Toward Transparent and Trustworthy Attribution of Cyberthreats

Cyber threat attribution is a critical component of modern cybersecurity, involving the identification of actors behind malicious activities and is defined as the process of identifying the origin, perpetrators, and intent behind a cyberattack. Its importance lies in enabling informed responses, deterring future attacks, and fostering accountability. It is a very dynamic field that faces significant challenges due to the unstable and rapidly evolving nature of cyber threats. In this research, we explore the balance between exactness and verifiability of cyber threat attribution. We define the basis for structuring data from cybersecurity incidents and a methodology for building a formal attribution based on this data, focusing on both of these aspects, which is intended to serve as the starting step to building a robust system for supporting formal attribution.