Cyber Defense eMagazine May 2019

The Attribution Problem – Using PAI to Improve Actor
Attribution
By Brian Pate, SVP, Babel Street
Within the cyber community, conventional wisdom is that malicious actors can carry out attacks while
hiding their true identities. Historically, analysts and investigators have predominantly focused attribution
efforts on technical attack aspects, such as digital forensics, malware analysis and signature analysis.
That we’ve yet to fully develop our capabilities or focus efforts at the persona level makes sense, given
the technical backgrounds of analysts, traditional reliance on technical indicators of compromise and the
difficulty of analyzing the volume of publicly available information. But by applying advanced tools and
analysis to publicly available information (PAI), including deep and dark web data, we can begin to deny
malicious actors the cloak of anonymity. Moreover, as sophisticated actors increasingly “live off the land,”
repurpose commodity malware, and use cloud infrastructure to continuously change IP addresses, we’re
seeing a diminution of the efficacy of technically-focused attribution. Therefore, it’s imperative that we
build up our PAI capabilities now.
What is attribution?
Broadly speaking, the objective of attribution is to move from an attack’s technical observables or related
digital personas to the true identity of an individual malicious actor, or actors, whether they be nation
state-sponsored actors, ideologic actors or criminals. But while the ultimate objective is a real name and
location with a high degree of confidence, it’s useful to think of attribution along a spectrum of confidence,
with confidence increasing as we gather identifiers that can be used to gain valuable insights about the
threat.
At a basic level, PAI analysis finds and links known attack indicators, uncovers unknown indicators, and
can yield location, online handles and email addresses, offline aliases and affiliations. These, in turn, can
often be linked to quasi-identifiers (QIDs) such as gender, age and date of birth, contained in socialmedia
metadata. Taken individually, none of these indicators are likely to return an identity with a high
degree of confidence. But as operators unearth and analyze more leads from PAI sources, each identifier
becomes a valuable marker on the road to attribution.
120