Post Your Answer
6 months ago in Cybersecurity , Threat Intelligence By Usha K
The Attribution Problem: Finding Data to Link Attacks to Hackers
I'm researching automated cyber-attribution (figuring out who did an attack). This seems impossible without classified intelligence. Are there any public datasets with ground truth on which hacker group is behind an attack?
All Answers (1 Answers In All)
By Shraddha Answered 3 months ago
You've hit the core challenge—true attribution datasets are classified. But you can build a proxy dataset for research. Start by mining public APT reports from companies like Mandiant or CrowdStrike, and map the described behaviors to the MITRE ATT&CK framework to extract group-specific Tactics, Techniques, and Procedures (TTPs). Combine this with malware datasets (like VirusShare or EMBER) that have family names. Your "dataset" becomes a collection of IoCs and TTPs linked to group names from these reports. It's not perfect, but it's the best available open-source approach.
Reply to Shraddha
Related Questions