Attack attribution in non-cooperative networks

This paper reports on preliminary research concepts in attack attribution that have been developed in Cs3´s project being conducted for advanced research and development activity (ARDA). The ARDA BAA identified 4 levels of attribution: level 1: attribution to the specific hosts involved in the attack; level 2: attribution to the primary controlling host; level 3: attribution to the actual human actor; level 4: attribution to an organization with the specific intent to attack. Cs3´s research specifically focuses on attribution in situations where universal cooperation is not available for the attribution effort. This paper describes research concepts that show promise in resolving the level 1 attribution problem. The name of the project is Systematically Tracking Attackers through Routing Data, Events, and Communication Knowledge (STARDECK).