## 3 Materials and Methods
### Dataset Description and Characterization
This analysis shows that the dataset contained not only trivial patterns but also complex and realistic behaviors, aligned with attack scenarios observed in competitive and real environments. The presence of both trivial and sophisticated patterns in the sequences was consistent with the dynamics of a CTF, where automated scripts and manual or adaptive attacks coexist. Thus, the richness of patterns, aligned with the malicious and strategic nature of traffic in the CTF, reinforced the relevance of the dataset as a realistic benchmark for attack attribution. The distribution of sequences by attacker IP and by team, illustrated in Figures 2 and 3, showed a significant imbalance in the number of sequences generated by each entity. This imbalance introduced an additional challenge, as attribution models must avoid overfitting to majority classes and maintain robust performance against minority classes. Regarding the complexity of the sequences, Figure 4 shows the distribution of their lengths. While most sequences were relatively short, there were notable outliers with significantly greater \begin{table}
\begin{tabular}{l l l} \hline
**Alert Sequence** & **Alert Description** & **Possible Interpretation** \\ \hline \multirow{3}{*}{[27, 13,...] (18 alerts)} & 27: TCP timestamp missing & Automated attack repeatedly exploiting an \\  & 13: HTTP invalid content length & HTTP vulnerability, possibly to evade \\  & or chunk size & session controls or exploit errors in header \\  & & handling. \\ \multirow{3}{*}{[14,...] (20 alerts)} & 14: Consecutive TCP small & Intentional fragmentation of TCP packets to \\  & segments exceeding threshold & evade detection systems or exploit in traffic \\  & 22: HTTP server response & Anomalous protocol behavior possibly \\  & before client request & generated by misconfigured tools or scripts. \\  & 27: TCP timestamp missing & Complex sequence suggesting an attack \\  & 13: HTTP invalid content length & combining HTTP and IMAP exploitation, \\  & 14: Consecutive TCP small segments & possibly for simultaneous reconnaissance \\  & 2: Unknown IMAP4 command & and exploitation. \\  & 29: TCP session & \\ \hline \end{tabular}
\end{table} 
Table 4: Examples of representative sequences and their possible interpretation in the CTF context. \begin{table}
\begin{tabular}{l l} \hline
**Feature** & **Value** \\ \hline Total sequences & 53,830 \\ Unique attacker IPs & 50 \\ Teams (third octet of the IP) & 20 \\ Unique victim IPs & 20 \\ Unique attacker–victim pairs & 849 \\ Minimum sequence length & 9 \\ Maximum sequence length & 243 \\ Mean sequence length & 61.7 \\ Median sequence length & 38 \\ Standard deviation of length & 62.2 \\ Percentile 95 & 243 \\ Unique sequences & 29,200 (54.2\%) \\ Most repeated sequence (occurrences) & 1259 \\ Silhouette index (by IP) & \(-\)0.312 \\ Silhouette index (by team) & \(-\)0.263 \\ Alert types (Snort) & 30 \\ \hline \end{tabular}
\end{table} 
Table 3: Statistical summary of the subset of alert sequences used for attribution experiments. The separability of classes and the inherent difficulty of the attribution task were evaluated using t-SNE visualizations, shown in Figures 5 and 6. These visual tools were crucial for understanding the underlying complexity of the attack attribution problem. In Figure 5, each point corresponds to an alert sequence generated by a specific team, with colors indicating the team of origin. The absence of well-defined clusters suggested a high degree of overlap between sequences from different teams. In several regions of the plot, sequences from multiple teams appeared intermingled, making it clear that there was no simple separation in the feature space. This overlapping distribution highlights the intrinsic challenge of distinguishing attackers based solely on the characteristics of their alert sequences. On the other hand, Figure 6 presents the centroids of the alert sequences, offering a more abstract and aggregated perspective of how the sequences were distributed in the feature space.