Ajallisesti luotettava APT-ryhmien attribuutio - Limnell, Aku (2025)
This study examined the attribution of state-sponsored and state-supported Advanced Persistent Threat (APT) attacks from the perspective of cybersecurity decision-making. The purpose of the research was to analyze the factors influencing the achievement of reliable and timely attribution and to identify the challenges and potential solutions associated with attributing the actors behind cyberattacks. The study focused particularly on decision-making mechanisms and administrative constraints of the attribution process, recognizing that technical analysis alone is insufficient to support decision-making in situations characterized by uncertainty, time pressure, and political consequences. The research employed a literature review, document analysis, and Design Science Research (DSR) as methodological approaches. The literature review identified key concepts of attribution, analytical methods, and international standards, while document analysis provided insights into international frameworks, official reports, and practical applications. Following the principles of DSR, a decision-making model was developed, integrating technical, operational, and strategic information and analysis through the application of Bayesian Decision Network (BDN), fuzzy logic, and the MITRE ATT&CK and Diamond models. The findings indicated that attribution is a complex, multilayered process marked by uncertainty, requiring the integration of technical, operational, and strategic perspectives to support reliable decision-making. The main challenges identified included uncertainty management, evaluation of information quality, lack of international cooperation and standards, and the potential manipulation of evidence. The developed decision-making model offered a systematic and transparent approach that improved the reliability, traceability, and acceptabil-ity of decision-making in international contexts. The study concluded that while a complete and flawless attribution process is unattainable, DSR provides structured pathway for developing practical solutions that enhance cybersecurity decision-making, strengthen international cooperation, and improve decision resilience under uncertainty.