There are number of sources of data offlate , http://www.netresec.com/?page=PcapFiles

http://www.secrepo.com/

http://www.caida.org/data/passive/ddos-20070804_dataset.xml

http://ita.ee.lbl.gov/html/traces.html

https://github.com/sooshie/Security-Data-Analysis/tree/master/Lab_2

It depends ofcourse how the attribution is done whether it is state sponsored. For example , search the pcap data from above locations to find where and whom the public ip addresses belong to.

I would send an e-mail to Erik Gartzke

...and then there is Thomas Rid

http://www.kcl.ac.uk/sspp/departments/warstudies/people/professors/rid.aspx