## 5 Discussion
### Comparative Analysis with Related Work  
To contextualize our results and demonstrate the advantages of our approach, we compared our method with several Transformer-based or deep learning-based models for attack detection or attribution. As shown in Table 6, many recent approaches employed deep learning or Transformer-based models for threat detection tasks, such as identifying anomalous or malicious behavior. For instance, [PERSON] et al. [13] adopted a Transformer-based approach and evaluated its performance on two large-scale DARPA datasets comprising over 17 billion system events. Although its detection metrics are strong, the model did not address attacker attribution, and its evaluation primarily focused on binary classification of malicious behavior within imbalanced log data. [PERSON] et al. [24] utilized the CIC-IDS2017 dataset, which includes over 2.8 million network traffic records: 2,273,097 normal and 557,646 attack instances, captured in a realistic network environment. However, their method focused on detecting types of malicious activity rather than attributing responsibility to specific actors. While the dataset size allowed for extensive training, the model evaluation was limited to standard classification performance without deeper analyses of attack attribution or the interpretability of the results. [PERSON] et al. [10] evaluated their RAPID method on three real-world system audit datasets totaling over 160 million events. Their method excelled in detecting APT activity based on provenance analysis but did not address the attribution problem, nor did it infer adversary identities from the data itself. In contrast, [PERSON] et al. [4] focused explicitly on attribution using enriched logs tagged with external threat intelligence. Although they achieved promising results (F1 = 0.90), their reliance on threat intelligence sources limited applicability in environments where such enrichment is unavailable. Moreover, their dataset remained relatively small, with about 25,000 sequences annotated for five actors. Our approach differs fundamentally in both design and scope. We tackled attribution directly by modeling temporal and structural correlations in raw alert sequences, using \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Method** & **Dataset** & **Task Type** & **F1 (Macro)** & **Attribution Capability** \\ \hline [PERSON] et al. [4] & Enriched threat logs (25k sequences) & Attribution & 0.90 & Group-level attribution using threat intelligence \\ [PERSON] et al. [10] & Enterprise audit logs (THEIA, CADETS, Public Arena) & APT detection & 0.96 & No attribution; provenance-based detection only \\ [PERSON] et al. [13] & Synthetic APT logs & APT detection & 0.94 & No attribution; focused on anomaly detection in synthetic logs \\ [PERSON] et al. [24] & IoT traffic (UNSW-NB15) & Detection & 0.95 & No attribution; focused on traffic classification \\ Ours & 53k CTF alert sequences & Attribution & 0.99 & Fine-grained, individual-level attribution without external enrichment \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparison with related methods for threat detection or attribution. no external enrichment or prior knowledge. Our dataset consisted of approximately 53,830 alert sequences, extracted from CTF environments with fifty distinct adversaries. Despite this class imbalance, our model achieved a macro F1-score of 0.99, surpassing prior methods in both detection and attribution. The strength of our method lies not only in its performance but also in its capacity to generalize across underrepresented actors through learned attention-based representations. This enables precise, interpretable attribution even in imbalanced, noisy, or data-sparse contexts, a key requirement for real-world deployment in operational security environments.