Attribution Across Cyber Attack Types: Network Intrusions and Information Operations

Abstract

The objective of this paper is to articulate the problem of attribution in cyber warfare incidents, including, surveillance, data theft, espionage, and misinformation campaigns. As the stakes increase, concerted efforts are being made by intelligence and law enforcement agencies to identify the perpetrators with much painstaking effort. Attribution tools and techniques for malicious activities on the internet are still nascent, relying mainly on technical measurements, the provenance of malicious code, and nontechnical assessments of attack and attacker characteristics to link attack activities to individuals or groups. Attribution of attacks is typically done through a burdensome manual process that relies on both technical analysis and ground intelligence. As a result, this cumbersome and laborious process of attribution is primarily reserved for the most egregious cyber attack cases and those conducted against well resourced organizations. Over time, our attribution abilities have improved, however, this improvement is a two-edged sword: as attribution capabilities improve, internet privacy is increasingly diluted. This paper discusses attribution for two vastly different types of attacks that are central to cyber conflict today: network intrusions and social bot-led misinformation campaigns. The paper discusses the state of the art regarding attribution abilities across both types of attack, provides recommendations for improved attribution, and lays out future research directions.

An Analysis of Cyberwarfare Attribution Techniques and Challenges

“…The identification of cyberattacks largely depends on technical analysis, which entails a meticulous examination of digital evidence and technical elements that may have been left behind (Goel & Nussbaum, 2021). With this type of investigation, important information about the source of the attack can be revealed.…”

“…Threat actors make strategic and operational choices known as Tactics, Techniques, and Procedures (TTPs) in their cyber operations. TTPs include the different stages of an attack, such as initial reconnaissance, intrusion, data exfiltration, or system disruption (Goel & Nussbaum, 2021). Attack vectors are the different ways in which attackers can access a target system or network.…”

Cyber Security Threats and Countermeasures using Machine and Deep Learning Approaches: A Survey

“…The attacker does not leave any proof of their involvement in these attacks. The attackers are called non-state attackers (Goel and Nussbaum, 2021). To name a few, non-state actors include criminal organizations, script kiddies, hacktivists, scammers, and black hat hackers.…”

An Environment-Specific Prioritization Model for Information-Security Vulnerabilities Based on Risk Factor Analysis

“…The rapid digital transition exposes vulnerabilities that are being exploited by cybercriminals [36,37]. Common security incidents include malware infection, ransomware, exploit exploits, improper access to applications, social engineering attacks, and denial of services [38,39].…”

“…The previous process of knowing how difficult it is to compromise an organization is decisive for an attacker or group of attackers to spend their resources and time. For this reason, all the information that organizations allow to be leaked on the Internet is of vital importance to become a target or not [34,38,39].…”