These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Advanced Persistent Threat (APT) attribution is a critical challenge in
cybersecurity and implies the process of accurately identifying the
perpetrators behind sophisticated cyber attacks. It can significantly enhance
defense mechanisms and inform strategic responses. With the growing prominence
of artificial intelligence (AI) and machine learning (ML) techniques,
researchers are increasingly focused on developing automated solutions to link
cyber threats to responsible actors, moving away from traditional manual
methods. Previous literature on automated threat attribution lacks a systematic
review of automated methods and relevant artifacts that can aid in the
attribution process. To address these gaps and provide context on the current
state of threat attribution, we present a comprehensive survey of automated APT
attribution. The presented survey starts with understanding the dispersed
artifacts and provides a comprehensive taxonomy of the artifacts that aid in
attribution. We comprehensively review and present the classification of the
available attribution datasets and current automated APT attribution methods.
Further, we raise critical comments on current literature methods, discuss
challenges in automated attribution, and direct toward open research problems.
This survey reveals significant opportunities for future research in APT
attribution to address current gaps and challenges. By identifying strengths
and limitations in current practices, this survey provides a foundation for
future research and development in automated, reliable, and actionable APT
attribution methods.