## 3 Materials and Methods
### Dataset Description and Characterization
\begin{table}
\begin{tabular}{l l l} \hline \hline
**alert\_id** & **Frequency** & **Description** \\ \hline
0 & 3984 & TCP port scan. \\
1 & 38 & Combined SDF flow alert. \\
2 & 430,466 & Unknown IMAP command. \\
3 & 196 & TCP homeypot port. \\
4 & 9498 & Missing HTTP content length. \\
5 & 1295 & Multiple TCP port scan. \\
6 & 1 & SIP URI too long. \\
7 & 5 & Distributed TCP port scan. \\
8 & 65 & SSH protocol mismatch. \\
9 & 81 & TCP timestamp out of window. \\
10 & 73 & Incorrect segment, size adjusted. \\
11 & 2 & Consecutive small HTTP chunk. \\
12 & 69 & Overlapping TCP packet limit. \\
13 & 526,640 & Invalid HTTP content. \\
14 & 2,265,584 & Consecutive small TCP segments. \\
15 & 261,768 & Non-RFC defined characters in HTTP. \\
16 & 349 & Missing TCP timestamp. \\
17 & 195 & Overloaded directory in HTTP URI. \\
18 & 62,701 & Reset out of window. \\
19 & 21,812 & Other HTTP protocol on server. \\
20 & 9348 & Long HTTP header. \\
21 & 39 & UDP port scan. \\
22 & 499,607 & TCP session without 3-way handshake. \\
23 & 1971 & Invalid HTTP chunk size. \\
24 & 1 & ICMP port scan. \\
25 & 44 & Invalid line before HTTP response. \\
26 & 1 & Invalid or malformed HTTP chunk. \\
27 & 1,122,635 & Unknown HTTP method. \\
28 & 34 & Simple HTTP request. \\
29 & 304,721 & Unescaped space in HTTP URI. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Summary of alert identifiers. 3.1.1. Complexity and Behavioral Diversity in the CTF Dataset  
For the attacker attribution experiments conducted in this study, the aforementioned filtered subset--comprising sequences between 9 and 243 alerts in length--served as the core dataset. This criterion ensured that the sequences included were sufficiently complex to capture meaningful behavioral patterns, while simultaneously removing noise introduced by overly short or anomalously long sequences. Table 3 presents a statistical summary of this final dataset, which formed the empirical basis for all subsequent analyses and modeling efforts. This refined subset retained much of the complexity and imbalance present in the original dataset. It exhibited a high proportion of unique sequences and recurring patterns, and an uneven distribution of activity among attacking teams. Furthermore, the low silhouette index values observed during clustering analysis indicated that the attacker attribution task remained highly challenging as the classes were not easily distinguishable in the feature space. The diversity of attack patterns within the dataset was closely linked to the nature of the vulnerable services and the competitive dynamics inherent to the CTF event. Many of the Snort rules observed in the sequences--such as those related to HTTP, IMAP, and TCP fragmentation--were directly associated with these services, and their frequency highlighted the strategic focus on exploiting them. The analysis of alert sequences not only revealed behavioral signatures of the attacking teams but also enabled inferences about their tactics and the specific vulnerabilities they targeted during the competition. For instance, the \"Unknown IMAP4 command\" alert (alert_id 2) was typically associated with reconnaissance or exploitation attempts on the IMAP service, while alerts like \"HTTP invalid content-length or chunk size\" (alert_id 13) and \"Consecutive TCP small segments\" (alert_id 14) often indicated attacks targeting web services such as wdub. Recurrent sequences of specific alerts suggested the use of automated tools to exploit known vulnerabilities, whereas more complex sequences--those combining alerts across multiple protocols--reflected evasion techniques, reconnaissance phases, or multi-stage exploitation strategies. These are hallmarks of the adversarial  
Figure 1: Distribution of Alert Sequence Lengths in the Multi-Adversary CTF Dataset. behavior commonly observed in CTF environments, where teams continuously adapt to exploit any available weakness to obtain tokens. Table 4 summarizes representative alert sequences and their possible interpretations in the context of the CTF competition.