Pretend for a moment I am investigating an attack. I find errors in the attack method (mistakes made by the human attacking my network/computer). I compile a database of these "mistakes" treating them like a fingerprint. I then look through sites like security.stackexchange.com comparing the mistakes to questions asked/answered. How many positives would you feel I need before I have a strong lead on a suspect? Keep in mind I can cross reference to other sites. How many cross referenced sites would I be expected to use before I have sufficient cause to call someone a suspect? This is an opinion, so the question might be closed. However, this is also a viable though inexact technique. I'm also considering that many "attacks" are cookbook techniques. In being used over and over, the first person to figure out the technique made the mistake, and everyone else is just reproducing it at some level.
Essentially you want to apply a Bayesian analysis to a corpus of work, to state something about the likelihood that you would believe an exemplar to be a member of the set constructed by your suspect. That analysis is well-known (and there's a whole statistics stackexchange site, too). You need about as big a corpus of suspect and non-suspect material as a decent spam filter uses.
I don't think this technique can hold much water, since it is likely that the attacker simply copypasted his way into your network.
Even if you keep searching for more references, your "suspect" could simply have found those sites too and copied from them. Note this may be the truth, or simply his alibi which you cannot disprove.