Social Engineering Vulnerability Index pada Provinsi di Indonesia Tahun 2025 dengan Principal Component Analysis dan K-Medoids Clustering

Hafizh  Nursalim; Ratna Widayati; Zulfia Memi  Mayasari; Oon  Septa

doi:10.29303/griya.v6i3.1353

Hafizh Nursalim Matematika, FMIPA, Universitas Bengkulu, Bengkulu
Ratna Widayati Universitas Bengkulu
Zulfia Memi Mayasari Matematika, FMIPA, Universitas Bengkulu, Bengkulu
Oon Septa Matematika, FMIPA, Universitas Bengkulu, Bengkulu

DOI: https://doi.org/10.29303/griya.v6i3.1353

Keywords: Social Engineering Vulnerability, Index, Principal Component Analysis, K-Medoids Clustering

Abstract

Indonesia generates a wide range of data, including both public data and sensitive personal data. Generally, cyber attacks can occur through software vulnerabilities, human intermediaries using social engineering techniques, or combination of both. If social engineering involves software vulnerabilities, the CVSS can be used to assess software vulnerabilities and the EPSS to estimate the probability of the exploitation. However, CVSS and EPSS cannot be applied to social engineering techniques that do not involve software or merely use it as a medium without exploiting its vulnerabilities. Based on a literature review, no study has been found that develops social engineering vulnerability index at the subnational level. Therefore, this research aims to fill this gap by constructing Social Engineering Vulnerability Index for 38 Indonesian provinces in 2025 using Principal Component Analysis (PCA), preserving 79.33% of the original data's information. Subsequently, the vulnerability levels were analyzed using K-Medoids clustering, where the optimal number of clusters was based on the interpretation of Silhouette Coefficient (SC) and average Silhouette Coefficient. The index ranges from 0 to 1, representing 5 vulnerability levels. This research indicates that there are variations in social engineering vulnerability due to socioeconomic and digital ecosystem disparities

References

Albladi, S. M., & Weir, G. R. S. (2020). Predicting Individuals’ Vulnerability to Social Engineering in Social Networks. Cybersecurity, 3(1), 7. https://doi.org/10.1186/s42400-020-00047-5.
Aldawood, H., & Skinner, G. (2019). Reviewing Cyber Security Social Engineering Training and Awareness Programs—Pitfalls and Ongoing Issues. Future Internet, 11(3), 73. https://doi.org/10.3390/fi11030073.
APJII. (2025). Survei Penetrasi Internet dan Perilaku Penggunaan Internet 2025. Retrieved February 10, 2026, from APJII website: https://survei.apjii.or.id/survei/group/11.
Bassett, G., Hylender, D., Langlois, P., Pinto, A., & Widup, S. (2022). 2022 Data Breach Investigations Report. Retrieved February 10, 2026, from Verizon website: https://www.verizon.com/business/resources/reports/2022-dbir-data-breach-investigations-report.pdf .
BIG. (2024). Pulau Indonesia Bertambah Jadi 17.380, Mengapa Angkanya Berubah Setiap Tahun?. Retrieved February 10, 2026, from BIG website: https://sipulau.big.go.id/news/11.
BPS. (2025a). Gini Ratio Menurut Provinsi dan Daerah, 2025. Retrieved February 10, 2026,
from BPS website: https://www.bps.go.id/id/statistics-table/2/OTgjMg==/gini-ratio-menurut-provinsi-dan-daerah.html.
BPS. (2025b). Jumlah Penduduk Pertengahan Tahun (Ribu Jiwa), 2025. Retrieved February 10, 2026, from BPS website: https://www.bps.go.id/id/statistics-table/2/MTk3NSMy/jumlah-penduduk-pertengahan-tahun--ribu-jiwa-.html.
BPS. (2025c). Penduduk, Laju Pertumbuhan Penduduk, Distribusi Persentase Penduduk, Kepadatan Penduduk, Rasio Jenis Kelamin Penduduk Menurut Provinsi, 2025. Retrieved February 10, 2026, from BPS website: https://www.bps.go.id/id/statistics-table/3/V1ZSbFRUY3lTbFpEYTNsVWNGcDZjek53YkhsNFFUMDkjMw==/penduduk--laju-pertumbuhan-penduduk--distribusi-persentase-penduduk--kepadatan-penduduk--rasio-jenis-kelamin-penduduk-menurut-provinsi--2024.html?year=2025.
BPS. (2025d). Persentase Penduduk Miskin (P0) Menurut Provinsi dan Daerah (Persen), 2025. Retrieved February 10, 2026, from BPS website: https://www.bps.go.id/id/statistics-table/2/MTkyIzI=/persentase-penduduk-miskin--p0--menurut-provinsi-dan-daerah.html.
BPS. (2025e). Rata-Rata Lama Sekolah Penduduk Umur 15 Tahun ke Atas Menurut Provinsi, 2025. Retrieved February 10, 2026, from BPS website: https://www.bps.go.id/id/statistics-table/2/MTQyOSMy/rata-rata-lama-sekolah-penduduk-umur-15-tahun-ke-atas-menurut-provinsi.html.
BPS. (2025f). Tingkat Pengangguran Terbuka Menurut Provinsi (Persen), 2025. Retrieved February 10, 2026, from BPS website: https://www.bps.go.id/id/statistics-table/2/NTQzIzI=/tingkat-pengangguran-terbuka--februari-2024.html.
FIRST. (2023). Common Vulnerability Scoring System version 4.0: User Guide. Retrieved February 10, 2026, from FIRST website: https://www.first.org/cvss/v4.0/user-guide.
Hossin, M. A., Du, J., Mu, L., & Asante, I. O. (2023). Big Data-Driven Public Policy Decisions: Transformation Toward Smart Governance. Sage Open, 13(4), 1–19. https://doi.org/10.1177/21582440231215123.
Jacobs, J., Romanosky, S., Edwards, B., Adjerid, I., & Roytman, M. (2021). Exploit Prediction Scoring System (EPSS). Digital Threats: Research and Practice, 2(3). https://doi.org/10.1145/3436242.
Kaiser, H. F. (1960). The Application of Electronic Computers to Factor Analysis. Educational and Psychological Measurement, 20(1), 141–151. https://doi.org/10.1177/001316446002000116.
Kaufman, L., & Rousseeuw, P. J. (1990). Finding Groups in Data: An Introduction to Cluster Analysis. New Jersey: John Wiley & Son.
Kumar, K., Shruthi, Sathwick, & Prathap. (2024). Outcomes of Social Engineering: Understanding Cybercriminals’ Exploitation of Human Psychology. International Journal of Scientific Research in Engineering and Management, 08(11), 1–10. https://doi.org/10.55041/IJSREM39133.
Maraj, A., & Butler, W. (2022). Taxonomy of Social Engineering Attacks: A Survey of Trends and Future Directions. Proceedings of the 17th International Conference on Information Warfare and Security, 17(1), 185–193. https://doi.org/10.34190/iccws.17.1.40.
Mitra, S., Neguyen, T., Zhang, Q., Kim, H., Salemi, H., Chang, C.-W., Zhang, F., Hong, M., Lu, C.-T., Purohit, H., & Cho, J.-H. (2025). SCVI: Bridging Social and Cyber Dimensions for Comprehensive Vulnerability Assessment. http://arxiv.org/abs/2503.20806.
Șandor, A., Tont, G., & Simion, E. (2022). A Mathematical Model for Risk Assessment of Social Engineering Attacks. TEM Journal, 11(1), 334–338. https://doi.org/10.18421/TEM111-42.
Trivianita, N., Marsisno, W., & Wilantika, N. (2019). Social Vulnerability Index to Tuberculosis of Provinces in Indonesia. Advances in Social Science, Education and Humanities Research (ASSEHR), 216, 170–180. https://doi.org/10.2991/ASSDG-18.2019.15.
Vishwanath, A., Harrison, B., & Ng, Y. J. (2016). Suspicion, Cognition, and Automaticity Model of Phishing Susceptibility. Communication Research, 45(8), 1146–1166. https://doi.org/10.1177/0093650215627483.
Wang, J., Herath, T., Chen, R., Vishwanath, A., & Rao, H. R. (2012). Research Article Phishing Susceptibility: An Investigation Into the Processing of a Targeted Spear Phishing Email. IEEE Transactions on Professional Communication, 55(4), 345–362. https://doi.org/10.1109/TPC.2012.2208392.