the project

why attribution

The number and impact of security incidents affecting companies and organisations has grown alarmingly. Cyber Threat Intelligence studies the activity of the groups responsible in order to organise and classify their behaviour, so that this knowledge serves to prevent and respond better. One of its hardest problems is attribution: determining who is behind a set of malicious actions. It is critical, because it makes legal action against those responsible possible and, above all, allows present and future incidents to be anticipated and handled more effectively.

Current approaches are severely limited. Most work on malware samples, an approach that the rise of malware-as-a-service and the use of several families within a single attack have rendered insufficient. Public threat reports, for their part, are of uneven quality, with few indicators and little context.

hypothesis

An intrusion is naturally represented as a network: tools, infrastructure, techniques, victims and artefacts related to one another. When several intrusions are analysed, some entities recur and connect them. Expert analysts identify these overlaps and weigh them by judgement. Our hypothesis is that graph neural networks with attention mechanisms can generalise that work: learning which relationships matter and how much, over heterogeneous networks and guided by meta-paths defined with expert knowledge.

objectives

Better training data

Build datasets from intelligence on real intrusions, drawing on sharing platforms such as MISP, and from adversary emulation with tools such as MITRE CALDERA. Define an optimal feature set for attribution that combines semantics and structure.

Attribution with graph attention networks

Model the relationships between intrusions as a heterogeneous network and apply multi-level attention to learn the influence of each relationship and each meta-path on attribution. Treat high-level indicators (tools, techniques) and atomic ones (IPs, hashes) differently, and detect spurious relationships.

Alert clustering and action inference

Cluster related alerts from a system in real time to infer the attacker's sequence of actions, map them to the MITRE ATT&CK framework and prioritise incident response.

impact

The project falls within the strategic lines of Spain's National Cybersecurity Plan and the National Cybersecurity Strategy's goal of expanding detection and analysis capabilities. Its results will make it possible to add attribution metadata to incidents shared on threat intelligence platforms, acting both as consumer and producer of intelligence, with loosely coupled integration and low deployment cost.

APT-GRAN contributes to Sustainable Development Goals 9 (resilient infrastructure and innovation) and 16 (peaceful, just and inclusive societies).

funding

Project funded by the Own Research Programme of the University of Alcalá, 2025 call for research project grants, reference PIUAH25/IA-058. Duration: 12 months, from December 2025 to December 2026. Supported by the Isdefe-UAH Chair in ICT and Artificial Intelligence.

acknowledgement and how to cite

Papers, repositories, presentations and any other output derived from the project should include the following acknowledgement:

This work was funded by the University of Alcalá through the APT-GRAN project (PIUAH25/IA-058), Own Research Programme, 2025 call.

Este trabajo ha sido financiado por la Universidad de Alcalá a través del proyecto APT-GRAN (PIUAH25/IA-058), Programa Propio de Investigación, convocatoria 2025.

To cite the project itself:

de la Hoz, E., Cornejo Bueno, L. M. et al. (2025–2026). APT-GRAN: Intelligent Attribution of Advanced Persistent Threats in Cybersecurity through Neural Networks and Graph Modelling (PIUAH25/IA-058). University of Alcalá. https://gnosis-uah.github.io/apt-gran/

Software and datasets have their own citation, with DOI, on the resources page.

technology transfer and industry contact

APT-GRAN produces results designed to fit into real environments with loose coupling: models that attribute malicious activity to known groups, tools that extract techniques and indicators from threat intelligence reports, and an integration model for threat sharing platforms such as MISP that adds attribution metadata to shared incidents.

We are interested in working with incident response teams (CERTs and CSIRTs), security operations centres, threat intelligence providers and critical infrastructure operators who want to validate these techniques on their own data or bring them into their processes. The usual routes are research and development contracts with the University of Alcalá, industry-sponsored chairs, joint projects under national or European calls, and access to real intrusion data for model validation, always under non-disclosure agreements.

Contact: Enrique de la Hoz, principal investigator, enrique.delahoz@uah.es.