Cyber Threat Actor Attribution: A Systematic Review and Evolutionary Perspective

Aykhan Huseynli

doi:10.55859/ijiss.1839759

Cyber Threat Actor Attribution: A Systematic Review and Evolutionary Perspective

Abstract

Accurately attributing cyberattacks to threat actors is a cornerstone of cybersecurity but remains highly challenging. This systematic review analyzes the evolution of various methods for threat attribution, proposing a taxonomy of methods from text and malware analysis to graph-based and large language model (LLM)-driven approaches. The paper traces the progression from probabilistic models to multi-modal, explainable AI, highlighting emerging trends like graph learning and retrieval-augmented generation. The study provides a structured overview of the field’s trajectory and outlines key future research directions for building more accurate and actionable attribution systems.

Keywords

References

T. Pahi and F. Skopik, “Cyber Attribution 2.0: Capture the False Flag,” in Proc. 18th European Conf. on Cyber Warfare and Security (ECCWS), 2019, pp. 338–345.
I. J. King, R. Ramirez, B. Bowman, and H. H. Huang, “Trail: A Knowledge Graph-Based Approach for Attributing Advanced Persistent Threats,” in Proc. IEEE 41st Int. Conf. on Data Engineering (ICDE), 2025, pp. 1207–1220.
L. Qiang, Z. Yang, L. Bao-xu, and Z. Zhengwei, “A Reasoning Method of Cyber-Attack Attribution Based on Threat Intelligence,” Int. J. Computer, Electrical, Automation, Control and Information Engineering, vol. 10, no. 5, pp. 920–924, 2016.
M. S. Abu, S. Rahayu, R. Yusof, and A. Ariffin, “An Attribution of Cyberattack Using Association Rule Mining (ARM),” Int. J. Advanced Computer Science and Applications, vol. 11, no. 2, 2020.
L. Perry, B. Shapira, and R. Puzis, “NO-DOUBT: Attack Attribution Based On Threat Intelligence Reports,” in Proc. IEEE Int. Conf. on Intelligence and Security Informatics (ISI), 2019, pp. 80–85.
I. Rosenberg, G. Sicard, and E. David, “DeepAPT: Nation-State APT Attribution Using End-to-End Deep Neural Networks,” in Artificial Neural Networks and Machine Learning–ICANN 2017, vol. 10614. Springer, 2017, pp. 91–99.
E. Böge, M. B. Ertan, H. Alptekin, and O. Çetin, “Unveiling Cyber Threat Actors: A Hybrid Deep Learning Approach for Behavior-Based Attribution,” Digital Threats: Research and Practice, vol. 6, no. 1, pp. 1–20, 2025.
N. Xiao, B. Lang, T. Wang, and Y. Chen, “APT-MMF: An Advanced Persistent Threat Actor Attribution Method Based on Multimodal and Multilevel Feature Fusion,” Computers & Security, vol. 144, p. 103960, 2024.

I. Aki, K. Watarai, S. Okada, and T. Mitsunaga, “Provenance- Based CTI Analysis with Knowledge Graph and RAG (KGRAG),” in Proc. IEEE 12th Int. Conf. on Cyber Security and Cloud Computing (CSCloud), 2025, pp. 1–6.
K. Guru, R. J. Moss, and M. J. Kochenderfer, “On Technique Identification and Threat-Actor Attribution Using LLMs and Embedding Models,” in Proc. IEEE Int. Conf. on Cyber-AI, 2025, pp. 332–339.
D. Cohen and K. Narayanaswamy, “Attack Attribution in Non- Cooperative Networks,” in Proc. Fifth Annual IEEE SMC Information Assurance Workshop, 2004, pp. 436–437.
X. Xiang, H. Liu, L. Zeng, H. Zhang, and Z. Gu, “IPAttributor: Cyber Attacker Attribution with Threat Intelligence-Enriched Intrusion Data,” Mathematics, vol. 12, no. 9, p. 1364, 2024.
S. Caltagirone, A. Pendergast, and C. Betz, “The Diamond Model of Intrusion Analysis,” Center for Cyber Intelligence Analysis and Threat Research, Tech. Rep., 2013.
T. Rid and B. Buchanan, “Attributing Cyber Attacks,” Journal of Strategic Studies, vol. 38, no. 1–2, pp. 4–37, 2015.
H. Haddadpajouh, A. Azmoodeh, A. Dehghantanha, and R. M. Parizi, “MVFCC: A Multi-View Fuzzy Consensus Clustering Model for Malware Threat Attribution,” IEEE Access, vol. 8, pp. 139 188–139 198, 2020.
B. Tang, P. Leng, X. Shen, and Y. Wei, “Deep Learning- Based APT Malware and Variants Detection with Attribution Analysis,” in Proc. IEEE 6th Int. Conf. on Pattern Recognition and Artificial Intelligence (PRAI), 2023, pp. 996–1003.
Q. Wang, H. Yan, and Z. Han, “Explainable APT Attribution for Malware Using NLP Techniques,” in Proc. IEEE 21st Int. Conf. on Software Quality, Reliability and Security (QRS), 2021, pp. 70–80.
Q. Wang, H. Yan, C. Zhao, R. Mei, Z. Han, and Y. Zhou, “APT Attribution for Malware Based on Time Series Shapelets,” in Proc. IEEE Int. Conf. on Trust, Security and Privacy in Computing and Communications (TrustCom), 2022, pp. 769– 777.
K. T. W. Teuwen, “A Modular Approach to Automatic Cyber Threat Attribution Using Opinion Pools,” in Proc. IEEE Int. Conf. on Big Data (BigData), 2023, pp. 3089–3098.
E. Irshad and A. B. Siddiqui, “Context-Aware Cyber-Threat Attribution Based on Hybrid Features,” ICT Express, vol. 10, no. 3, pp. 553–569, 2024. 43

Details

Primary Language

English

Subjects

Cybersecurity and Privacy (Other)

Journal Section

Research Article

Authors

Aykhan Huseynli ^*
0009-0008-7172-0239
Azerbaijan

Publication Date

June 30, 2026

Submission Date

December 10, 2025

Acceptance Date

April 29, 2026

Published in Issue

Year 2026 Volume: 15 Number: 2

DOI

https://doi.org/10.55859/ijiss.1839759

IZ

https://izlik.org/JA88XT42FX

Cite

RIS / Bibtex

APA

Huseynli, A. (2026). Cyber Threat Actor Attribution: A Systematic Review and Evolutionary Perspective. International Journal of Information Security Science, 15(2), 29-43. https://doi.org/10.55859/ijiss.1839759

AMA

1.Huseynli A. Cyber Threat Actor Attribution: A Systematic Review and Evolutionary Perspective. IJISS. 2026;15(2):29-43. doi:10.55859/ijiss.1839759

Chicago

Huseynli, Aykhan. 2026. “Cyber Threat Actor Attribution: A Systematic Review and Evolutionary Perspective”. International Journal of Information Security Science 15 (2): 29-43. https://doi.org/10.55859/ijiss.1839759.

EndNote

Huseynli A (June 1, 2026) Cyber Threat Actor Attribution: A Systematic Review and Evolutionary Perspective. International Journal of Information Security Science 15 2 29–43.

IEEE

[1]A. Huseynli, “Cyber Threat Actor Attribution: A Systematic Review and Evolutionary Perspective”, IJISS, vol. 15, no. 2, pp. 29–43, June 2026, doi: 10.55859/ijiss.1839759.

ISNAD

Huseynli, Aykhan. “Cyber Threat Actor Attribution: A Systematic Review and Evolutionary Perspective”. International Journal of Information Security Science 15/2 (June 1, 2026): 29-43. https://doi.org/10.55859/ijiss.1839759.

JAMA

1.Huseynli A. Cyber Threat Actor Attribution: A Systematic Review and Evolutionary Perspective. IJISS. 2026;15:29–43.

MLA

Huseynli, Aykhan. “Cyber Threat Actor Attribution: A Systematic Review and Evolutionary Perspective”. International Journal of Information Security Science, vol. 15, no. 2, June 2026, pp. 29-43, doi:10.55859/ijiss.1839759.

Vancouver

1.Aykhan Huseynli. Cyber Threat Actor Attribution: A Systematic Review and Evolutionary Perspective. IJISS. 2026 Jun. 1;15(2):29-43. doi:10.55859/ijiss.1839759