocation of automated versus human review resources across content risk categories is under adversarial conditions.

To address these questions, this study proposes and empirically operationalizes a Platform-Based Risk Assessment (PBRA) paradigm that reorients cybercrime risk analysis from reactive forensic investigation toward proactive content-level interception. The paradigm is implemented through a three-phase analytical framework: Phase 1 employs K-means clustering to classify cybercrime content into empirically derived risk categories; Phase 2 applies ridge regression to examine how platform operational characteristics, including platform scale, AI-based detection capability, and review efficiency, are associated with detection effectiveness and its variation across content complexity levels; Phase 3 uses game-theoretic optimization to derive equilibrium solutions for human–AI resource allocation differentiated by content risk category.

Literature review

Cybercrime risk assessment: evolution and limitations

The traditional approaches to cybersecurity risk assessments have grown from signature-based detection tools to advanced analytics, but they also demonstrate inherent structural limitations. The current approaches mostly focus on past attacks to identify potential risks, causing considerable time gaps between attacks happening and risks being recognized¹¹. Traditional approaches have also been very challenging for cyber insurance risk evaluation, as they lack adequate past claims data, as well as tend to be chronically underreported in cybersecurity incidents, an issue that has been exacerbated by organizations’ failure to announce cybersecurity breaches to the public because of feared reputational damage, causing significant gaps in threat intelligence databases, an issue that has been observed by research to occur in most organizations^9,12. Global cybercrime costs amount to an estimated $1 trillion in 2020, reflecting a 50% escalation in costs from 2018¹³, which is also projected to continue escalating, indicating an escalating demand for shifts in approaches from reactive methods of risk assessments, which have failed to keep pace as criminal actions transition to online platforms, which allow malicious material to spread to millions of people in as little as several hours.

Platform-based cybercrime: a new frontier

According to statistics, the consequences of this threat to social platforms have been quite significant. In the first quarter of 2024, social media and SaaS/webmail platforms combined accounted for nearly 60% of all detected phishing attacks (APWG,¹⁴) with social media platforms alone representing 30.5% of total phishing cases by Q3 of 2024 (APWG,¹⁵). Malicious contents available in current platforms include financial scam advertisements, phishing URLs modeled to resemble notifications, as well as recruitment postings for human trafficking rings. The Digital Services Act (DSA) in Europe, passed in 2022, presents unprecedented transparency obligations for large online platforms, requiring systematic reporting of both content removal policies and algorithmic reasoning processes^16,17. Individually published platform-specific transparency reports, including Meta’s Community Standards Enforcement Reports, Google Transparency Reports, as well as Safety Reports from Twitter, involve an aggregate of over 1.5 billion platform-specific content actions, offering unprecedented insights into platform processes (Meta,¹⁸. Analysis of platform-specific reporting reveals a level of inequality in platform-specific removal actions^4,19. Current platforms demonstrate a completely different threat scenario than those of previous cybersecurity because they involve malicious actors using trust-based social relationships to bypass previous methods of protecting the network perimeter²⁰, who recognize platform-specific content removal as a critical event for predictive threat protection to function effectively.

Machine learning applications in cybersecurity risk assessment

Machine learning approaches have proven disruptive in improving threat identification and risk assessment capabilities. Applications of the K-means clustering algorithm have proven successful in clustering intrusions in computer networks into different threat categories, allowing for differentiated approaches to tackle them efficiently. Recent applications of this approach have also indicated an accuracy level of more than 89% in identifying phishing websites by leveraging this algorithm in combination with an appropriate feature selection methodology²¹. The methodology involves automatically segmenting pre-classified security data into efficient clusters, also including applications in malware classification, which clusters malicious code using different behavioral signs. Modern applications of this methodology utilize unsupervised machine learning in detecting zero-day attacks by identifying unusual patterns beyond known signs for resolving significant vulnerabilities in signature-based detection tools²².

Though current studies mostly focus on using machine learning for network-level telemetry data and system logs, the current study proposes to extend clustering techniques to platform-based content analysis by transforming platform-based attributes of content into observable characteristics for unconstrained machine learning classification techniques by repurposing platform transparency reports to include structured data for violation types, detection rates, and processing quantities, in an appropriate manner to allow for clustering-based machine learning approaches to be systematically applied for risk analysis at a content level.

While complementing clustering methods, regression analyses have also been useful in determining cybersecurity risks by ascertaining measures of association between organization variables and breach likelihood, and Ridge regression, in particular, has been useful in dealing with multicollinearity in correlated variables for cybersecurity⁹. Modern applications involve using panel data in dealing with platform operational data to examine cross-sectional differences between platforms, as well as differences over time to establish causation between variables, apart from accounting for potential differences in breach likelihood. For detection, deep learning models, specifically those employing Convolutional Neural Networks (CNNs), register detection rates of more than 95%, although there is an increasing demand for trustworthy AI systems, ensuring compliance with regulations²³. For cyber threat classification, machine learning models register accurate prediction rates between 92% and 99%²⁴. Applications of current machine learning systems mostly revolve around system data, leaving little room for analysis of platform data, which is an area this paper seeks to explore by applying machine learning algorithms to platform transparency reports as well as data related to content moderation.

Game theory for security resource allocation

Game theory modeling has been developed as a scientific tool for analysis of interactions between cybersecurity defenders and attackers, using concepts of Nash equilibrium to provide a mathematic basis for resource allocation optimization. A classical solution views cybersecurity as a game played by two agents, resource allocation by defenders, and exploitation plans by attackers, using equilibrium to find stable positions of defenders⁷. The Mixed Strategy Nash Equilibrium has been observed to be quite effective in cybersecurity problems, as it has been observed that no strategy pair is an equilibrium in a deterministic game, meaning that for a cyber-attack, to avoid an attacker capitalizing on certain patterns, a defensive strategy must be mixed (i.e., randomly varied)²⁵. Evolutionary games widen this concept by taking into consideration dynamic adaptations of strategies, which evolve in relation to payoff differences in repeated games of cyber-Physical Systems, as validated by data-related calibrations of such principles to actual patterns of observed systems¹⁹.

Modern applications involve resource allocation optimization subject to budget constraints, in which resource allocation for defending heterogeneous assets is taken into consideration. Stackelberg game models include modeling of defenders’ strategies prior to the action of attackers, who behave optimally after observing them. Modern applications involve cyber-physical infrastructure protection, illustrating Stackelberg equilibria-based optimized defensive plans for more adaptive attackers²⁶. Similarly, platform operators must also grapple with strategic dilemmas, where higher rates of automation drive down the unit costs of detection but may also communicate detection thresholds to sophisticated attackers who refine their level of complexity in response, whereas sustainment of human detection capacity maintains strategic unpredictability of platform operation.

Human-AI collaboration in content moderation

Studies pertaining to human-AI collaboration for content moderation have established that hybrid models employing automated tagging in conjunction with human intelligence lead to better results than manually as well as automated methods²⁷. From empirical research, it is observed that AI tools support human moderators by dealing with massive quantities, referring more complex cases to human moderators who possess cultural understanding, whereas human moderators relying upon AI support complete tasks much faster with increased recall than manually²⁸. The intensity of workloads impacts review quality, reaching an optimal level where workloads prevent cognitive overload. Systems dealing with million-level submissions per day face inherent capacity limits, making manually-intensive review processing infeasible from an economic perspective (Meta,²⁹. Current systems using this methodology demonstrate reaching high levels of accuracy via a precision-tuned combination of human-AI integration, but potential issues of cultural insensitivity, as systems generally predisposed to Western data do not account for locally relevant content in different cultural environments, have been raised³⁰. Scale is fundamental to operational effectiveness, as platforms aim to integrate multiple facets of operations, including automatic screening, human review, appeals, as well as transparency reporting, into a cohesive system of moderation. It is necessary to calibrate rates of automating to strike a balance between efficiency on the one hand and maintaining precision as well as cultural nuance on the other.

Theoretical framework

Presented in this manuscript is a concept for a Platform-Based Risk Assessment (PBRA) model, which entirely shifts the modality of cybercrime risk assessment from forensic analysis after an event to near-real-time interception of offending content at the stage of publication. While both automated detection and human review processes inherently involve processing delays, the PBRA model substantially reduces the temporal gap between content creation and risk identification compared to traditional post-incident forensic approaches. Current risk assessment methodologies involve a forensic cycle of criminal actions, complaint registration by victims, and subsequent analysis, which is further accompanied by pragmatic temporal lag that results in widespread victimization prior to taking preventive measures. The PBRA model, in contrast, starts with platform-based moderated review of published content for potential harmful material during the stage of submittal, prior to reaching target recipients, which is an entirely different modality of risk assessment from current methodologies that extensively require complaint registration by victims prior to analysis of past data.

The figure shows the differences between traditional reactive risk assessment schemes and the proposed Platform-Based Risk Assessment (PBRA) model. The figure shows that in traditional reactive schemes, risk assessments occur after instances of criminal activity, exposure of victims, reporting of incidents, which in turn result in risk assessments that involve time lags, underreporting, and reactions to risks. The figure shows that in the PBRA model, prevention of victimization is achieved after detection, classification of risks, which in turn results in prevention of victimization with a significantly reduced temporal lag compared to traditional reactive approaches. The center-right corner reveals the three analytical layers of the PBRA framework, of which Layer 1 utilizes K-means clustering for risk classification, Layer 2 employs Ridge regression for determinants analysis, and Layer 3 applies game theory for resource optimization. The bottom panel reveals three related research hypotheses for each of the analytical layers, including hypotheses for feasibility of content clustering (H1), correlation between technologies and accuracy (H2), and optimal thresholds for automation (H3). Dotted borders mark conceptual frameworks, whereas solid arrows denote flow, using dash lines to highlight layer-to-hypothesis correspondences. Note that while Fig. 1 depicts idealized prevention with minimal temporal lag for illustrative contrast, in practice, both automated and human review processes involve non-trivial processing time, as discussed above.

Fig. 1.

Comparison of traditional and platform-based risk assessment frameworks.

This study addresses three research questions (RQ1 through RQ3). In relation to these questions, this paper proposes three research hypotheses. H1 posits that cybercrime content exhibits systematic differences across risk categories defined by attributes of technical complexity, potential for propagation, financial level of severity, legal repercussions, and ease of detection. H2a posits that detection effectiveness is predicted by platform AI capabilities. H2b posits that detection effectiveness is predicted by human review capacity. H3 posits that the effectiveness of platform AI capabilities is systematically different across content types, presenting diminishing returns for highly sophisticated content necessitating human judgment.

Data and variables

Data sources

This study utilizes three publicly accessible data categories spanning 2022–2024. Platform transparency reports from Meta (n = 12 quarterly reports), Google (n = 8), and Twitter (n = 7) provide violation volumes, content taxonomies, and proactive detection rates for K-means clustering (Phase 1) and Ridge regression variables (Phase 2).

Specifically, the dataset comprises quarterly transparency reports from: (1) Meta’s Facebook and Instagram platforms combined (12 quarterly reports covering Q1 2022 through Q4 2024), (2) Google’s YouTube platform (8 quarterly reports covering Q1 2023 through Q4 2024), and (3) Twitter/X platform (7 quarterly reports covering Q3 2022 through Q1 2024, with irregular publication schedules).

These three platforms were selected based on: (a) classification as Very Large Online Platforms (VLOPs) under EU Digital Services Act with monthly active users exceeding 45 million, (b) publicly available English-language quarterly transparency reports with consistent content moderation metrics, (c) comprehensive reporting of both proactive detection rates and violation volumes across multiple content categories, and (d) consistent quarterly publication throughout the study period. Other VLOPs were excluded due to incomplete quarterly reporting coverage or inconsistent content category taxonomies limiting cross-platform comparability.

Data were collected in May 2025 from official sources: Meta: “Community Standards Enforcement Report” (transparency.fb.com); Google: “YouTube Community Guidelines Enforcement” (transparencyreport.google.com); Twitter/X: “Twitter Transparency Report” (transparency.twitter.com); FBI IC3: “Internet Crime Report” (ic3.gov, 2022–2024); Europol: “Internet Organised Crime Threat Assessment” (europol.europa.eu, 2022–2024).

The final sample comprises 27 platform-quarter observations, distributed as 12 observations from Meta, 8 from Google, and 7 from Twitter.

Cybercrime databases (FBI IC3 and Europol IOCTA, n = 6 annual reports total) supply criminal typologies and financial loss data for risk calibration. Industry documentation from Trust and Safety Professional Association and publicly disclosed platform technology investments from earnings reports, supplemented by academic game-theoretic frameworks, inform parameter calibration (Phase 3). This platform-centric operational data approach mitigates traditional limitations, notably victim underreporting and temporal lags, inherent in retrospective datasets, offering a comparatively more timely basis for risk assessment than traditional post-incident analysis, though subject to the data limitations discussed below. Data Collection Procedure: Platform transparency reports were accessed from official transparency centers (Meta: transparency.fb.com; Google: transparencyreport.google.com; Twitter: transparency.twitter.com) in May 2025. Data extraction followed a systematic protocol capturing: total content actioned by category, proactive detection rates distinguishing AI-initiated versus human-initiated actions, appeal volumes and resolution outcomes, restoration rates, and temporal metadata. Extracted data were validated against platform-reported aggregate statistics to ensure consistency with official disclosures.

Several data limitations warrant acknowledgment. Platform transparency reports are self-reported disclosures subject to heterogeneous reporting standards across platforms, including differences in how violations are counted, how proactive detection is defined, and what content categories are disclosed. Strategic disclosure incentives tied to reputational and regulatory pressures may further influence the scope and framing of reported metrics. To mitigate these concerns, the study cross-validates against platform-reported aggregate statistics and employs relative measures such as proactive detection rates as proportions rather than absolute counts; nevertheless, platform-reported metrics should be interpreted as indicators of disclosed enforcement activity rather than comprehensive measures of actual moderation performance. Additionally, the final sample of 27 platform-quarter observations, while sufficient for the exploratory framework employed here, imposes constraints on statistical power for Phase 2 regression analysis, a limitation addressed further in Sect.  4.4 and reflected in the cautious interpretation of results in Sect.  6.

Variable operationalization

This section operationalizes data sources into analytical variables for the tripartite framework. Phase 1 clustering variables stratify cybercrime content into 12 categories derived from harmonized platform taxonomy classifications. These standardized content types comprise: (1) Financial fraud (including investment scams and deceptive advertising, mapped from Meta’s “financial scam” and Google’s “deceptive financial content”), (2) Phishing attacks (credential theft and account impersonation), (3) Malware distribution (viruses, trojans, and ransomware), (4) Hate speech (discriminatory content based on protected characteristics), (5) Misinformation (deliberately false news and unverified claims), (6) Spam (unsolicited commercial messages and fake engagement), (7) Human trafficking recruitment (exploitation and forced labor content), (8) Identity theft (personal data harvesting and synthetic identity fraud), (9) Child exploitation (child sexual abuse material and grooming behaviors), (10) Violent extremism (terrorism recruitment and radicalization content), (11) Harassment and bullying (targeted threats and intimidation), and (12) Intellectual property violations (copyright and trademark infringement). These categories represent the most prevalent violation types consistently reported across Meta, Google, and Twitter transparency reports during 2022–2024, supplemented by cybercrime typologies from FBI IC3 and Europol IOCTA databases.

The 12 content types are defined in relation to five variables to account for complex risk attributes, including: complexity of technological expertise (scaled from IC3/IOCTA Attack Sophistication Levels, ranging from level 1 = simple spam to level 5 = Advanced Persistent Threats), potential for propagation (log-transformed level of violation quantities from platform reporting data, reflecting content virality), financial weight of consequences (IC3 Average Loss per Crime Type, ranging from $240 for spam to $6,150 for Investment Fraud), legal gravity of consequences (maximum federal sentence in months, ranging from 3 months for lesser crimes to child exploitation of 144 months in prison), and detection ease (derived from 1 minus platform reporting of proactive detection rates, where higher values denote increased review by human operators).

Phase 2 regression variables include detection effectiveness (proactive violations per total violations) as the dependent variable, platform scale (log MAU) as an independent variable, AI capability index (number of detection features publicly disclosed via transparency reports) as an independent variable, and review efficiency (inverse appeal processing time) as an independent variable, using observations of 27 platform-quarters. Both the dependent variable and the AI capability index are derived from platform self-reported transparency data and are therefore subject to the reporting limitations discussed above.

Phase 3 game-theoretic parameters calibrate automation costs ($0.0075/item) and human costs ($0.45/item) based on cloud computing pricing for ML inference and global moderator compensation data, respectively, detection probabilities derived from proactive detection rates stratified by content complexity (AI: 0.45–0.85; human: 0.85–0.95), and breach losses ($500-$5,000 from FBI IC3 financial impact data), enabling Nash equilibrium computation for optimal resource allocation across the four content clusters identified in Phase 1.

Data processing and standardization

Data processing addresses cross-platform taxonomic heterogeneity and temporal alignment requirements. Because platform transparency reports reflect self-reported enforcement activity with potentially heterogeneous measurement definitions across platforms (e.g., what constitutes a “proactive” detection may differ between Meta’s automated classifiers and Twitter’s reporting criteria), the standardization procedures described below aim to maximize cross-platform comparability, though residual measurement inconsistencies cannot be fully eliminated. Content type standardization harmonizes platform-specific violation categories into 12 unified classifications through systematic mapping: Meta’s “financial scam” and Google’s “deceptive financial content” both map to the standardized “financial fraud” category. Temporal alignment converts all platform reports to quarterly granularity, with Twitter’s irregular publication schedules disaggregated to quarterly equivalents where necessary and Google’s variable reporting frequency retained as available observations. Missing value imputation applies linear interpolation for sporadic gaps and employs industry median substitution for unreported appeal processing times. Variable standardization is also conducted, applying Z-score normalization to all variables in Phase 1 clustering analysis, complemented by mean-centering of Phase 2 regression variables to aid in understanding coefficients. Data validation measures also include assessing temporal reproducibility, interquartile range outlier detection, as well as comparisons to platform-reported totals, ensuring strong analysis validity for all variables, although data availability is available in excess of 90% for key variables, with documented imputation methods accounting for remaining gaps.

Sample characteristics and descriptive overview

Our framework employs two data structures for different analytical purposes. Phase 1 clustering analyzes content-type-level data: we harmonized platform-specific violation categories (e.g., Meta’s “financial scam” and Google’s “deceptive financial content” both classified as “financial fraud”) into 12 standardized content types, then constructed a 12 × 5 feature matrix by characterizing each content type across five risk dimensions. These dimensions integrate platform-derived metrics (propagation potential from log-transformed violation volumes; detection difficulty calculated as 1 minus average proactive detection rate) with external risk indicators (technical complexity from IC3/IOCTA attack sophistication descriptions, financial severity from IC3 average loss data, and legal consequences from federal sentencing guidelines). All variables were Z-score normalized prior to K-means clustering.

Phase 2 regression uses the original 27 platform-quarter observations (Meta: 12, Google: 8, Twitter: 7) spanning 2022Q1 to 2024Q4 to examine platform operational factors. Detection effectiveness serves as the dependent variable, ranging from 39.2% to 87.3% (M = 66.8%, SD = 12.8%), with strong cross-platform heterogeneity evident in platform-specific averages varying from 58.9% (Twitter) to 71.2% (Google). Platform scale ranges from 237 million to 2.96 billion monthly active users (log-transformed for analysis). Cluster assignments from Phase 1 are incorporated as contextual variables in regression modeling.

Phase 3 game-theoretic calibration employs five core parameter types derived from preceding analyses: automation costs ($0.0075/item), human review costs ($0.45/item), complexity-stratified detection probabilities (AI: 0.45–0.85; human: 0.85–0.95), and breach loss values ($500-$5,000 from FBI IC3 data).

The sample size of 27 platform-quarter observations for Phase 2 regression analysis warrants careful consideration. With three predictors in the base model, this yields approximately nine observations per predictor, a ratio that constrains the stability of coefficient estimates in conventional regression settings. Ridge regression with L2 regularization partially addresses this by shrinking coefficients toward zero and reducing variance from overfitting, but does not fully compensate for the limited degrees of freedom available for detecting smaller effects. The extended interaction model introduces additional terms that further reduce effective degrees of freedom, increasing the risk of model instability. These constraints inform the analytical strategy: effect sizes and confidence intervals are reported alongside significance tests to provide a more complete picture of the strength and precision of observed associations, and results from the interaction model are interpreted with appropriate caution. Leave-one-out cross-validation results are reported in Sect.  6 to assess the robustness of base model findings. Additional stability assessments, including bootstrap resampling of coefficient estimates, are recommended for future validation with larger samples.

Methodology

Analytical overview

This chapter details the tripartite analytical framework operationalizing the Platform-Based Risk Assessment paradigm through sequential methodological phases. Phase 1 employs K-means clustering on the 12 × 5 feature matrix to stratify cybercrime content into empirically derived risk categories, addressing RQ1 through unsupervised pattern recognition. Phase 2 applies ridge regression to 27 platform-quarter observations, examining platform operational correlates of detection effectiveness and testing H2a-H2b regarding technology investment and human capacity associations with performance outcomes. Phase 3 implements Nash equilibrium computation through game-theoretic modeling, calibrating optimal automation-human resource allocation strategies to address RQ3. Each phase leverages earlier results of analyses, as Phase 1risk clusters shape Phase 2 context factors, which in turn shape Phase 3 game theoretic parameters by leveraging Phase 2 actual empirical results. Every analysis is coded in Python v3.10 for machine learning program executions as well as game theoretic computations in either NumPy libraries or SciPy libraries. Complete implementation code, including data generation, clustering, regression, and game-theoretic optimization scripts, is publicly available (see Data Availability).

Phase 1: K-means clustering for content risk stratification

The data is clustered into different risk categories by dividing the 12 types of contents using the K-means clustering algorithm, which optimizes for centroids to minimize sum of squared Euclidean distances for standardized 12 × 5 feature matrix, where cluster number (k) is selected by joint analysis of elbow method for variance explained versus iteration number, using seeding for sensitivity to local minima of initialization, running for a total of 1,000 iterations for convergence tolerance of 1e-4. Validity of cluster analysis is evaluated by silhouette values (target > 0.5), Davies-Bouldin index (lower, better clusters), and Calinski-Harabasz index (higher, more dense clusters). An unsupervised machine learning technique, this resolves RQ1 by identifying risk stratifications automatically based on content attributes, as cluster distinctiveness is also established using ANOVA tests for validation for H1, which suggests distinct category differences across the five attributes.

Phase 2: ridge regression for detection determinants

Ridge regression examines platform operational factors associated with detection effectiveness across 27 platform-quarter observations, addressing multicollinearity through L2 regularization. The model specification is:

1

with regularization parameter λ selected via 5-fold cross-validation minimizing mean squared error. Ridge regression corrects for multicollinearity in platform features, reducing coefficients but maintaining all variables. A standardized coefficients analysis allows for comparisons of relative associations. Statistically significant results (p < 0.05) examine hypotheses H2a (technology investment is associated with detection effectiveness) and H2b (human review capacity is associated with detection effectiveness), focusing on RQ2, which asks what platform variables are most strongly associated with detection performance. The results’ validity tests involve leave-one-out analysis and heteroskedastic-robust standard errors to account for differences in platforms. As noted in Sect.  4.4, the sample of 27 observations with three predictors yields a limited observations-per-predictor ratio, and coefficient estimates should be interpreted as indicating the direction and approximate magnitude of associations rather than precise causal effects.

To examine whether platform capabilities exhibit differential effectiveness across content types identified in Phase 1 clustering, hierarchical regression analysis extends the base ridge model by incorporating interaction terms between AI Capability Index and cluster membership. This approach addresses the possibility that technological investments may yield varying returns depending on content complexity characteristics, a phenomenon overlooked in main-effects-only specifications. The hierarchical modeling strategy proceeds in two stages: Model 1 (Main Effects):

2

where cluster dummy variables use Cluster 1 (Low-Complexity High-Volume) as the reference category. Model 2 (With Interactions): Model 2 augments Model 1 by adding interaction terms: , enabling assessment of whether AI effectiveness varies systematically across threat complexity gradients. Model comparison employs incremental F-tests to evaluate whether interaction terms significantly improve explanatory power (, ). Marginal effects of AI Capability are calculated at each cluster level to quantify differential effectiveness, with robust standard errors (HC3) accounting for potential heteroskedasticity. This analysis directly tests H3, which posits that platform capability effectiveness varies by content type, with diminishing returns for sophisticated threats requiring contextual judgment beyond pattern recognition. Statistical significance of individual interaction coefficients indicates where AI effectiveness deviates from the baseline (Cluster 1) performance, informing Phase 3 game-theoretic calibration of optimal automation levels tailored to content-specific technological constraints. An important methodological caveat applies to the interaction model. With 27 observations and multiple interaction terms, the extended model consumes a substantial proportion of available degrees of freedom, raising concerns about overfitting and the stability of highly significant p-values. To address this, several precautions are taken. Robust standard errors (HC3) are used throughout to guard against heteroskedasticity-driven inflation of test statistics. Model comparison between the base model and the interaction model is evaluated using incremental F-tests and adjusted R², which penalize model complexity relative to the base specification. Leave-one-out cross-validation, already applied to the base ridge model, provides a benchmark for assessing overfitting risk; for the interaction model, adjusted R² and incremental F-tests serve as the primary indicators of whether added complexity is justified relative to the base specification. Results from the interaction model are interpreted as exploratory indicators of content-type-specific patterns rather than confirmatory evidence, and the strength of individual interaction coefficients is evaluated in terms of effect sizes and confidence interval widths alongside conventional significance thresholds.

Phase 3: game-theoretic modeling for optimal resource allocation

Game-theoretic modeling determines optimal automation levels through Nash equilibrium computation in a two-player simultaneous game between platform (defender) and attacker. Platform strategy space comprises automation proportion α∈[0,1], with payoff function: , where. Attacker chooses level of complexity to maximize payoff based on platform strategy. Nash equilibrium solution determines α* at which players have no reason to cheat by themselves. Calibrated values for parameters, based on empirical regularities of Phase 2, enable realistic payoff analysis. Analysis of sensitivity of α* to differences in costs and precision, testing hypothesis H3, answers RQ3 about finding an optimal level of integration of human intelligence into automated systems of a different complexity level of threat. Parameter Calibration: Cost parameters derived from cloud ML pricing ($0.0075) and moderator compensation benchmarks ($0.45, Trust and Safety Professional Association 2023–2024). Detection probabilities stratified by complexity (AI: 0.45–0.85; Human: 0.85–0.95) from platform transparency reports. Breach losses ($500-$5,000) from FBI IC3 2022–2024 data. The current model treats content risk and attacker-defender interactions at an aggregated platform level. This design choice prioritizes analytical tractability with the available data but does not capture network topology effects, local interaction dynamics, or evolutionary adaptation of attacker strategies over time.

Results

Descriptive statistics

Table 1 presents the 12 content types across five standardized dimensions, revealing substantial heterogeneity in financial severity (M = $1,950, SD = $1580, skewness = 1.12) and legal consequences (M = 47.6 months, range = 3.0-144.0). Table 2 reports platform-quarter characteristics (n = 27), with detection effectiveness averaging 66.8% (SD = 12.8%, range = 39.2–87.3%). Interestingly, Google beat Meta in detection efficacy (71.2% versus 68.4%, F = 4.18, p < 0.05) as well as review efficiency (0.102 versus 0.073). Table 3 shows correlations, in which platform size is insignificant in relation to detection efficacy (r = -0.17, p = 0.39). Figure 2 shows that, aside from AI Capability Index, values for all variables are far from exceeding the thresholds of multicollinearity (VIF = 4.58). The mean value of 2.62 is acceptable, anyway. All platform-level variables are derived from self-reported transparency data.

Table 1.

Content type characteristics for clustering analysis.

Dimension	Mean	SD	Min	Max	Skewness
Technical complexitya	2.92	1.47	1.00	5.00	0.23
Propagation potentialb	5.51	1.82	2.14	9.06	0.58
Financial severity ($)c	1,950	1,580	240	6,150	1.12
Legal consequence (months)d	47.6	41.3	3.0	144.0	0.81
Detection difficultye	0.41	0.23	0.08	0.85	0.47

Notes: ^a Ordinal scale from IC3/IOCTA attack sophistication descriptions (1 = low to 5 = very high), ^b Log transformed violation volumes from platform transparency reports, ^c Average financial loss per incident from FBI IC3 annual reports, ^d Maximum federal sentencing guidelines in months, e Calculated as (1 − proactive detection rate) from platform reports. All variables standardized via Z-score normalization prior to K-means clustering analysis (Phase 1). n = 12 content types.

Table 2.

Descriptive statistics of platform-quarter variables.

Variable	Mean	SD	Min	Max	Skewness	Meta	google	Twitter	F-stat
Dependent variable
Detection effectiveness (%)	66.8	12.8	39.2	87.3	−0.31	68.4	71.2	58.9	4.18*
Independent variables
log(MAU)	20.35	1.14	18.73	22.08	−0.09	21.43	21.21	19.28	35.7***
AI capability index	5.1	2.8	0.0	10.0	0.19	7.4	5.9	2.8	29.4***
Review efficiencya	0.079	0.043	0.018	0.184	0.89	0.073	0.102	0.065	3.52*

Notes: ^aCalculated as inverse of appeal processing time (1/days); higher values indicate greater efficiency; Platform columns show mean values: Meta (n = 12), Google (n = 8), Twitter (n = 7); F-statistics from one-way ANOVA testing between-platform differences; ***p < 0.001, **p < 0.01, *p < 0.05; Variables mean-centered prior to ridge regression analysis (Phase 2). Total n = 27 platform-quarter observations.

Table 3.

Correlation matrix and multicollinearity diagnostics.

	(1)	(2)	(3)	(4)	Mean	SD	VIF
(1) Detection effectiveness (%)	–				66.8	12.8	–
(2) log(MAU)	−0.17	–			20.35	1.14	1.47
(3) AI capability index	0.62***	0.68***	–		5.1	2.8	4.58
(4) Review efficiency	0.53**	0.29	0.47*	–	0.079	0.043	1.82

Notes: Pearson correlation coefficients below diagonal (n = 27 platform-quarter observations); VIF = Variance Inflation Factor; values approaching 5 indicate borderline multicollinearity concern; Mean VIF = 2.62 (acceptable level); ***p < 0.001, **p < 0.01, *p < 0.05 (two-tailed tests).

Fig. 2.

Multicollinearity diagnostics for independent variables. (Notes: VIF calculated as 1/(1-R²_j) where R²_j from auxiliary regression. AI Capability Index shows VIF = 4.58, approaching concern threshold (5.0) due to correlations with log(MAU) (r = 0.68***) and Review Efficiency (r = 0.47*). While below 5.0, this borderline value justifies Ridge regression for coefficient stability. Wide VIF range (1.47–4.58) reflects heterogeneous collinearity patterns. See Table 3 for complete correlation matrix. *p < 0.05, ***p < 0.001. n = 27 platform-quarter observations.)

K-means clustering results

K-means clustering identified four distinct content categories (k = 4), addressing RQ1’s categorization question. Elbow technique and silhouette analysis yielded this solution (Fig. 3). validity measures suggest that this solution is moderately good (silhouette value of 0.54; slightly above threshold of 0.5; Davies-Bouldin index of 1.03; borderline acceptable). Analysis of Table 4 shows that all variables significantly discriminate between clusters (p < 0.01) with F-values ranging from 9.8 (legal consequences) to 31.4. Cluster 2, emerged as the most significant (n = 5), as it mostly contains cases of moderate-violation types, which include misinformation and hate speech dissemination. Clusters 3 and 4, both emerged as (n = 2). PC Analysis of PCA (Fig. 4) describes a total of 69.1% of variance in the data sets. The above results partially support Hypothesis-1, as they prove that different types of clusters do indeed exist, but as they border a threshold level, they tend to possess some common attributes (Table 5).

Fig. 3.

Optimal cluster number determination. (Notes: Elbow method identifies inflection point where marginal reduction in within-cluster variance diminishes. Both methods converge on k = 4 as optimal solution.)

Table 4.

K-means cluster profiles and ANOVA results.

Dimension	Cluster 1	Cluster 2	Cluster 3	Cluster 4	ANOVA
	(n = 3)	(n = 5)	(n = 2)	(n = 2)	F-stat
Technical complexity	−0.91	0.28	0.84	1.47	28.3***
Propagation potential	1.23	−0.18	0.67	−0.96	18.7***
Financial severity	−0.68	−0.34	1.96	0.52	31.4***
Legal consequence	−0.54	0.19	0.88	0.73	9.8**
Detection difficulty	−0.87	0.04	1.12	1.08	23.6***

Notes: Values shown as standardized Z-scores (mean = 0, SD = 1).

Fig. 4.

Cluster visualization using principal component analysis. (Notes: PCA performed on standardized 5-dimensional data. First two components explain 69.1% of total variance.)

Table 5.

Cluster validation metrics.

Metric	Value	Threshold/benchmark	Interpretation
Overall Silhouette Score	0.54	> 0.50 = reasonable	Moderate cluster structure
Davies-Bouldin Index	1.03	< 1.00 = good	Borderline separation quality
Calinski-Harabasz Index	118.3	Higher = better	Acceptable cluster definition
Within-Cluster SS	22.15	–	Moderate intra-cluster compactness
Between-Cluster SS	37.85	–	Moderate inter-cluster separation
Total SS	60.00	–	Total variance
Variance Explained	63.1%	–	Between-cluster/total

Ridge regression result

Ridge Regression (λ = 0.18, cross-validated value) focused on platform variables associated with detection efficacy, responding to RQ2, Although AI Capability Index VIF (4.58) falls below the standard threshold (5.0), we employed Ridge regression to address this borderline multicollinearity concern (Table 6). Based upon cluster Typological Analysis in Phase 1, findings suggest AI Capability Index as the strongest predictor in this sample (Std β = 0.63, t = 4.22, p < 0.001). Review Efficiency has a moderate positive association (Std β = 0.39, t = 2.43, p = 0.023), which is consistent with H2b, although less strongly. Notice, however, that platform scale (log MAU) is insignificant (Std β=-0.13, p = 0.479), which challenges scale-related hypotheses. The model achieves moderate fit. Figure 5 visualizes effect sizes with confidence intervals. Diagnostic tests confirm assumptions satisfied (Breusch-Pagan p = 0.28, Shapiro-Wilk p = 0.41). Substantial unexplained variance (43.8%) suggests content characteristics and policy factors warrant Phase 3 examination. Results inform subsequent interaction analysis between platform capabilities and content types.

Table 6.

Ridge regression results for detection effectiveness.

Variable	β	Std β	SE	t-stat	p-value	95% CI
Intercept	28.47	–	18.62	1.53	0.140	[− 9.84, 66.78]
log(MAU)	−1.38	−0.13	1.92	−0.72	0.479	[− 5.35, 2.59]
AI capability index	2.87	0.63	0.68	4.22	< 0.001	[1.47, 4.27]
Review efficiency	78.34	0.39	32.18	2.43	0.023	[12.08, 144.60]

Notes: Dependent variable: Detection Effectiveness (%). β = unstandardized coefficients; Std β = standardized coefficients. Ridge regularization parameter λ = 0.18 selected via 5-fold cross-validation (optimal range: 0.12–0.25). VIF values: log(MAU) = 1.47, AI Capability = 4.58, Review Efficiency = 1.82. Diagnostic tests: Breusch-Pagan χ² = 3.84 (p = 0.28), Shapiro-Wilk W = 0.96 (p = 0.41), Cook’s D max = 0.23. Leave-one-out cross-validation R² = 0.562. n = 27 platform-quarter observations. Model Statistics: R²=0.562, Adjusted R² = 0.512, F(3,23) = 9.84, p < 0.001.

Fig. 5.

Relative effects of platform factors on detection effectiveness. (notes: Error bars represent 95% confidence intervals calculated from robust standard errors (HC3). n = 27 platform-quarter observations.)

Interaction effects analysis

Phase 3 explores whether platform capabilities exhibit differential effectiveness for different types of content, extending the main-effects model examined in Phase 2. Hierarchical regression analysis (Table 7) indicates that interaction effects between AI Capability Index and content types reach statistical significance. Model 2 is an improvement over models containing only main effects (ΔR² = 0.089, F(3,17) = 4.83, p = 0.008). Interaction coefficients suggest diminishing AI effectiveness for sophisticated threats: Cluster 3 (β=−1.94, p = 0.011) and Cluster 4 (β=−2.31, p < 0.001). Marginal effects in Fig. 6 illustrate that AI shows the strongest association in low complexity cases (Cluster 1, β = 3.42, p < 0.001) but steadily decreases for moderate-violation cases (Cluster 2, β = 2.55, p = 0.003) and is no longer significant in financial (Cluster 3, β = 1.48, p = 0.084) and technological (Cluster 4, β = 1.11, p = 0.203) types of threat violation cases, providing preliminary support for H3, suggesting content-type-specific variation in AI-assisted detection effectiveness.

Table 7.

Interaction effects - platform capabilities × content clusters.

	Variable	Model 1	Model 2
		Coef (SE)	Coef (SE)
Platform factors	log(MAU)	−1.42 (1.98)	−1.56 (1.89)
	AI Capability Index	2.91 (0.71)***	3.42 (0.85)***
	Review Efficiency	76.28 (33.45)*	68.14 (31.22)*
Content clusters (ref: cluster 1)	Cluster 2 (Moderate-Impact)	−4.23 (2.87)	−3.86 (2.64)
	Cluster 3 (Financial Fraud)	−8.47 (3.52)*	−7.92 (3.28)*
	Cluster 4 (Technical Threats)	−9.18 (3.68)*	−8.53 (3.42)*
Interactions (AI capability ×)	× Cluster 2	–	−0.87 (0.45)
	× Cluster 3	–	−1.94 (0.58)**
	× Cluster 4	–	−2.31 (0.62)***
Model statistics	R2	0.614	0.703
	Adjusted R2	0.541	0.618
	RMSE	8.34%	7.21%
	F-statistic	8.42***	9.67***

Notes: Dependent variable: Detection Effectiveness (%). Model 1 includes platform factors and content cluster main effects. Model 2 adds interaction terms between AI Capability Index and cluster membership. Cluster 1 (Low-Complexity, High-Volume content) serves as reference category. Robust standard errors (HC3) in parentheses. Model 2 improves fit relative to Model 1 (ΔR² = 0.089, p = 0.008). Marginal effects of AI Capability by cluster (from Model 2): Cluster 1 β = 3.42 (p < 0.001), Cluster 2 β = 2.55 (p = 0.003), Cluster 3 β = 1.48 (p = 0.084), Cluster 4 β = 1.11 (p = 0.203). Review Efficiency interactions non-significant (all p > 0.15, not shown). n = 27 platform-quarter observations. ***p < 0.001, **p < 0.01, *p < 0.05.

Fig. 6.

AI capability effectiveness varies by content type. (Notes: Marginal effects represent change in detection effectiveness (percentage points) for one-unit increase in AI Capability Index, calculated atmean values of other predictors. Error bars show 95% confidence intervals (HC3 robust standard errors). n = 27.)

Game-theoretic resource allocation

Nash equilibrium analysis estimates optimal automation rates balancing costs against breach risks under adversarial conditions. Table 8 presents solutions calibrated from Phase 2 marginal effects and cost parameters, revealing α* declining from 0.78 (Cluster 1) to 0.29 (Cluster 4) as threat complexity increases. High automation for simple content achieves 55.0% cost savings ($0.103/item) and 54.5% breach reduction compared to random allocation. However, advanced threats demand human-centric strategies (71% human analysis) together with associated 41.5% cost multipliers and breach risks, as underlined in Phase 2, to compensate for intrinsic detection technological limitations. Money-related fraud (α* = 0.41) lends itself to moderate technological usage because of certain patterns related to them. Figure 7 above shows resource-performance tradeoffs, explained by Nash equilibriums in optimally allocating resources based upon technological limitations, as opposed to affecting all types of contents in a beneficial manner in all cases. Monte Carlo tests (n = 1,000) established equilibrium stability.

Table 8.

Nash equilibrium solutions for optimal resource allocation.

Content type (cluster)	Optimal α*	95% CI	Expected cost/item ($)	Expected detection rate (%)	Breach prob. (%)	Total payoff ($/item)
Cluster 1 low-complexity high-volume	0.78	[0.74–0.82]	0.103 (0.012)	88.4 (2.3)	11.6 (2.3)	−0.161 (0.018)
Cluster 2 moderate-impact violations	0.61	[0.56–0.66]	0.181 (0.019)	81.2 (3.1)	18.8 (3.1)	−0.275 (0.024)
Cluster 3 financial fraud high-severity	0.41	[0.35–0.47]	0.269 (0.029)	74.2 (3.9)	25.8 (3.9)	−0.408 (0.034)
Cluster 4 technical threats advanced attacks	0.29	[0.23–0.35]	0.322 (0.035)	67.8 (4.6)	32.2 (4.6)	−0.483 (0.042)
Random allocation (baseline)	0.50	–	0.229 (0.023)	74.5 (4.5)	25.5 (4.5)	−0.357 (0.041)

Fig. 7.

Optimal automation strategy varies by threat complexity. (Note: Error bars represent 95% confidence intervals (asymmetric). Shaded annotations indicate strategic zones. n = 4 content clusters; 1,000 Monte Carlo simulations per cluster.)

Discussion and conclusion

This paper explored platform-level variables associated with detection effectiveness for cybercrime-related content using integrated clustering analysis, regression analysis, interaction analysis, and optimization from game theory perspectives. Results of this study have identified systematic differences in cybercrime-related content homogeneity, as well as systematic differences in platform effectiveness, challenging the uniformity of detection methods in different cyber platforms. There appear to be four systematically different clusters of cybercrime-related content as far as complexity, spread, financial injury, legal impacts, and effectiveness of detection in different platforms, as explored by K-mean clustering analysis used in this study, which further refines existing platform level cybercrime-related content management^6,31. This study represents examinations that integrates unsupervised content risk stratification, platform-level regression analysis, and game-theoretic resource optimization within a unified analytical framework, offering a methodological template for platform-based cybercrime risk assessment.

Ridge regression analysis suggests that, within this sample, AI capability is the strongest correlate of detection effectiveness, with the model accounting for approximately 56% of outcome variation. However, coefficient estimates from regularized regression with small samples are better understood as indicative of association direction and approximate magnitude rather than precise predictive relationships³². This is in line with claims that machine learning technologies have radically shifted content moderation economics as well as capabilities^33,34. The human review capacity variable showed moderate positive associations for detection outcome measures, which suggests that human review processes complement, rather than substitute for, algorithmic processes, in line with recent statements about human moderators being more effective than AI in complex contexts²⁶. Contrary to expectations, platform size of user bases failed to demonstrate significant detection benefits, which could be due to challenges in balancing content increases versus resource shortages, as observed in platform governance studies^35,36.

The exploratory interaction analysis suggests content-specific effectiveness of AI, which has potentially important implications for real-world applications of this technology. The detection performance showed a gradient decline upon increasing complexity of malicious content, which is consistent with the interpretation that AI systems are highly efficient in dealing with low-spam, low-quality malicious data but show diminished effectiveness in more sophisticated financial deception schemes and advanced cyberthreats³⁷. This pattern aligns with the trade-off framework identifying a fundamental tension between automated scalability and contextual judgment in content moderation across 86 empirical studies³⁸. The effectiveness drop-off pointed to current AI systems being well-justified for anti-pattern detection of high-volume, low-complexity content, rather than for context-related analysis, which demands domain-specific judgment and behavioral expertise^39,40. The observed variation in detection performance across different types of malicious data challenges technological presumptions of universality in general (Label Your Data. 2023). These interaction results are exploratory given the sample size constraints, and the specific magnitudes of content-type-specific effectiveness differences should be interpreted with caution.

Furthermore, game theoretic analysis suggests that detection capabilities for sophisticated threats are constrained by fundamental technological capabilities, as opposed to inefficient resource allocation. Nash equilibrium resource allocation maximizes automata rates for general AI effectiveness, but sophisticated attacks (Clusters 3–4) remain susceptible to breaches even for optimized strategies, resulting in an increased resource cost of 17–41% above randomly-allocated resources. This pattern is consistent with the interpretation that optimization procedures lead to better resource allocation efficiency but cannot bypass technological capabilities, which remain a fundamental limitation. For simple contents but highly efficient AI (as in Cluster 1, detection rates of up to 88.4% for Cluster 1), optimized strategies for high-automation resource allocation (α*=0.78) outlining a 55.0% resource savings and 54.5% breach avoidance advocate heavily for technological-intensive approaches, but for sophisticated contents necessitating Context Analysis, highly human-intensive strategies (71% human analysis for Cluster 4) result in relatively lower detection rates, pointing to technological advancement in detection capabilities as an imperative complement for optimization algorithms. These game-theoretic results are conditional on the cost parameters and detection probabilities calibrated from Phase 2, the implications of this platform-level scope, including network topology and evolutionary dynamics, are addressed in the limitations below.

There also exist several limitations that must be taken into account. The cross-sectional design precludes causal inference; although the temporal ordering of platform capabilities preceding detection outcomes provides a degree of logical sequencing, the observational nature of the data means that all regression results should be interpreted as associations rather than causal effects. The sample size is small (n = 27 for platform per quarter), which makes it difficult to detect smaller effects using statistics. Aggregated data at a platform level does not allow consideration of differences at a level of platform users, as well as detection patterns for different types of objects (e.g., malware vs. spam). The data relied upon publicly available metrics, which might be characterized by reporting bias, at least to a certain extent. The study is focused on developed platforms, primarily serving Western markets, which makes it difficult to generalize results to other platforms or to different regions (e.g., Asia). A game theoretic model does not account for dynamic changes in threat distribution, which require constant update in response to adaptations of potential adversaries to detection methods.

The limited sample size warrants particular emphasis as it shapes the interpretive scope of this study’s findings. With 27 platform-quarter observations and three predictors, the base ridge regression model operates at a ratio of nine observations per predictor. Regularization approaches such as ridge regression can partially address coefficient instability in small-sample settings, though the precision of point estimates remains fundamentally constrained by the limited degrees of freedom³². The interaction model, which introduces cluster dummy variables and their cross-products with AI Capability Index, further reduces available degrees of freedom, raising concerns about overfitting. As detailed in Sect. 5.3, the interaction results are treated as exploratory, with effect directions and relative magnitudes considered more informative than precise p-values. Ridge regularization partially mitigates collinearity-driven instability, and leave-one-out cross-validation (R² = 0.562) provides a benchmark for the base model’s out-of-sample performance. Nevertheless, the statistical power to detect moderate interaction effects is limited, and the highly significant p-values reported for certain interaction coefficients (e.g., Cluster 4, p < 0.001) should be viewed with the caution appropriate to small-sample exploratory analysis, for such coefficients, the direction of effects and their relative magnitudes across clusters are more informative than precise significance levels. Future replication with larger, multi-platform longitudinal datasets is essential before these patterns can be considered confirmatory.

A related concern is the epistemic status of the data underpinning this analysis. All platform-level variables, including detection effectiveness, AI capability indicators, and review efficiency, are derived from platform transparency reports, which are self-reported and not subject to independent verification. None of the major platforms’ transparency reports fully comply with the Santa Clara Principles 2.0 framework, and platforms may engage in “visibility management” rather than providing substantively meaningful disclosure⁴¹. Heterogeneous reporting standards across platforms (e.g., what constitutes “proactive detection” may differ between Meta and Google) introduce measurement inconsistency that cannot be fully resolved through post-hoc standardization. As discussed in Sect. 4.1, we attempted to mitigate this through cross-validation with external benchmarks and the use of relative rather than absolute metrics, but residual reporting bias may still influence the magnitude and precision of estimated associations. Independent audit mechanisms or standardized regulatory reporting frameworks would substantially improve the empirical foundation for studies of this kind.

Finally, the current framework operates at an aggregated platform level and does not account for the networked structure through which cybercrime content propagates. Network topology, including scale-free and clustered architectures, critically shapes the dynamics of cyber risk diffusion, implying that platform-level averages may mask substantial variation in local risk exposure⁴². The game-theoretic model likewise treats attacker–defender interactions as a single simultaneous game without incorporating network position effects or the evolutionary adaptation of attacker strategies over time. These simplifications prioritize analytical tractability with the available data but represent meaningful scope boundaries that future extensions should address.

Future work should examine longitudinal study approaches to understand the trajectory of detection effectiveness over time in response to advancing AI capabilities, especially in light of recent large language model applications in content moderation (UNESCO,⁴³. The exploration of effective human-AI symbiotic relationships for different types of content, as well as analyses of regulator conditions affecting platform investments in detection infrastructure, rank as high priority topics for further exploration. Game theory models incorporating adversarial learning dynamics would benefit from further theoretical development to capture the co-evolutionary nature of attacker–defender interactions. Comparative platform studies, taking into account a broader range of geographical and demographic conditions, would also improve generalizability of results. Analysis of adversarial learning by malicious actors in response to advancements in detection systems is another highly relevant area, in consideration of recent advancements in AI-based cybercrime methods.

A particularly promising direction involves extending the PBRA framework to complex network settings. Recent advances in evolutionary dynamics on networks have demonstrated that topological structure fundamentally shapes strategic outcomes. Bursty switching between network topologies can promote topological collapse, substantially altering both diffusion processes and evolutionary game equilibria⁴⁴, and power-law activation patterns on networks yield critical conditions for cooperation in evolutionary games under topological evolution⁴⁵. Self-interaction learning, where agents reinforce their own strategies based on local network position, has also been shown to act as a selection amplifier that alters fixation probabilities and cooperation equilibria in networked systems⁴⁶. These findings suggest that incorporating network structure into cybercrime risk models could capture topology-dependent variation in risk exposure that platform-level aggregation currently masks. In the cybersecurity domain specifically, evolutionary game theory has been applied to model cybersecurity investment as a multi-population asymmetric game with replicator dynamics, showing how evolutionary stable strategies emerge from the interplay of costs, benefits, and attack probabilities²⁶. This framework could be adapted to model the dynamic co-evolution of platform moderation strategies and attacker sophistication over time.

In summary, this study’s principal finding, that content moderation effectiveness depends fundamentally on matching technological capabilities to content complexity and that resource optimization alone cannot compensate for detection technology limitations, offers empirically grounded, though preliminary, guidance for platform governance, regulatory design, and cybersecurity policy development. The integrated clustering, regression, and game-theory framework provides a replicable methodological approach that, with larger datasets and network-level extensions, can support more precise and generalizable recommendations.

Author contributions

L.Z. conceptualized the research framework, designed the machine learning and game theory methodology, collected and processed the platform data, performed the statistical analysis including K-means clustering, ridge regression, and Nash equilibrium optimization, interpreted the results, and wrote the entire manuscript.

Funding

This research received no external funding support.

Data availability

The datasets generated during the current study and all analysis code are available in the Zenodo repository, https://doi.org/10.5281/zenodo.18972838.

Declarations

Competing interests

The authors declare no competing interests.