A set of technical methods and organizational measures for identifying the perpetrators of a cyber attack or malicious campaign. Attribution usually entails expert analysis of cybercrime traces, as well as investigative actions by police on the basis of the analysts’ findings.