Bottom-to-Top OSINT Investigation: A Structured Approach for Relational Attribution in Cyber Threat Analysis

This research introduces a novel methodology for open-source intelligence (OSINT) investigations—Bottom-to-Top Relational Attribution (BTRA)—designed to build validated, multi-layered identity profiles from minimal initial data. Departing from conventional top-down methods, the BTRA model incrementally constructs profiles through contextual expansion, relational linking, and structured validation. This methodology enables investigators to pivot from fragmented indicators such as email or phone numbers into robust, evidence-backed profiles. The model integrates seamlessly into hybrid loops where top-down validation and hypothesis testing enhance the discovery process. The paper presents a six-stage framework that prioritizes precision, scalability, and investigative repeatability across cyber threat intelligence scenarios.