Deep Learning Based Attribution of Threat Activity in Network Forensic Analytics

Attributing malicious network activity to specific threat actors remains a critical challenge in digital forensics due to encrypted traffic and high volume of network data. Conventional rule-based and signature-based methods lack generalization and cannot capture the spatial and temporal dependencies that characterize advanced persistent threats. This paper presents a deep learning framework that combines Convolutional Neural Networks and Recurrent Neural Networks for automated attribution of threat activity within network forensics analytics. The framework employs CNN to extract Spatial features from packet-level and flow-level traffic representations, identifying structural patterns, protocol anomalies, and payload signatures indicative of malicious behavior. Temporal dynamics and attack progression are modeled using RNNs with gated Recurrent Units, enabling the system to learn sequential patterns in tactics, techniques, and procedures across network sessions. Evaluation was performed on the CICIoT2023 dataset, which was adopted because of its scale, diversity, and relevance to modern IoT security environments. The hybrid CNN-RNN model called Intelligent Network Forensic Investigative Model (INFIM) achieved 98.3% accuracy, 98.4% F1-Score, 98.7% precision, and 98.5% recall for multiclass attribution. Ablation analysis confirms that both spatial and temporal components are essential, particularly under imbalanced and low-signal conditions. The system also demonstrates robustness against common evasion ways, such as traffic padding and minor protocol obfuscation. This work shows that integrating CNN and RNN architectures improves the scalability and accuracy of network forensic attribution, reducing analyst burden and supporting timely incident response.