Search papers, labs, and topics across Lattice.
The paper introduces ARCANE, a Bayesian network framework, to aggregate passive telemetry data across multiple cyber attack campaigns for improved adversary identification. It models adversary fingerprints as multi-dimensional feature vectors derived from covert beacon interactions and updates these fingerprints over time using a time-decayed confidence metric. Evaluations on synthetic data reveal that while intra-actor similarity is higher than inter-actor similarity, a structural ceiling in feature space limits the ability to distinguish between different actors, even without evasion.
Even with cross-campaign aggregation of telemetry data, distinguishing sophisticated cyber adversaries remains fundamentally limited by shared operational practices, revealing a structural ceiling on attribution accuracy.
Current cyber attribution approaches typically operate on a per-incident basis, leaving open whether aggregating evidence across campaigns improves adversary identification. We investigate whether cross-campaign attribution reduces ambiguity or whether structural limits persist under longitudinal data. We model adversary fingerprints as multi-dimensional feature vectors encoding behavioral, infrastructural, and temporal characteristics derived from covert beacon interactions. We introduce ARCANE (Attacker Re-identification via Cross-campaign Attribution Network), a probabilistic framework that aggregates passive telemetry across campaigns and organizations to construct persistent adversary fingerprints. These fingerprints are updated using a Bayesian belief network that integrates new evidence over time. A time-decayed confidence metric captures accumulated similarity across campaigns. Evaluation on a synthetic dataset of multiple threat profiles shows that intra-actor similarity consistently exceeds inter-actor similarity. However, separation between distinct actors remains limited due to shared operational practices among sophisticated adversaries. Results indicate that cross-campaign aggregation alone does not resolve attribution ambiguity. Performance is constrained by a structural ceiling in feature space, where inter-actor similarity remains high even without evasion. Attribution accuracy remains stable under increasing evasion, suggesting the main limitation is feature indistinguishability rather than adversarial adaptation. These findings highlight the need for additional signal classes, such as targeting patterns, temporal coordination, and infrastructure relationships, to improve attribution reliability.
