Abstract:Purpose of the paper: analysis of models and techniques used for attribution of cybersecurity violators in the interests of building a promising attribution system in the implementation of targeted attacks against critical information infrastructure objects. Research method: system analysis of open sources of data on the attribution of cyber-violators in the implementation of targeted attacks against critical information infrastructure objects over a period mainly over the last 5 years. The result obtained: based on the consideration of open sources, the paper presents an analysis of the models and techniques used to attribute cyber intruders in the implementation of targeted attacks and used both in scientific and practical projects. The paper analyzes new models used for attribution, allowing the collection of data at the tactical-technical and socio-political levels. The main indicators of ongoing cyber attacks and intruders that are essential for the implementation of attribution processes are identified. The procedure for generating data for profiling cybergroups is considered, as well as the possibility of using the considered models and techniques in the interests of building a promising system for attribution of a cyber intruder in the implementation of targeted attacks against critical information infrastructure objects. The analysis was carried out according to sources over a twentyyear period, meanwhile, the main works under consideration were published in the last 5 years. The analysis does not claim to be complete, but an attempt is made to cover the most significant studies. Scientific novelty lies in the fact that the presented paper is one of the first domestic works that provides a detailed analysis of studies published in recent years in the field of attribution of cyber security violators. Models such as «cyber intrusion chain», «unified cyber intrusion chain», Diamond basic and extended intrusion analysis models, ATT&CK model are considered. Examples of attribution methods for argumentation-based reasoning with evidence at the technical and social levels and the use of technical artifacts to identify false flags in attribution are given. Besides, the paper also lists trends in the usage of modern solutions for detecting and attributing attacks based on artificial intelligence and machine learning.

An Argumentation-Based Framework to Address the Attribution Problem in Cyber-Warfare

Argumentation Models for Cyber Attribution

Cyber-Deception and Attribution in Capture-the-Flag Exercises

Evidential Cyber Threat Hunting

Analysis of Models and Techniques Used for Attribution of Cyber Security Violators in the Implementation of Targeted Attacks

Intensional Cyberforensics

A Modular Approach to Automatic Cyber Threat Attribution using Opinion Pools

Automated Reasoning over Provenance-Aware Communication Network Knowledge in Support of Cyber-Situational Awareness

Analyzing Cyber-Attack Intention for Digital Forensics Using Case-Based Reasoning

Game-Theoretic Decision Support for Cyber Forensic Investigations

Argument Attribution Explanations in Quantitative Bipolar Argumentation Frameworks (Technical Report)

From understanding to justifying: Computational reliabilism for AI-based forensic evidence evaluation

When Autonomous Intelligent Goodware will Fight Autonomous Intelligent Malware: A Possible Future of Cyber Defense

IPAttributor: Cyber Attacker Attribution with Threat Intelligence-Enriched Intrusion Data

Countering Autonomous Cyber Threats

Network Forensics Analysis with Evidence Graphs.

Attribution-driven Causal Analysis for Detection of Adversarial Examples

A Bayesian-network-based cybersecurity adversarial risk analysis framework with numerical examples

Lawful Remote Forensics Mechanism With Admissibility of Evidence in Stochastic and Unpredictable Transnational Crime

XAI-CF -- Examining the Role of Explainable Artificial Intelligence in Cyber Forensics

Exploiting Trust for Resilient Hypothesis Testing With Malicious Robots