ARCANE: cross-campaign attacker re-identification via Beacon and canary-token telemetry—a sequential evidence-accumulation framework for longitudinal cyber attribution

Current cyber-attribution approaches typically operate on a per-incident basis, leaving open the question of whether aggregating evidence across campaigns can meaningfully improve adversary identification. We investigate this question with attacker re-identification via cross-campaign attribution network (ARCANE), a framework that aggregates telemetry from tracking payloads (“Beacons”/canary tokens) embedded in documents, credentials, or source code across campaigns to build persistent adversary fingerprints, and combines new evidence with a single, principled application of Bayes’ rule per query campaign. The method performs one multiclass Bayesian update per query rather than a chain of per-actor updates, resets the prior for every query campaign, and only allows knowledge-base entries to be used as evidence after an explicit label-confirmation delay that models a realistic analyst-confirmation lag. We evaluate it with an actor-level bootstrap statistical protocol (rather than pairwise tests that would treat non-independent campaign pairs as independent), against two similarity-based baselines, with a feature-group ablation, a calibration analysis (Brier score, expected calibration error), an open-set pilot, and a simulator-sensitivity check. On a synthetic benchmark of eight simulated nation-state actors and 96 campaigns, within-actor fingerprint similarity is reliably higher than cross-actor similarity (actor-level bootstrap \(Δ _S = 0.149\) , 95% CI [0.104, 0.176]), but ARCANE attains only \(32.9%\) accuracy (91 evaluated campaigns)—significantly worse than a simple running-profile nearest-neighbour baseline ( \(62.8%\) ; actor-cluster bootstrap \(p = 6.7× 10⁻⁴\) ) and statistically indistinguishable from a k -nearest-neighbour baseline ( \(55.8%\) ; \(p = 0.073\) ). Accuracy is stable across two different evasion schedules (chi-square test on per-campaign outcomes, \(p > 0.65\) in both cases)—a finding we report as evasion-invariance under the two evasion models tested , not as a general property of adversary evasion. A feature-group ablation shows that the geospatial feature subgroup alone outperforms the full 24-dimensional fingerprint, indicating that naively concatenating heterogeneous feature groups under a single cosine similarity dilutes informative signal rather than combining it. We present these results as a rigorously qualified negative/mixed finding: cross-campaign aggregation, even implemented as a mathematically valid Bayesian update, does not automatically outperform simpler running-profile matching on this benchmark, and any claim of a general “structural” separability ceiling in real-world attribution is beyond what a single synthetic simulator can establish. We scope our conclusions accordingly and outline the specific experiments—additional baselines, real telemetry, open-set evaluation, metric learning—needed to test them further.