Attribution — tying an intrusion back to the group behind it — is one of the slowest, most manual jobs in a security operations centre. Analysts cross-reference tooling, infrastructure and tradecraft by hand, and the answer often arrives long after it could have changed a decision.
This research explores whether that work can be meaningfully automated. By treating an incident tactics, techniques and procedures as structured features, and applying machine learning and natural-language processing to the enormous body of open threat reporting, the goal is to surface candidate actors and a confidence level in minutes rather than days.
The problem with manual attribution
Attribution evidence is scattered across incident notes, malware analyses, vendor reports and blog posts, almost all of it unstructured prose. An analyst must read widely, remember which group favoured which loader eighteen months ago, and weigh overlapping indicators that multiple groups share. The result is slow, inconsistent between analysts, and heavily biased toward whichever reporting the analyst happens to have read.
It is also easy to get wrong. Shared tooling, commodity malware and deliberate false flags mean that a single strong-looking indicator can point confidently in the wrong direction. Any automated approach has to represent uncertainty honestly rather than emitting a single name.
Approach
- Behaviour as features: encoding observed activity as MITRE ATT&CK techniques gives a consistent vocabulary that is far more durable than indicators such as hashes or IP addresses, which change between campaigns.
- NLP over public reporting: extracting technique and tooling mentions from threat-intelligence prose at a scale no analyst can read manually.
- Similarity and clustering: comparing an incident technique profile against known campaign profiles to rank candidates rather than assert one.
- Calibrated confidence: treating attribution as a probability distribution, and being explicit about which evidence is doing the work.
Why it matters operationally
Attribution is not about naming and shaming. Knowing which cluster of activity you are facing changes defensive priorities immediately: it predicts which techniques come next, which assets are likely targets, and which detections are worth writing first. Delivering that signal early in an incident, with an honest confidence level attached, is worth considerably more than a perfect answer produced after remediation is complete.
The findings from this work feed directly into the detections and analysis published in the research write-ups and the detection engineering library.