Attribution Across Cyber Attack Types: Network Intrusions and Information Operations
The objective of this paper is to articulate the problem of attribution in cyber warfare incidents, including, surveillance, data theft, espionage, and misinformation campaigns. As the stakes increase, concerted efforts are being made by intelligence and law enforcement agencies to identify the perp...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2021-01-01
|
| Series: | IEEE Open Journal of the Communications Society |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9411871/ |
| _version_ | 1819105555179896832 |
|---|---|
| author | Sanjay Goel Brian Nussbaum |
| author_facet | Sanjay Goel Brian Nussbaum |
| author_sort | Sanjay Goel |
| collection | DOAJ |
| description | The objective of this paper is to articulate the problem of attribution in cyber warfare incidents, including, surveillance, data theft, espionage, and misinformation campaigns. As the stakes increase, concerted efforts are being made by intelligence and law enforcement agencies to identify the perpetrators with much painstaking effort. Attribution tools and techniques for malicious activities on the Internet are still nascent, relying mainly on technical measurements, the provenance of malicious code, and non-technical assessments of attack and attacker characteristics to link attack activities to individuals or groups. Attribution of attacks is typically done through a burdensome manual process that relies on both technical analysis and ground intelligence. As a result, this cumbersome and laborious process of attribution is primarily reserved for the most egregious cyber attack cases and those conducted against well resourced organizations. Over time, our attribution abilities have improved, however, this improvement is a two-edged sword: as attribution capabilities improve, Internet privacy is increasingly diluted. This paper discusses attribution for two vastly different types of attacks that are central to cyber conflict today: network intrusions and social bot-led misinformation campaigns. The paper discusses the state of the art regarding attribution abilities across both types of attack, provides recommendations for improved attribution, and lays out future research directions. |
| first_indexed | 2024-12-22T02:24:06Z |
| format | Article |
| id | doaj.art-674e247662d643b59b961e1e55930cfa |
| institution | Directory Open Access Journal |
| issn | 2644-125X |
| language | English |
| last_indexed | 2024-12-22T02:24:06Z |
| publishDate | 2021-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Open Journal of the Communications Society |
| spelling | doaj.art-674e247662d643b59b961e1e55930cfa2022-12-21T18:42:03ZengIEEEIEEE Open Journal of the Communications Society2644-125X2021-01-0121082109310.1109/OJCOMS.2021.30745919411871Attribution Across Cyber Attack Types: Network Intrusions and Information OperationsSanjay Goel0https://orcid.org/0000-0002-7164-8395Brian Nussbaum1https://orcid.org/0000-0002-2077-9379School of Business, University at Albany, State University of New York, Albany, NY, USACollege of Emergency Preparedness, Homeland Security and Cybersecurity, University at Albany, State University of New York, Albany, NY, USAThe objective of this paper is to articulate the problem of attribution in cyber warfare incidents, including, surveillance, data theft, espionage, and misinformation campaigns. As the stakes increase, concerted efforts are being made by intelligence and law enforcement agencies to identify the perpetrators with much painstaking effort. Attribution tools and techniques for malicious activities on the Internet are still nascent, relying mainly on technical measurements, the provenance of malicious code, and non-technical assessments of attack and attacker characteristics to link attack activities to individuals or groups. Attribution of attacks is typically done through a burdensome manual process that relies on both technical analysis and ground intelligence. As a result, this cumbersome and laborious process of attribution is primarily reserved for the most egregious cyber attack cases and those conducted against well resourced organizations. Over time, our attribution abilities have improved, however, this improvement is a two-edged sword: as attribution capabilities improve, Internet privacy is increasingly diluted. This paper discusses attribution for two vastly different types of attacks that are central to cyber conflict today: network intrusions and social bot-led misinformation campaigns. The paper discusses the state of the art regarding attribution abilities across both types of attack, provides recommendations for improved attribution, and lays out future research directions.https://ieeexplore.ieee.org/document/9411871/Attributioncyber attacksmalicious social botscyber warfare |
| spellingShingle | Sanjay Goel Brian Nussbaum Attribution Across Cyber Attack Types: Network Intrusions and Information Operations IEEE Open Journal of the Communications Society Attribution cyber attacks malicious social bots cyber warfare |
| title | Attribution Across Cyber Attack Types: Network Intrusions and Information Operations |
| title_full | Attribution Across Cyber Attack Types: Network Intrusions and Information Operations |
| title_fullStr | Attribution Across Cyber Attack Types: Network Intrusions and Information Operations |
| title_full_unstemmed | Attribution Across Cyber Attack Types: Network Intrusions and Information Operations |
| title_short | Attribution Across Cyber Attack Types: Network Intrusions and Information Operations |
| title_sort | attribution across cyber attack types network intrusions and information operations |
| topic | Attribution cyber attacks malicious social bots cyber warfare |
| url | https://ieeexplore.ieee.org/document/9411871/ |
| work_keys_str_mv | AT sanjaygoel attributionacrosscyberattacktypesnetworkintrusionsandinformationoperations AT briannussbaum attributionacrosscyberattacktypesnetworkintrusionsandinformationoperations |