# Cyber-Deception and Attribution in Capture-the-Flag Exercises

arXiv: https://arxiv.org/abs/1507.01922 · HTML: https://mlsanity.com/paper/1507.01922/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Jul 2015.

## Built on by (most cited first, 1 of 1)

- [A Machine Learning based Empirical Evaluation of Cyber Threat Actors High Level Attack Patterns over Low level Attack Patterns in Attributing Attacks](https://mlsanity.com/paper/2307.10252/) (2023)

## Abstract (arXiv)

Attributing the culprit of a cyber-attack is widely considered one of the major technical and policy challenges of cyber-security. The lack of ground truth for an individual responsible for a given attack has limited previous studies. Here, we overcome this limitation by leveraging DEFCON capture-the-flag (CTF) exercise data where the actual ground-truth is known. In this work, we use various classification techniques to identify the culprit in a cyberattack and find that deceptive activities account for the majority of misclassified samples. We also explore several heuristics to alleviate some of the misclassification caused by deception.