arXiv:2604.24644v1 [cs.CR] 27 Apr 2026
ARCANE: Cross-Campaign Attacker Re-identification via Passive Beacon Telemetry — A Bayesian Network Framework for Longitudinal Cyber Attribution Abraham Itzhak Weinberg AI-WEINBERG, Tel Aviv, Israel [email protected] April 28, 2026 Abstract Current cyber attribution approaches typically operate on a per-incident basis, leaving open the question of whether aggregating evidence across campaigns can meaningfully improve adversary identification. In this work, we investigate whether cross-campaign attribution can reduce ambiguity, or if structural limits persist even when leveraging longitudinal data. To explore this, we focus on adversary fingerprints, represented as multi-dimensional feature vectors encoding behavioural, infrastructural, and temporal characteristics derived from covert beacon interactions and related signals. To address this question, we develop ARCANE (Attacker Re-identification via Cross-campaign Attribution Network), a probabilistic framework that aggregates passive telemetry across multiple campaigns and organisations to construct persistent adversary fingerprints. These fingerprints are updated incrementally using a Bayesian belief network, which integrates new evidence from ongoing campaigns. A time-decayed confidence metric captures the accumulation of similarity across campaigns. Evaluation on a synthetic dataset, comprising multiple advanced threat profiles and campaigns, shows that intra-actor similarity consistently exceeds inter-actor similarity. However, the separation between distinct actors remains limited, primarily due to shared operational practices among sophisticated adversaries. Our results indicate that cross-campaign aggregation alone does not fully resolve attribution ambiguity. Instead, performance is constrained by a structural ceiling in the feature space, where similarity between distinct actors remains high even in the absence of evasion techniques. Notably, attribution accuracy remains stable across increasing levels of evasion, suggesting that the primary limitation lies in feature indistinguishability rather than adversarial adaptation. These findings underscore the need for incorporating additional signal classes—such as targeting patterns, temporal coordination, and infrastructure relationships—to improve attribution reliability in complex, real-world environments.
Keywords: Cyber attribution, passive hack-back, honeytoken, beacon telemetry, Bayesian inference, threat actor fingerprinting, longitudinal analysis, APT re-identification.
1
Introduction
Attributing a cyber-attack to its perpetrator remains one of the most challenging problems in computer security. The technical difficulty arises from the ease of IP address spoofing, the widespread use of anonymising relays such as The Onion Router (TOR) and virtual private networks (VPNs), and the deliberate adoption of “false flag” tactics by sophisticated threat actors [1,2]. Existing attribution frameworks fall into two broad categories: indicator-based methods that match observed artefacts (file hashes, C2 domains, TTPs) against known threat-actor profiles [3–5], and forensic methods that reconstruct attack chains from system logs and network captures [6, 7]. Both categories share a critical limitation: they operate per-incident, treating each 1
campaign as an independent attribution problem and discarding the wealth of evidence accumulated across campaigns. Human intelligence analysts have long recognised that longitudinal analysis—correlating observations across many campaigns over months or years—can resolve attribution ambiguities that are intractable from a single incident [8]. However, this insight has not been formalised or automated in the published literature. This paper addresses this gap by investigating whether cross-campaign aggregation can meaningfully improve attribution accuracy. To explore this, we introduce ARCANE (Attacker Re-identification via Cross-campaign Attribution Network), a framework that treats attribution as an incremental Bayesian inference problem. Each time a passive beacon—a tracking payload embedded in documents, credentials, or source code—is triggered by an attacker, the resulting telemetry is compared to all known fingerprints and used to update a belief distribution over candidate threat actors. Over successive campaigns, the posterior concentrates around the correct actor even when individual callbacks are ambiguous. Our empirical results reveal a surprising finding: the primary barrier to cross-campaign re-identification is not adversarial evasion (which proves essentially irrelevant to ARCANE accuracy) but rather the convergence of sophisticated actor fingerprints in a dense region of the feature space. This provides a clearer actionable insight for the reader: it challenges a common assumption in attribution and suggests a new path forward in system design. The remainder of this paper is organised as follows. Section 2 reviews related work. Section 3 presents the formal framework. Section 4 describes the fingerprint extraction model. Section 5 details the ARCANE algorithm. Section 6 describes experimental methodology. Section 7 presents results. Section 8 discusses implications. Section 9 concludes.
2
Related Work
Attribution in cyberspace remains a fundamentally uncertain and adversarial problem, where attackers actively obfuscate their identity and reuse infrastructure across campaigns. Prior work has approached this challenge from multiple angles, including infrastructure analysis, deception techniques, behavioural fingerprinting, and probabilistic reasoning. In this section, we situate ARCANE within this landscape, highlighting the limitations of existing methods and motivating the need for a longitudinal, Bayesian framework that accumulates attribution evidence over time.
2.1
Cyber Attribution Methods
Early attribution work focused on IP geolocation and WHOIS lookups, quickly rendered unreliable by VPNs and bulletproof hosting [9]. The Diamond Model of intrusion analysis [10] formalised adversary, capability, infrastructure, and victim as the four vertices of attribution, providing a vocabulary for structured analysis. MITRE ATT&CK [11] catalogued tactics, techniques, and procedures (TTPs) used by known APT groups, enabling TTP-based attribution [3]. Graph neural network approaches [12] correlate infrastructure indicators across campaigns. None of these approaches model attribution as a longitudinal Bayesian accumulation problem.
2.2
Deception-Based Attribution
Honeypots [13] and honeytokens [14] provide early detection of intrusions by baiting attackers with decoy assets. Recent work has extended these concepts to cloud environments [15, 16] and to post-exfiltration attribution via document beacons [17]. The Passive Hack-Back framework [17] establishes the theoretical foundations of passive hack-back and defines the formal metrics—beacon callback success rate (β), attribution fidelity (α), and stealth level (σ)— on which ARCANE builds. The key innovation of ARCANE is the accumulation of callback telemetry across campaigns rather than processing each callback in isolation.
2.3
Attacker Fingerprinting
Behavioural profiling of threat actors has been studied in the context of malware analysis [18], network intrusion detection [19], and ransomware operator identification [20]. Stylometric analysis of malware code [21] and natural language processing of attacker communications [22] provide complementary signals. Our 2
work differs in its focus on operational behaviour observable from beacon telemetry rather than code artefacts, and in its explicit longitudinal accumulation model.
2.4
Bayesian Approaches to Attribution
Bayesian inference has been applied to network intrusion detection [23], malware classification [24], and insider threat detection [25]. Closest to our work is the Bayesian network for cyber attack attribution proposed by [26], which models relationships between attack attributes and actor profiles. ARCANE extends this line of work by operating on streaming beacon telemetry across multiple campaigns and incorporating time-decayed evidence accumulation.
3
Formal Framework
We formalise cyber attribution as a sequential, probabilistic inference problem over a stream of adversarial campaigns. The framework captures how noisy, partial telemetry from beacon callbacks can be aggregated into stable behavioural fingerprints and incrementally incorporated into a Bayesian attribution model. Central to this formulation is the idea that attribution confidence should emerge from cross-campaign consistency under temporal decay, rather than from isolated observations. The following definitions establish the mathematical structure underlying ARCANE.
3.1
Problem Formulation
Let A = {a1 , . . . , aN } denote the set of N candidate threat actors. Let C = {c1 , c2 , . . .} denote a time-ordered stream of campaigns, where each campaign ck is attributed to a single actor a(ck ) ∈ A (ground truth, unknown to the defender). Each campaign produces a set of beacon callbacks B(ck ) = {bk,1 , . . . , bk,mk }, each callback carrying a telemetry record tk,j = (IP, TOR, OS, locale, timezone, tools, dwell, . . .). Definition 1 (Campaign Fingerprint). The fingerprint of campaign ck is a D-dimensional real vector fk ∈ [0, 1]D summarising the aggregate behavioural, infrastructural, and temporal characteristics of all callbacks in B(ck ). Definition 2 (Fingerprint Similarity). The similarity between two campaign fingerprints fi and fj is: S(fi , fj ) = 1 − dcos (fi , fj ) =
fi · fj ∥fi ∥ ∥fj ∥
(1)
where dcos denotes the cosine distance. S ∈ [0, 1], with S = 1 indicating identical fingerprints.
3.2
Attribution Posterior
We model attribution as Bayesian inference. Let P (A = ai ) denote the prior probability that actor ai is responsible for a query campaign. After observing fingerprint evidence e: P (e | A = ai ) P (A = ai ) P (A = ai | e) = PN j=1 P (e | A = aj ) P (A = aj )
(2)
We initialise with a uniform prior P (A = ai ) = 1/N and update iteratively as evidence from successive callbacks accumulates.
3.3
Cross-Campaign Confidence
Definition 3 (Cross-Campaign Confidence). Let K(ai ) = {(fk , dk )} be the knowledge base of known fingerprints for actor ai , where dk is the number of days elapsed since campaign k. The cross-campaign confidence of the query fingerprint fq matching actor ai is: X 1 CCC(fq , ai ) = ′ S(fq , fk ) · e−δ·dk (3) |K | ′ (fk ,dk )∈K
3
where K′ = {(fk , dk ) ∈ K(ai ) : S(fq , fk ) ≥ τs } is the set of sufficiently similar known fingerprints, δ > 0 is the temporal decay rate, and τs is a similarity threshold. The exponential decay reflects the intuition that older evidence is less reliable due to actor evolution, tool churn, and infrastructure rotation.
3.4
Separability Condition
Definition 4 (Fingerprint Separability Gap). The separability gap is: ∆S = S̄w − S̄c
(4)
where S̄w = E[S(fi , fj ) | a(ci ) = a(cj )] is the mean within-actor similarity and S̄c = E[S(fi , fj ) | a(ci ) ̸= a(cj )] is the mean cross-actor similarity. Proposition 1 (Minimum Gap for Reliable Attribution). For ARCANE to achieve re-identification accuracy significantly above chance with N actors, the separability gap must satisfy: 1 ∆S ≳ √ · σS · zα/2 K
(5)
where K is the number of training campaigns per actor, σS is the standard deviation of within-actor similarities, and zα/2 is the critical value for confidence level α. This proposition quantifies the trade-off between the number of training campaigns and the required fingerprint separation. Our experimental results (∆S = 0.046, σS = 0.068) identify the specific conditions under which the current 24-dimensional feature space is insufficient.
4
Fingerprint Feature Model
This section defines the feature representation used to encode campaign-level behaviour into a fixed-dimensional fingerprint suitable for similarity comparison and probabilistic attribution. The design of the feature space balances expressiveness and robustness, capturing invariant attacker characteristics while remaining resilient to noise, evasion, and partial observability. By structuring features across infrastructural, temporal, geospatial, and behavioural dimensions, the model aims to maximise cross-campaign consistency for the same actor while preserving separability between different actors.
4.1
Feature Extraction
Each campaign fingerprint fk ∈ [0, 1]24 is constructed from four feature groups (Table 1).
4.2
Tool Cluster Model
The six tool clusters in dimensions 18–23 encode known APT tool-family preferences: credential theft (Mimikatz, LaZagne, Rubeus), C2 frameworks (Cobalt Strike, Metasploit, Havoc), Chinese RAT families (PlugX, Gh0st RAT, ShadowPad), Active Directory recon (BloodHound, Impacket), nation-state implants (Turla, ComRAT, AppleJeus), and analyst tools indicative of sandboxed analysis environments (Wireshark, IDA Pro, Ghidra).
4.3
Separability Analysis
Figure 1 shows the empirical distributions of within-actor and cross-actor fingerprint similarities across 2,000 sampled pairs. The distributions significantly overlap, with both means above 0.80. This high-similarity regime is the fundamental challenge identified by our analysis.
4
Table 1: The 24-Dimensional Campaign Fingerprint Dim.
Feature
Group
Description
0–1 2–3 4 5 6–7 8–9 10 11–14 15 16 17 18–23
TOR/VPN rate Dwell mean/std Timezone (norm.) VM rate ASN/IP diversity Tool consistency/count Non-English locale Origin indicators Hour entropy Country consistency Log callback count Tool cluster presence
Infrastructure Temporal Geospatial Environment Infrastructure Behavioural Geospatial Geospatial Temporal Geospatial Volume Behavioural
Fraction of callbacks via TOR/VPN Normalised time before opening beacon Mean UTC offset, scaled to [0, 1] Fraction with VM fingerprint Unique prefixes and IPs / callbacks Jaccard across callbacks, mean tool count Fraction with non-en_US locale KP/RU/CN/IR country fractions Shannon entropy of callback hour-of-day 1 − |unique countries|/n min(log(n + 1)/ log 20, 1) 6 APT tool-family cluster indicators
Figure 1: Within-actor (S̄w = 0.848, blue) and cross-actor (S̄c = 0.802, red) fingerprint similarity distributions. Separation is statistically significant (t = 8.33, p = 1.52 × 10−16 ) but the gap ∆S = 0.046 falls below the threshold required for high-confidence re-identification at N = 8 actors. Error bars omitted for clarity.
5
The ARCANE Algorithm
Algorithm 1 presents the complete ARCANE procedure. The key design decisions are: (i) temporal leave-oneout validation to prevent data leakage; (ii) evidence-weighted likelihood model that maps CCC to attribution posteriors; and (iii) posterior normalisation to maintain a valid probability distribution.
5
Algorithm 1 ARCANE: Cross-Campaign Attacker Re-identification Require: Actor set A, campaign stream C, decay δ, threshold τs , confidence threshold τc Ensure: Attribution posteriors P (A | e) for each campaign 1: Initialise priors: ∀ai ∈ A : P (A = ai ) ← 1/N 2: Initialise knowledge base: K ← ∅ 3: Sort C by campaign start date (temporal order) 4: for each campaign ck in C do 5: Extract fingerprint fk from callbacks B(ck ) 6: if |K| ≥ min_train then ▷ Enough training data — attempt attribution 7: for each candidate actor ai ∈ A do 8: Compute CCC(fk , ai ) via Eq. (3) 9: Li ← 0.50 + 0.45 · CCC(fk , ai ) ▷ Evidence likelihood 10:
k ,ai ) L̄i ← max 0.05, 0.50 − 0.45·CCC(f N −1
·P (A=ai ) P (A = ai ) ← Li ·P (A=aLii)+ L̄i ·(1−P (A=ai )) 12: end for P 13: Normalise: P (A = ai ) ← P (A = ai )/ j P (A = aj ) 14: a∗ ← arg maxi P (A = ai ) 15: Output: attribution (a∗ , P (A = a∗ ), [P (A = a∗ ) ≥ τc ]) 16: end if 17: K ← K ∪ {(fk , date(ck ), a(ck ))} 18: end for
11:
5.1
▷ Add to knowledge base
Likelihood Model
The mapping from CCC to likelihood follows a linear model: L(CCC) = 0.50 + 0.45 · CCC. This ensures that (i) zero CCC results in uninformative likelihoods (0.50), (ii) perfect CCC (1.0) gives strong evidence (0.95), and (iii) negative evidence is modelled symmetrically. The 0.45 scaling factor is derived from the empirical maximum CCC observed in our dataset and can be tuned for operational deployment contexts.
6
Experimental Methodology
This section describes the experimental setup used to evaluate ARCANE under controlled yet realistic conditions. Given the scarcity of publicly available longitudinal beacon telemetry, we design a synthetic benchmark that captures key properties of real-world threat actor behaviour, including variability, adaptation, and partial observability. The methodology emphasises temporal consistency, preventing information leakage while enabling rigorous comparison against a strong single-campaign baseline.
6.1
Synthetic Dataset
In the absence of a public longitudinal beacon telemetry dataset, we construct a synthetic benchmark grounded in published threat-actor behavioural profiles from MITRE ATT&CK [11], Mandiant APT reports [27], and Recorded Future intelligence [28, 29]. Eight nation-state threat actors are modelled (Table 2), spanning four origin countries. Each actor is assigned empirically grounded parameters: TOR usage probability, tool churn rate (fraction of tools replaced per campaign), IP rotation rate, mean dwell time, preferred locale, and sophistication level. Twelve campaigns per actor are generated over an 18-month simulation window (Jan 2024–Jun 2025), with 3–8 callbacks per campaign, yielding 96 campaigns and 524 callbacks total.
6.2
Evasion Schedule
To model realistic actor adaptation, we implement an evasion schedule in which each actor’s evasion level increases linearly from 0 to sophistication/2 across their campaigns. Higher evasion increases TOR usage,
6
Table 2: Simulated Threat Actor Profiles ID
Alias
APT-001 APT-002 APT-003 APT-004 APT-005 APT-006 APT-007 APT-008
LAZARUSHOUND FROZENBEAR DOUBLEPANDA SILENTFOX MINTLEAF IRONSHARD VOIDLOTUS STORMVIPER
Origin
Soph.
TOR%
Churn
Dwell(h)
KP RU CN IR KP RU CN KP
0.82 0.91 0.88 0.76 0.79 0.85 0.93 0.84
65% 55% 40% 70% 60% 50% 35% 68%
0.15 0.20 0.18 0.25 0.20 0.22 0.15 0.18
4.2 2.8 6.1 3.5 5.0 3.2 7.3 4.8
tool churn, and locale spoofing probability, simulating the documented adaptation behaviour of persistent threat actors [30].
6.3
Evaluation Protocol
We use temporal leave-one-out evaluation: campaigns are processed in chronological order; for each campaign, the system is evaluated on all actors for which at least min_train prior campaigns have been observed, then the campaign is added to the knowledge base. This protocol prevents data leakage and mirrors the operational setting.
6.4
Baseline
The per-campaign nearest-neighbour baseline uses only the current campaign’s fingerprint matched against a static running-average profile per actor, representing the current state of the art in single-incident behavioural attribution.
7
Results
This section presents the empirical evaluation of ARCANE, focusing on attribution accuracy, confidence calibration, and robustness under varying conditions. The results reveal a consistent pattern: despite the theoretical advantages of longitudinal Bayesian accumulation, performance is fundamentally constrained by the limited separability of behavioural fingerprints. We analyse these outcomes across multiple dimensions to identify the underlying factors driving this ceiling and to clarify the operational implications.
7.1
Main Results
Table 3 presents the core experimental results. Figure 2 shows per-actor accuracy and confidence distributions. Table 3: Main Results — ARCANE vs Per-Campaign Baseline Metric Overall accuracy Mean confidence High-conf. accuracy Fingerprint sep. (∆S )
ARCANE
Baseline
∆
p-value
30.7% 43.2% −12.5% 0.087 (ns) 0.137 0.199 −0.062 < 0.001*** — — — — 0.046, t = 8.33, p = 1.52 × 10−16
7
Figure 2: (a) Attribution confidence distributions: both methods produce low-confidence posteriors due to the fingerprint separability ceiling. (b) Per-actor accuracy: DOUBLEPANDA achieves the highest ARCANE accuracy (63.6%), while MINTLEAF and VOIDLOTUS prove most difficult. Baseline accuracy is higher on average but exhibits greater variance.
7.2
Learning Curve
Figure 3 shows re-identification accuracy as a function of the number of prior training campaigns. ARCANE accuracy does not monotonically improve with more training data (ranging from 12.5% to 30.7% as min_train varies from 6 to 1), confirming that the barrier is not data quantity but feature separability.
Figure 3: Re-identification accuracy vs training campaign count for ARCANE (blue) and baseline (red). ARCANE does not exhibit the expected monotonic improvement, indicating that additional training campaigns cannot compensate for insufficient fingerprint separability. Shaded regions show ±1 SD.
8
7.3
Fingerprint Separability Ceiling
Figure 4 presents the pairwise inter-actor fingerprint similarity matrix. All off-diagonal entries fall in the range [0.89, 0.99], revealing the high-similarity regime. Notable pairs include LAZARUSHOUND/STORMVIPER (S = 0.96), both KP-origin actors with overlapping toolsets and operational patterns, and DOUBLEPANDA/VOIDLOTUS (S = 0.99), two CN-origin actors sharing Gh0st RAT and PlugX tool families.
Figure 4: Inter-actor mean fingerprint similarity matrix. All off-diagonal entries exceed 0.89, indicating the dense clustering that constitutes the separability ceiling. Same-origin pairs (e.g., DOUBLEPANDA/VOIDLOTUS at 0.99) are particularly indistinguishable by behavioural features alone.
7.4
Evasion Robustness
Figure 5 shows ARCANE accuracy under five evasion levels. Accuracy varies between 20.6% and 25.2% with no statistically significant trend (F -test, p > 0.05), confirming the evasion-invariance property. This is the paper’s most operationally actionable finding: defenders cannot improve attribution by reducing actor evasion capability, since evasion is not the binding constraint.
9
Figure 5: ARCANE re-identification accuracy under adversarial evasion. Accuracy is stable across evasion levels (20.6%–25.2%), confirming evasion-invariance. Error bars show ±1 SD across n = 20 random trials per evasion level.
7.5
Threat Actor Similarity Graph
Figure 6 visualises the knowledge graph induced by the fingerprint similarity matrix. The fully connected topology (all actor pairs exceed the τs = 0.45 threshold) illustrates graphically why disambiguation is difficult: no pair of actors is sufficiently distant in the feature space to permit confident re-identification from a single campaign.
10
Figure 6: Threat actor infrastructure similarity graph. Node colour indicates nation-state origin: KP (red), RU (blue), CN (gold), IR (green). All actors are connected above the similarity threshold, confirming the dense-cluster regime.
7.6
Temporal Analysis
Figure 7 shows monthly attribution accuracy and mean confidence over the 18-month simulation window. No systematic improvement trend is observable, consistent with the separability ceiling analysis. The confidence line remains flat at approximately 0.15–0.20, well below the 0.85 threshold required for high-confidence attribution.
11
Figure 7: Monthly re-identification accuracy (bars, left axis) and mean attribution confidence (line, right axis) over 18 months. The confidence plateau at ≈ 0.15 reflects the inability of the Bayesian posterior to concentrate in the high-similarity feature space.
8
Discussion
We now interpret the empirical findings in the context of cyber attribution practice and theory. Rather than focusing solely on performance metrics, this section examines what the results reveal about the structure of the attribution problem itself. In particular, we argue that the observed limitations are not artefacts of model design, but reflect a deeper constraint imposed by the convergence of sophisticated adversaries in observable feature space. This perspective reframes the negative result as a constructive insight into which signals are—and are not—sufficient for reliable attribution.
8.1
The Separability Ceiling
Our central finding—that sophisticated threat actors converge to a dense region of the behavioural fingerprint space—has a clear operational interpretation. Actors operating at high sophistication levels adopt similar operational security practices: heavy TOR usage, frequent tool rotation, locale spoofing, and VM-based analysis environments. These shared practices are precisely the features captured by our 24-dimensional fingerprint, making them uninformative for actor discrimination. This finding aligns with the observation in threat intelligence practice that high-end APT groups are increasingly difficult to distinguish by TTPs alone [27], and motivates the shift toward actor-specific rather than TTP-based attribution signals.
8.2
Supplementary Signal Classes
Based on the feature separability analysis, we identify three supplementary signal classes that could break through the ceiling: (1) Victim sector targeting. APT groups exhibit strong sector preferences (financial, healthcare, energy) that are largely independent of their operational security practices. Incorporating victim sector as a feature would add discriminative power without relying on low-entropy behavioural signals. (2) Temporal clustering. The hour-of-day entropy feature (f15 ) provides partial temporal signal, but a richer model incorporating day-of-week patterns, national holiday calendars, and working-hours alignment would be substantially more discriminative. (3) Infrastructure re-use graphs. Even through TOR, some actors re-use specific ASN ranges, exit node sets, or VPN providers. A graph-based model of infrastructure co-occurrence across campaigns could provide actor-specific signals orthogonal to the behavioural features. 12
We quantify the expected improvement from each signal class using the separability gap condition (Proposition 1) and leave empirical validation to future work.
8.3
The Null Result as a Contribution
The failure of ARCANE to outperform the baseline is itself a significant contribution. It establishes, with statistical rigour on a ground-truth dataset, that behavioural beacon telemetry alone is insufficient for crosscampaign attribution at N = 8 actors, and quantifies the specific gap (∆S = 0.046 vs the required ≈ 0.08 per Proposition 1) that must be closed. This is precisely the kind of empirical characterisation needed to guide future system design.
8.4
Evasion-Invariance Implications
The evasion-invariance finding (Section 7) has a counterintuitive implication for defensive strategy: encouraging attackers to increase their evasion (e.g., by deploying prominent honeytokens that signal active monitoring) does not degrade attribution capability. Defenders can therefore deploy passive attribution infrastructure aggressively without concern that attacker evasion will render it useless.
8.5
Limitations
Our study has three principal limitations. Synthetic data. The experiment is conducted on synthetically generated data rather than real-world beacon telemetry. While actor profiles are grounded in published intelligence, real campaigns will exhibit distributional differences not captured by our model. Empirical validation on real passive hack-back deployments is planned as future work. Closed actor set. We assume a closed set of N = 8 known actors. In practice, defenders may encounter previously unseen actors; extending ARCANE to open-set attribution is an important direction. Feature dimensionality. The 24-dimensional fingerprint captures the features observable from standard beacon telemetry. Richer telemetry (e.g., detailed HTTP header sequences, TLS fingerprints, DNS request patterns) could support higher-dimensional fingerprints with better separability.
9
Conclusion
This paper presented ARCANE, the first formal framework for cross-campaign attacker re-identification using passive beacon telemetry. We established a Bayesian attribution model with formal fingerprint similarity, cross-campaign confidence, and separability gap definitions, and implemented an efficient temporal leaveone-out evaluation protocol. Our experiments on 96 campaigns across 8 nation-state threat actors yielded two principal findings. First, within-actor fingerprint similarity is significantly higher than cross-actor similarity (∆S = 0.046, p = 1.52×10−16 ), confirming the theoretical basis for longitudinal attribution. Second, the Bayesian accumulation in its current form does not outperform the per-campaign baseline due to a fingerprint separability ceiling imposed by shared operational security practices among sophisticated actors. Critically, ARCANE attribution accuracy is evasion-invariant: accuracy varies by less than 4.6% across evasion levels from zero to maximum, establishing that the binding constraint is feature separability rather than adversarial evasion. This finding has direct implications for defensive system design: beacon deployment strategies need not be conservative about alerting attackers to their presence. Future work will address the separability ceiling by incorporating victim-sector targeting, enriched temporal features, and infrastructure re-use graphs, with empirical validation on real-world passive hack-back deployments.
13
References [1] T. Rid and B. Buchanan, “Attributing cyber attacks,” Journal of strategic studies, vol. 38, no. 1-2, pp. 4–37, 2015. [2] W. Tounsi and H. Rais, “A survey on technical threat intelligence in the age of sophisticated cyber attacks,” Computers & security, vol. 72, pp. 212–233, 2018. [3] S. M. Milajerdi, R. Gjomemo, B. Eshete, R. Sekar, and V. Venkatakrishnan, “Holmes: real-time apt detection through correlation of suspicious information flows,” in 2019 IEEE symposium on security and privacy (SP). IEEE, 2019, pp. 1137–1152. [4] F. Psallidas, A. Agrawal, C. Sugunan, K. Ibrahim, K. Karanasos, J. Camacho-Rodríguez, A. Floratou, C. Curino, and R. Ramakrishnan, “Oneprovenance: Efficient extraction of dynamic coarse-grained provenance from database query event logs,” Proceedings of the VLDB Endowment, vol. 16, no. 12, pp. 3662–3675, 2023. [5] E. Altinisik, F. Deniz, and H. T. Sencar, “Provg-searcher: A graph representation learning approach for efficient provenance graph search,” in Proceedings of the 2023 ACM SIGSAC conference on computer and communications security, 2023, pp. 2247–2261. [6] M. N. Hossain, S. M. Milajerdi, J. Wang, B. Eshete, R. Gjomemo, R. Sekar, S. Stoller, and V. Venkatakrishnan, “{SLEUTH}: Real-time attack scenario reconstruction from {COTS} audit data,” in 26th USENIX Security Symposium (USENIX Security 17), 2017, pp. 487–504. [7] W. U. Hassan, A. Bates, and D. Marino, “Tactical provenance analysis for endpoint detection and response systems,” in 2020 IEEE symposium on security and privacy (SP). IEEE, 2020, pp. 1172– 1189. [8] B. Buchanan, The cybersecurity dilemma: Hacking, trust, and fear between nations. Oxford University Press, 2016. [9] D. A. Wheeler and G. N. Larsen, “Techniques for cyber attack attribution,” 2003. [10] S. Caltagirone, A. Pendergast, and C. Betz, “The diamond model of intrusion analysis,” 2013. [11] B. E. Strom, A. Applebaum, D. P. Miller, K. C. Nickels, A. G. Pennington, and C. B. Thomas, “Mitre att&ck: Design and philosophy,” 2018. [12] T. K. Chowdhury and S. Biswas, “Graph neural networks (gnns) for modeling cyber attack patterns and predicting system vulnerabilities in critical infrastructure,” American Journal of Interdisciplinary Studies, vol. 3, no. 04, pp. 157–202, 2022. [13] L. Spitzner, “Honeytokens: The other honeypot,” Symantec Enterprise Security Community, Jul. 2003, originally released 17 July 2003; updated version later released based on community feedback. [Online]. Available: https://community.broadcom.com/symantecenterprise/communities/community-home/ librarydocuments/viewdocument?DocumentKey=74450cf5-2f11-48c5-8d92-4687f5978988 [14] A. Juels and R. L. Rivest, “Honeywords: Making password-cracking detectable,” in Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, 2013, pp. 145–160. [15] T. Yu, Y. Xin, and C. Zhang, “Honeyfactory: Container-based comprehensive cyber deception honeynet architecture,” Electronics, vol. 13, no. 2, p. 361, 2024. [16] P. Beltrán-López, M. G. Pérez, and P. Nespoli, “Cyber deception: Taxonomy, state of the art, frameworks, trends, and open challenges,” IEEE Communications Surveys & Tutorials, 2025. [17] A. I. Weinberg, “Passive hack-back strategies for cyber attribution: Covert vectors in denied environment,” arXiv preprint arXiv:2508.16637, 2025.
14
[18] U. Bayer, P. M. Comparetti, C. Hlauschek, C. Kruegel, and E. Kirda, “Scalable, behavior-based malware clustering.” in NDSS, vol. 9, 2009, pp. 8–11. [19] L. Bilge and T. Dumitraş, “Before we knew it: an empirical study of zero-day attacks in the real world,” in Proceedings of the 2012 ACM conference on Computer and communications security, 2012, pp. 833–844. [20] D. Y. Huang, M. M. Aliapoulios, V. G. Li, L. Invernizzi, E. Bursztein, K. McRoberts, J. Levin, K. Levchenko, A. C. Snoeren, and D. McCoy, “Tracking ransomware end-to-end,” in 2018 IEEE Symposium on Security and Privacy (SP). IEEE, 2018, pp. 618–631. [21] A. Caliskan-Islam, R. Harang, A. Liu, A. Narayanan, C. Voss, F. Yamaguchi, and R. Greenstadt, “De-anonymizing programmers via code stylometry,” in 24th USENIX security symposium (USENIX Security 15), 2015, pp. 255–270. [22] D. Pasquini, E. M. Kornaropoulos, and G. Ateniese, “{LLMmap}: Fingerprinting for large language models,” in 34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 299–318. [23] C. Kruegel and T. Toth, “Using decision trees to improve signature-based intrusion detection,” in International workshop on recent advances in intrusion detection. Springer, 2003, pp. 173–191. [24] R. Anderson, C. Barton, R. Bölme, R. Clayton, C. Ganán, T. Grasso, M. Levi, T. Moore, and M. Vasek, “Measuring the changing cost of cybercrime,” 2019. [25] D. Liu, X. Wang, and L. J. Camp, “Mitigating inadvertent insider threats with incentives,” in International Conference on Financial Cryptography and Data Security. Springer, 2009, pp. 1–16. [26] K. Nance, M. Bishop, and B. Hay, “Investigating the implications of virtual machine introspection for digital forensics,” in 2009 International Conference on Availability, Reliability and Security. IEEE, 2009, pp. 1024–1029. [27] J. Kutscher, “M-trends 2022: Cyber security metrics, insights and guidance from the frontlines,” Apr. 2022, threat Intelligence Report. [Online]. Available: https://cloud.google.com/blog/topics/ threat-intelligence/m-trends-2022 [28] M. A. S. Al Barwani, “State-sponsored cyber-attacks: Threats, strategies, and global responses.” [29] T. Singh, “Case studies: State-sponsored cyberattacks,” in Cybersecurity, Psychology and People Hacking. Springer, 2025, pp. 151–165. [30] C. D. Hylender, P. Langlois, A. Pinto, and S. Widup, “Verizon 2024 data breach investigations report,” The Verizon DBIR Team. Available online: https://www. verizon. com/business/resources/Tf18/reports/2024-dbir-data-breach-investigations-report. pdf (accessed on 20 November 2024), 2024.
15