What happens after a cyberattack is detected? - CADC 1-YEAR MILESTONE EVENT

Key Concepts

• Cyber Attribution: The process of identifying, assigning responsibility, and understanding the intent and methodology of a cyber threat actor.
• CADC (Cyber Attribution Data Center): A specialized research and operational center at the University of New Brunswick (UNB) focused on advancing Canada’s ability to attribute and respond to sophisticated cyber threats.
• Threat Actor Profiling: Using AI to analyze tactics, techniques, and procedures (TTPs) to identify and track specific hacking groups.
• Cyber Deception: The use of "honey-nets" or decoys to lure attackers into a controlled environment to study their behavior in real-time.
• Data Sovereignty: The commitment to storing and processing sensitive intelligence data within Canadian borders.
• Evidence-Based Attribution: Moving from speculative guessing to certainty by using AI-driven graph reasoning and binary DNA analysis.

---

1. Main Topics and Key Points

The event celebrated the one-year anniversary of the Cyber Attribution Data Center (CADC) at the Canadian Institute for Cyber Security (CIC).

• Strategic Importance: The CADC is positioned as a national asset for protecting critical infrastructure (energy, health, finance, and telecommunications).
• Investment: The Government of Canada, through the Atlantic Canada Opportunities Agency (ACOA), invested $9.7 million in December 2024 to support the center.
• Operational Scale: In its first year, the CADC hired 26 employees, established two redundant data centers, and developed seven proprietary AI-powered tools.
• Research Output: The CIC is a global leader in cyber security data sets, with over one million downloads to date.

2. Real-World Applications

• Critical Infrastructure Protection: The CADC provides intelligence to secure ports, energy grids, and agricultural systems against state-sponsored and criminal actors.
• Incident Response: Tools like Luminol allow incident response teams to move from fragmented evidence to a clear "adversary picture" during active breaches.
• Threat Intelligence: The center tracks global campaigns, such as the 2025 Salesforce-focused phishing campaign, where they successfully attributed attacks to the "Shiny Hunters" group with high confidence.

3. Methodologies and Frameworks

The CADC operates under a specific Cyber Attribution Framework:

1. Data Verification: Ensuring the integrity and source of collected data.
2. AI-Powered Analysis: Utilizing machine learning for clustering evidence and identifying patterns.
3. Sovereign Storage: Ensuring all intelligence remains within Canada.
4. Modular Architecture: The platform is designed to be used commercially or by government entities, either as a collective or as standalone modules.

4. Key Tools and Technologies

• Luminol: An AI-powered clustering engine that connects fragmented evidence (reports, past incidents, infrastructure) to identify the "who" behind an attack. It features "binary DNA" technology to compare malware structures.
• Sigil: A threat actor profiling platform that correlates disparate hacking groups (e.g., Scattered Spider, Lapsis, and Shiny Hunters) to anticipate mergers or coordinated campaigns.
• Deak (Cyber Deception): A high-interaction honey-net system that mirrors real infrastructure to lure attackers, allowing researchers to observe their TTPs in a safe, controlled environment.

5. Notable Quotes

• MP David Miles: "These kind of things don't happen without being able to imagine what our role can be... in facing some of the greatest challenges our country faces today."
• Dr. Ali Ghorbani (Director): "Cyber attribution is basically a scouting report that we do in cyber security to study the attacker groups."
• Anonymous/General Sentiment: "Wars aren't won by weapons only. They're won by good intelligence."

6. Logical Connections

The presentations followed a clear progression:

• Policy/Strategic Level: Government officials (Miles, Gettys) emphasized the need for a "whole-of-society" approach to national security and the importance of Bill C-8.
• Institutional Level: Dr. Kathy Wilson highlighted the role of UNB in training the next generation of professionals and maintaining Canadian autonomy.
• Technical/Operational Level: The CADC team (Hicks, Bubing, Ansong, Reza) demonstrated how the theoretical framework is translated into actionable software tools.

7. Synthesis and Conclusion

The CADC has successfully transitioned from a research concept to an operational powerhouse within one year. By combining academic rigor with high-fidelity AI tools, the center is filling a critical gap in Canada’s national defense. The primary takeaway is that attribution is the key to deterrence; by identifying the "who" and "why" behind cyber attacks, organizations can move from a reactive posture to a proactive, intelligence-led defense. The center’s future roadmap focuses on expanding its employee footprint, disseminating intelligence reports to stakeholders, and rolling out nationwide attribution training.