# DeepAPT: Nation-State APT Attribution Using End-to-End Deep Neural Networks

arXiv: https://arxiv.org/abs/1711.09666 · HTML: https://mlsanity.com/paper/1711.09666/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Nov 2017.

## Built on by (most cited first, 6 of 6)

- [Towards Energy-Efficient and Secure Edge AI: A Cross-Layer Framework](https://mlsanity.com/paper/2109.09829/) (2021)
- [AURA: A Multi-Agent Intelligence Framework for Knowledge-Enhanced Cyber Threat Attribution](https://mlsanity.com/paper/2506.10175/) (2025)
- [On Technique Identification and Threat-Actor Attribution using LLMs and Embedding Models](https://mlsanity.com/paper/2505.11547/) (2025)
- [APT-MMF: An advanced persistent threat actor attribution method based on multimodal and multilevel feature fusion](https://mlsanity.com/paper/2402.12743/) (2024)
- [DeepTaskAPT: Insider APT detection using Task-tree based Deep Learning](https://mlsanity.com/paper/2108.13989/) (2021)
- [High-Precision APT Malware Attribution with Out-of-Scope Resilience](https://mlsanity.com/paper/2606.03523/) (2026)

## Abstract (arXiv)

In recent years numerous advanced malware, aka advanced persistent threats (APT) are allegedly developed by nation-states. The task of attributing an APT to a specific nation-state is extremely challenging for several reasons. Each nation-state has usually more than a single cyber unit that develops such advanced malware, rendering traditional authorship attribution algorithms useless. Furthermore, those APTs use state-of-the-art evasion techniques, making feature extraction challenging. Finally, the dataset of such available APTs is extremely small. In this paper we describe how deep neural networks (DNN) could be successfully employed for nation-state APT attribution. We use sandbox reports (recording the behavior of the APT when run dynamically) as raw input for the neural network, allowing the DNN to learn high level feature abstractions of the APTs itself. Using a test set of 1,000 Chinese and Russian developed APTs, we achieved an accuracy rate of 94.6%.