The study provides a structured overview of the field’s trajectory and outlines key future research directions for building more accurate and actionable attribution systems.
📌 3 Key Takeaways
🎯
Objective & Hypothesis:Accurately attributing cyberattacks to threat actors is a cornerstone of cybersecurity but remains highly challenging.
📊
Key Findings & Data:This systematic review analyzes the evolution of various methods for threat attribution, proposing a taxonomy of methods from text and malware analysis to graph-based and large language model (LLM)-driven approaches.
💡
Conclusion & Impact:The study provides a structured overview of the field’s trajectory and outlines key future research directions for building more accurate and actionable attribution systems.
🔬Design:Review & Systematic Survey
📍Scope:Comprehensive Sample
⚙️Variables:Cyber Threat Intelligence · Threat Actor Attribution · Machine Learning
Abstract
Accurately attributing cyberattacks to threat actors is a cornerstone of cybersecurity but remains highly challenging. This systematic review analyzes the evolution of various methods for threat attribution, proposing a taxonomy of methods from text and malware analysis to graph-based and large language model (LLM)-driven approaches. The paper traces the progression from probabilistic models to multi-modal, explainable AI, highlighting emerging trends like graph learning and retrieval-augmented generation. The study provides a structured overview of the field’s trajectory and outlines key future research directions for building more accurate and actionable attribution systems.
Huseynli, A. (2026). Cyber Threat Actor Attribution: A Systematic Review and Evolutionary Perspective. International Journal of Information Security Science, Volume: 15 Issue: 2. https://doi.org/10.55859/ijiss.1839759
T. Pahi and F. Skopik, “Cyber Attribution 2.0: Capture the False Flag,” in Proc. 18th European Conf. on Cyber Warfare and Security (ECCWS), 2019, pp. 338–345.
I. J. King, R. Ramirez, B. Bowman, and H. H. Huang, “Trail: A Knowledge Graph-Based Approach for Attributing Advanced Persistent Threats,” in Proc. IEEE 41st Int. Conf. on Data Engineering (ICDE), 2025, pp. 1207–1220.
L. Qiang, Z. Yang, L. Bao-xu, and Z. Zhengwei, “A Reasoning Method of Cyber-Attack Attribution Based on Threat Intelligence,” Int. J. Computer, Electrical, Automation, Control and Information Engineering, vol. 10, no. 5, pp. 920–924, 2016.
M. S. Abu, S. Rahayu, R. Yusof, and A. Ariffin, “An Attribution of Cyberattack Using Association Rule Mining (ARM),” Int. J. Advanced Computer Science and Applications, vol. 11, no. 2, 2020.
L. Perry, B. Shapira, and R. Puzis, “NO-DOUBT: Attack Attribution Based On Threat Intelligence Reports,” in Proc. IEEE Int. Conf. on Intelligence and Security Informatics (ISI), 2019, pp. 80–85.
I. Rosenberg, G. Sicard, and E. David, “DeepAPT: Nation-State APT Attribution Using End-to-End Deep Neural Networks,” in Artificial Neural Networks and Machine Learning–ICANN 2017, vol. 10614. Springer, 2017, pp. 91–99.
E. Böge, M. B. Ertan, H. Alptekin, and O. Çetin, “Unveiling Cyber Threat Actors: A Hybrid Deep Learning Approach for Behavior-Based Attribution,” Digital Threats: Research and Practice, vol. 6, no. 1, pp. 1–20, 2025.
N. Xiao, B. Lang, T. Wang, and Y. Chen, “APT-MMF: An Advanced Persistent Threat Actor Attribution Method Based on Multimodal and Multilevel Feature Fusion,” Computers & Security, vol. 144, p. 103960, 2024.
I. Aki, K. Watarai, S. Okada, and T. Mitsunaga, “Provenance- Based CTI Analysis with Knowledge Graph and RAG (KGRAG),” in Proc. IEEE 12th Int. Conf. on Cyber Security and Cloud Computing (CSCloud), 2025, pp. 1–6.
K. Guru, R. J. Moss, and M. J. Kochenderfer, “On Technique Identification and Threat-Actor Attribution Using LLMs and Embedding Models,” in Proc. IEEE Int. Conf. on Cyber-AI, 2025, pp. 332–339.
D. Cohen and K. Narayanaswamy, “Attack Attribution in Non- Cooperative Networks,” in Proc. Fifth Annual IEEE SMC Information Assurance Workshop, 2004, pp. 436–437.
X. Xiang, H. Liu, L. Zeng, H. Zhang, and Z. Gu, “IPAttributor: Cyber Attacker Attribution with Threat Intelligence-Enriched Intrusion Data,” Mathematics, vol. 12, no. 9, p. 1364, 2024.
S. Caltagirone, A. Pendergast, and C. Betz, “The Diamond Model of Intrusion Analysis,” Center for Cyber Intelligence Analysis and Threat Research, Tech. Rep., 2013.
T. Rid and B. Buchanan, “Attributing Cyber Attacks,” Journal of Strategic Studies, vol. 38, no. 1–2, pp. 4–37, 2015.
H. Haddadpajouh, A. Azmoodeh, A. Dehghantanha, and R. M. Parizi, “MVFCC: A Multi-View Fuzzy Consensus Clustering Model for Malware Threat Attribution,” IEEE Access, vol. 8, pp. 139 188–139 198, 2020.
B. Tang, P. Leng, X. Shen, and Y. Wei, “Deep Learning- Based APT Malware and Variants Detection with Attribution Analysis,” in Proc. IEEE 6th Int. Conf. on Pattern Recognition and Artificial Intelligence (PRAI), 2023, pp. 996–1003.
Q. Wang, H. Yan, and Z. Han, “Explainable APT Attribution for Malware Using NLP Techniques,” in Proc. IEEE 21st Int. Conf. on Software Quality, Reliability and Security (QRS), 2021, pp. 70–80.
Q. Wang, H. Yan, C. Zhao, R. Mei, Z. Han, and Y. Zhou, “APT Attribution for Malware Based on Time Series Shapelets,” in Proc. IEEE Int. Conf. on Trust, Security and Privacy in Computing and Communications (TrustCom), 2022, pp. 769– 777.
K. T. W. Teuwen, “A Modular Approach to Automatic Cyber Threat Attribution Using Opinion Pools,” in Proc. IEEE Int. Conf. on Big Data (BigData), 2023, pp. 3089–3098.
E. Irshad and A. B. Siddiqui, “Context-Aware Cyber-Threat Attribution Based on Hybrid Features,” ICT Express, vol. 10, no. 3, pp. 553–569, 2024. 43