Cyber Threat Actor Attribution: A Systematic Review and Evolutionary Perspective

Accurately attributing cyberattacks to threat actors is a cornerstone of cybersecurity but remains highly challenging. This systematic review analyzes the evolution of various methods for threat attribution, proposing a taxonomy of methods from text and malware analysis to graph-based and large language model (LLM)-driven approaches. The paper traces the progression from probabilistic models to multi-modal, explainable AI, highlighting emerging trends like graph learning and retrieval-augmented generation. The study provides a structured overview of the field’s trajectory and outlines key future research directions for building more accurate and actionable attribution systems.