In the dynamic landscape of cyberspace, organizations face a myriad of coordinated advanced threats that challenge the traditional defense paradigm. Cyber Threat Intelligence (CTI) plays a crucial role, providing in-depth insights into adversary groups and enhancing the detection and neutralization of complex cyber attacks. However, attributing attacks poses significant challenges due to over-reliance on malware samples or network detection data alone, which falls short of comprehensively profiling attackers. This paper proposes an IPv4-based threat attribution model, IPAttributor, that improves attack characterization by merging a real-world network behavior dataset comprising 39,707 intrusion entries with commercial threat intelligence from three distinct sources, offering a more nuanced context. A total of 30 features were utilized from the enriched dataset for each IP to create a feature matrix to assess the similarities and linkage of associated IPs, and a dynamic weighted threat segmentation algorithm was employed to discern attacker communities. The experiments affirm the efficacy of our method in pinpointing attackers sharing a common origin, achieving the highest accuracy of 88.89%. Our study advances the relatively underexplored line of work of cyber attacker attribution, with a specific interest in IP-based attribution strategies, thereby enhancing the overall understanding of the attacker’s group regarding their capabilities and intentions.

The excess readmission ratio (ERR) is currently used to determine penalties for hospitals with excessive readmission rates. To determine whether the effectiveness of alternative measures, such as the Risk-Standardized Readmission Rate (RSRR), or Excess Days in Acute Care (EDAC), or differences between paired measures, would provide comparable or superior assessments. A retrospective national study on readmission measures. This study analyzed national readmission data from 3,047 hospitals for the fiscal year (FY) 2022. We measured the agreements and disparity scores in hospital performance assessments, as well as the changes in penalty status between the paired readmission measures. The ERR and RSRR measures showed a significantly high degree of agreement, ranging from 83.5 to 93.8% across the six applicable conditions/procedures. In contrast, marked differences emerged when comparing EDAC with ERR or RSRR, showing varying levels of disparities. If the EDAC measure were adopted, between 15.9 and 25.2% of hospitals would experience a change in their penalty status. Specifically, using EDAC would reduce financial penalties for 11.4–16.6% of small community hospitals and safety-net hospitals for at least one of the targeted conditions. These findings suggest that integrating disparity scores into the current ERR-based measurement system could have significant implications for promoting equity and informing policy decisions. By doing so, the evaluation of individual providers and hospital care quality could become more comprehensive, insightful, accurate, and equitable.