Artificial Intelligence Tools for Cyber Attribution

This SpringerBrief discusses how to develop intelligent systems for cyber attribution regarding cyber-attacks. Specifically, the authors review themultiple facets of the cyber attribution problem that make it difficult for"out-of-the-box" artificial intelligence and machine learning techniques tohandle. Attributing a cyber-operation through the use of multiple pieces oftechnical evidence (i.e., malware reverse-engineering and source tracking)and conventional intelligence sources (i.e., human or signals intelligence) isa difficult problem not only due to the effort required to obtain evidence,but the ease with which an adversary can plant false evidence. This SpringerBrief not only lays out the theoretical foundations for how tohandle the unique aspects of cyber attribution - and how to updatemodels used for this purpose - but it also describes a series of empiricalresults, as well as compares results of specially-designed frameworks forcyber attribution to standard machine learning approaches. Cyber attribution is not only a challenging problem, but there are alsoproblems in performing such research, particularly in obtaining relevantdata. This SpringerBrief describes how to use capture-the-flag for such research,and describes issues from organizing such data to running your owncapture-the-flag specifically designed for cyber attribution. Datasets andsoftware are also available on the companion website.