System and method for determining the confidence level in attributing a cyber campaign to an activity group

A system for analyzing a cyber-attack, comprising:

• a processor;
• processor memory;
• and
• a high confidence cyber threat attribution engine comprising a set of computer readable instructions stored in processor memory that are executable by the processor to:
• receive intrusion set data, wherein the intrusion set data comprises data associated with a campaign, extract quantitative data from the indicator set data, wherein the extracted indicator data (“EKID”) comprises data related to a plurality of metrics associated with a campaign that is used for cyber threat attribution,
• receive activity groups data, wherein the activity group data comprises data associated with an activity group, extract quantitative data, wherein the extracted activity group data (“AGID”) comprises data related to a plurality of metrics associated with a that activity group,
• compare the EKID with the AGID, and
• determine if the EKID is attributed to a known activity group with the associated confidence level based on a multi-stage comparison;
• wherein the metrics associated with the intrusion set and the metrics of known activity groups are associated with at least one tool and techniques