Attribution research

43 papers · Investigation type

Attribution research examines how observations may be connected to accounts, systems, groups or people. These are different levels of inference: similarity, shared infrastructure and evidence of control do not necessarily answer the same question.

Scope of this collection

This bibliography includes papers assigned to the Attribution investigation type. Its membership spans the subject categories represented in ALEX. The presence of a paper in this collection is not an endorsement of a particular attribution claim or a statement about an actor’s responsibility.

Using this research

Use the references to examine alternative explanations, uncertainty and the evidence needed for each step in an inference. Check whether apparent links rely on independent sources or repeat the same observation. Report the level of confidence supported by the original evidence rather than extending an association beyond it.

References reproduce the metadata held by ALEX. Missing author, year or source details are identified in the listing. Publication years are shown as recorded; collection and retrieval dates are not substituted. Follow the original source to verify a citation.

Bibliography

Showing 1–43 of 43 papers, ordered by publication year (newest first), then title.

Earlier research · five years or older Historical reference

Age markers as of 2026-11-06.

<b>A Scientific Methodology for Behavioral Identity Attribution</b>
Ahmed Awad (2026) · Figshare
Paper details
View paper · Open ALEX record
A more useful ally: the adoption of cybersecurity into the U.S.–Japan alliance
Benjamin Bartlett (2026) · The Pacific Review
Paper details
View paper · Open ALEX record
A novel ontology for cyber-attack attribution and investigation
Dilpreet Kaur Gill; Erisa Karafili (2026) · Forensic Science International: Digital Investigation
Paper details
View paper · Open ALEX record
AnubisX Framework
Ahmed Awad (2026) · Figshare
Paper details
View paper · Open ALEX record
ARCANE: Cross-Campaign Attacker Re-identification via Passive Beacon Telemetry -- A Bayesian Network Framework for Longitudinal Cyber Attribution
Abraham Itzhak Weinberg (2026) · ArXiv.org
Paper details
View paper · Open ALEX record
Artificial Intelligence, Synthetic Media, and The Criminal Justice System
Jeffrey Jacobs (2026) · Digital Commons (Liberty University)
Paper details
View paper · Open ALEX record
Bell‐Ringer Legitimacy and Crisis Responsibility Attribution: A Source‐Based Mechanism of Stakeholder Judgement
Baobao Song; Weiting Tao (2026) · Journal of Contingencies and Crisis Management
Paper details
View paper · Open ALEX record
BiTTP: Bidirectional Consistency-Enhanced Framework for Low-Resource APT Tactic and Technique Attribution
Lin Ni; Gang Yang; Xiang Peng (2026) · Electronics
Paper details
View paper · Open ALEX record
Bottom-to-Top OSINT Investigation: A Structured Approach for Relational Attribution in Cyber Threat Analysis
Gagan Jain B. S. (2026) · International Journal of Innovative Science and Research Technology
Paper details
View paper · Open ALEX record
Combating Digital Deception: A Taxonomical and Systematic Review of Deepfake Detection Approaches
Pratishtha Gupta; Bhawna Narwal; Amar Kumar Mohapatra (2026) · WIREs Data Mining and Knowledge Discovery
Paper details
View paper · Open ALEX record
Criminal Liability for Trademark Counterfeiting in the Digital Environment: A Comparative Study
Lubna Saeed Musa Ouda (2026) · Journal of Humanities and Social Sciences Studies
Paper details
View paper · Open ALEX record
Cyber Threat Actor Attribution: A Systematic Review and Evolutionary Perspective
Aykhan Huseynli (2026) · International Journal of Information Security Science
Paper details
View paper · Open ALEX record
Cybercrime 2.0: Evolving Digital Threats and The Indian Legal Framework
Balajeyasakthi J (2026) · Journal of Law and Legal Research Development
Paper details
View paper · Open ALEX record
Debapt: Ontology-driven multi-agent debate for APT adversary profile construction from cyber threat intelligence
Xinyun Zhao; Lanlan Qi; Yongheng Zhang; Yingxiao Guan; Guozheng Yang; Yuliang Lu; Xiang Wang (2026) · Computers & Security
Paper details
View paper · Open ALEX record
Deep Learning Based Attribution of Threat Activity in Network Forensic Analytics
Olarinde O.O.; Adewale O.S.; Agbonifo O.C.; O. Taiwo (2026) · Iconic Research and Engineering Journals
Paper details
View paper · Open ALEX record
EU AND NATO RESPONSES TO HYBRID THREATS: OPERATIONAL GAPS AND STRATEGIC MISALIGNMENT
Ilija Životić; Darko Obradović (2026) · SCIENCE International Journal
Paper details
View paper · Open ALEX record
False Flag Operations and Hybrid Warfare: 2026 Manual
Santiago Sainz; Álvaro Rodríguez (2026) · Zenodo (CERN European Organization for Nuclear Research)
Paper details
View paper · Open ALEX record
Figuring Out How 'Point Running' Is Treated in Criminal Law for Telecom Fraud-Criminal Law Classification of Money Muling in Telecommunications and Online Fraud
Xuanyu Zhou (2026) · International Journal of Asian Social Science Research
Paper details
View paper · Open ALEX record
High-Precision APT Malware Attribution with Out-of-Scope Resilience
Peter Williams; Adam Sobey; Erisa Karafili (2026) · arXiv (Cornell University)
Paper details
View paper · Open ALEX record
INFORMATION WARFARE - THE INTERNATIONAL LEGAL REGIME EVOLUTION, CHALLENGES, ARCHITECTURE, AND THE PATH FORWARD
Prof. Dr. Shabana Fayyaz (2026) · Strategic Thought
Paper details
View paper · Open ALEX record
KGV: Integrating Large Language Models With Knowledge Graphs for Cyber Threat Intelligence Credibility Assessment
Zongzong Wu; Ming Zhao; Yufeng Li; Huan Li; Shisong Peng; Nei Kato; Fengxiao Tang (2026) · IEEE Transactions on Mobile Computing
Paper details
View paper · Open ALEX record
Kitten or Panda? Measuring the Specificity of Threat Group Behaviors in Public CTI Knowledge Bases
Aakanksha Saha; Martina Lindorfer; Juan Caballero (2026) · Proceedings of the ACM Asia Conference on Computer and Communications Security
Paper details
View paper · Open ALEX record
LEGAL LIABILITY FOR ARTIFICIAL INTELLIGENCE-AGGRAVATED CYBERCRIMES IN NIGERIA: A SOCIO-LEGAL AND RELIGIOUS CRITIQUE
MUJTABA MUHAMMAD ABDULKADIR; BABANGIDA ADAMU BAPPIYA; SALEH ABDULLAHI (2026) · International Journal of Law, Politics and Humanities Research
Paper details
View paper · Open ALEX record
MCGMark: An Encodable and Robust Online Watermark for Tracing LLM-Generated Malicious Code
Kaiwen Ning; Jiachi Chen; Qingyuan Zhong; Tao Zhang; Yanlin Wang; Wei Li; Jingwen Zhang; Jianxing Yu; Yuming Feng; Weizhe Zhang; Zibin Zheng (2026) · ACM Transactions on Software Engineering and Methodology
Paper details
View paper · Open ALEX record
Quantifying Event Impacts on Time Series via Multiscale Contrastive Learning
Yiming Sun; Shengyu Chen; Zhengzhang Chen; Haoyu Wang; Xiaowei Jia; Haifeng Chen (2026) · Proceedings of the 35th ACM International Conference on Information and Knowledge Management
Paper details
View paper · Open ALEX record
Research on APT Attack Behavior Tracing Method Based on Deep Neural Network
Mengyuan Tao; Shuo Yang; Fangru Duan; Dong Zhu; Guliasiman Abudukadier; Aobo Zhang (2026) · Frontiers in Computing and Intelligent Systems
Paper details
View paper · Open ALEX record
Strengthening the Nexus between Criminology and Cybersecurity
Fosu Bora (2026) · International Journal of Law and Societal Studies
Paper details
View paper · Open ALEX record
Synthetic APTs: the Collapse of TTP-Based Attribution
Francesco Balassone; Víctor Mayoral-Vilches; María Sanz-Gómez; Paul Zabalegui-Landa; Stefan Rass; Davide Quarta; Daniel Sanchez-Prieto; Marina Oteiza-Álvarez; Almerindo Graziano; Lauren Min Kim; MinSeok Choi (2026) · arXiv
Collection: ALEX regular weekly discovery review queue
Paper details
View paper · Open ALEX record
The Dynamics of Cyber Terrorism
Omkar Sonawane (2026) · Exploresearch
Paper details
View paper · Open ALEX record
The Meaning Caste: How a Frontier AI Company Engineered a Meaning Caste System, Then Licensed It to the State in the Polite Grammar of Cybersecurity
Lee Sharks (2026) · Open MIND
Paper details
View paper · Open ALEX record · Source page
The Mitigation Paradox: How AI-Disinformation Experts Converge on Threats but Polarize on Solutions
Alexander Loth; Mina Schütz; Martin Kappes; Marc-Oliver Pahl (2026) · Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society
Paper details
View paper · Open ALEX record
The Role of Cyber Operations and Information Warfare in the Strategic Calculus of State and Non-State Actors
Christian C Madubuko (2026) · Journal of International Relations and Policy
Paper details
View paper · Open ALEX record
Why Cybersecurity Needs Cultural Intelligence (CULTINT)
Zoltán Bodó (2026) · Zenodo (CERN European Organization for Nuclear Research)
Paper details
View paper · Open ALEX record
Identifying Authorship in Malicious Binaries: Features, Challenges & Datasets
Jason Gray; Daniele Sgandurra; Lorenzo Cavallaro; Jorge Blasco Alis (2024) · ACM Computing Surveys
Paper details
View paper · Open ALEX record
CSKG4APT: A Cybersecurity Knowledge Graph for Advanced Persistent Threat Organization Attribution
Yitong Ren; Yanjun Xiao; Yinghai Zhou; Zhiyong Zhang; Zhihong Tian (2022) · IEEE Transactions on Knowledge and Data Engineering
Paper details
View paper · Open ALEX record
Resource Networks of Pet Scam Websites
5+
Benjamin Price; Matthew Edwards (2020) · 2020 APWG Symposium on Electronic Crime Research (eCrime)
Collection: APWG.org eCrimes Research · Original collection
Paper details
Research context
This work reflects the evidence and technical environment at the time of publication. Its methods and insights may remain valuable, while some findings or practical guidance may have been refined or superseded by subsequent research and developments. Please consult more recent sources before applying it to current research or investigations.
View paper · Open ALEX record · Source page
WordyThief: A Malicious Spammer
5+
Dr. Renée Burton; Vadym Tymchenko; Nicholas Sundvall; Minh Hoang; Jim Mozley; Michael Josten (2020) · 2020 APWG Symposium on Electronic Crime Research (eCrime)
Collection: APWG.org eCrimes Research · Original collection
Paper details
Research context
This work reflects the evidence and technical environment at the time of publication. Its methods and insights may remain valuable, while some findings or practical guidance may have been refined or superseded by subsequent research and developments. Please consult more recent sources before applying it to current research or investigations.
View paper · Open ALEX record · Source page
Measuring cyber attribution in games
5+
Andrew Ruef; Eric Nunes; Paulo Shakarian; Gerardo I. Simari (2017) · 2017 APWG Symposium on Electronic Crime Research (eCrime)
Collection: APWG.org eCrimes Research · Original collection
Paper details
Research context
This work reflects the evidence and technical environment at the time of publication. Its methods and insights may remain valuable, while some findings or practical guidance may have been refined or superseded by subsequent research and developments. Please consult more recent sources before applying it to current research or investigations.
View paper · Open ALEX record · Source page
Profiling underground merchants based on network behavior
5+
Srikanth Sundaresan; Damon McCoy; Sadia Afroz; Vern Paxson (2016) · 2016 APWG Symposium on Electronic Crime Research (eCrime)
Collection: APWG.org eCrimes Research · Original collection
Paper details
Research context
This work reflects the evidence and technical environment at the time of publication. Its methods and insights may remain valuable, while some findings or practical guidance may have been refined or superseded by subsequent research and developments. Please consult more recent sources before applying it to current research or investigations.
View paper · Open ALEX record · Source page
REAPER: an automated, scalable solution for mass credential harvesting and OSINT
5+
Blake Butler; Brad Wardman; Nate Pratt (2016) · 2016 APWG Symposium on Electronic Crime Research (eCrime)
Collection: APWG.org eCrimes Research · Original collection
Paper details
Research context
This work reflects the evidence and technical environment at the time of publication. Its methods and insights may remain valuable, while some findings or practical guidance may have been refined or superseded by subsequent research and developments. Please consult more recent sources before applying it to current research or investigations.
View paper · Open ALEX record · Source page
Indirect information linkage for OSINT through authorship analysis of aliases
5+
Author metadata incomplete (2013) · Springer
Paper details
Research context
This work reflects the evidence and technical environment at the time of publication. Its methods and insights may remain valuable, while some findings or practical guidance may have been refined or superseded by subsequent research and developments. Please consult more recent sources before applying it to current research or investigations.
View paper · Open ALEX record · Source page
Authorship attribution of web forum posts
5+
Sangita R. Pillay; Thamar Solorio (2010) · 2010 eCrime Researchers Summit
Collection: APWG.org eCrimes Research · Original collection
Paper details
Research context
This work reflects the evidence and technical environment at the time of publication. Its methods and insights may remain valuable, while some findings or practical guidance may have been refined or superseded by subsequent research and developments. Please consult more recent sources before applying it to current research or investigations.
View paper · Open ALEX record · Source page
Establishing phishing provenance using orthographic features
5+
Liping Ma; John Yearwood; Paul Watters (2009) · 2009 eCrime Researchers Summit
Collection: APWG.org eCrimes Research · Original collection
Paper details
Research context
This work reflects the evidence and technical environment at the time of publication. Its methods and insights may remain valuable, while some findings or practical guidance may have been refined or superseded by subsequent research and developments. Please consult more recent sources before applying it to current research or investigations.
View paper · Open ALEX record · Source page

Explore another perspective

These collections offer a different way into the library; their bibliographies need not contain the same papers.

Cyber Threat Intelligence · Research category
Network Investigation · Investigation type
Social Media Analysis · Investigation type