<— Back

Using Linguistics and Psychological Profiling in Threat Actor Attribution

Traditional threat actor attribution primarily focuses on TTPs (Tactics, Techniques, and Procedures), but this method is increasingly ineffective when adversaries employ similar strategies or attempt to mask their identities. This paper introduces an advanced attribution methodology that combines cyber linguistics, behavioral profiling, and Natural Language Processing (NLP). By analyzing linguistic markers such as vocabulary, syntax, tone, intent, and prominent words, alongside sentiment analysis, we identify distinct patterns that differentiate threat actor groups. This approach reveals not only behavioral traits but also the psychological drivers behind attack campaigns. By integrating NLP techniques for tone and intent detection, we provide more nuanced insights into the actors’ motivations. This advanced model enhances attribution accuracy, enabling threat intelligence teams to refine defensive strategies and proactively counter emerging threats. This work represents a step forward in making attribution more precise, dynamic, and actionable for the cybersecurity community.

Rishika Desai – BforeAI

Rishika Desai is a leading threat intelligence and cybercrime researcher with a strong focus on OSINT and dark web investigations. Featured in Forbes and Dark Reading as a subject matter expert, she was also awarded as Rising Star of the Year 2025 by BSides Bangalore. Rishika regularly shares her insights at global conferences and is known for her engaging, real-world approach to cybersecurity education. As a mentor and founder of a thriving cyber community, she is dedicated to shaping the next generation of cyber defenders.