Prismatic Manipulation

Overview

Prismatic Manipulation provides defensive analysis capabilities for detecting social engineering attempts, manipulation tactics, and deceptive communication patterns. It analyzes communication content for manipulation indicators, scoring the likelihood of deceptive intent for security awareness and incident response. While Prismatic Influence operates at the strategic level of coordinated campaigns, Manipulation focuses on the tactical level -- individual communications, specific phishing attempts, and targeted social engineering against personnel.

The module implements a multi-layered detection framework based on established influence psychology research, including Cialdini's six principles of persuasion (reciprocity, commitment, social proof, authority, liking, scarcity). Each incoming communication is analyzed for the presence and intensity of these manipulation vectors, producing a structured score that security teams can use for triage. A message scoring high on authority impersonation and urgency pressure, for example, is flagged with higher confidence than one exhibiting only mild scarcity language.

Beyond detection, Manipulation serves a training function. It generates realistic but safe social engineering examples that organizations can use for security awareness training. These examples are parameterized by tactic type, sophistication level, and industry context, allowing training programs to evolve alongside the actual threat landscape rather than relying on static, easily-recognized examples.

Architecture

PrismaticManipulation.Application
└── PrismaticManipulation.Supervisor (:one_for_one)
    ├── PrismaticManipulation.DetectionPipeline (GenServer)
    │   ├── NLP Preprocessor → Feature Extractor → Scoring Model
    │   └── Broadway-backed queue for high-throughput email scanning
    ├── PrismaticManipulation.TrainingGenerator (GenServer)
    │   └── Tactic spec + difficulty → synthetic communication
    ├── PrismaticManipulation.SenderReputation (GenServer)
    │   └── ETS: :sender_reputation (historical pattern cache)
    └── PrismaticManipulation.AlertEngine (GenServer)
        └── Severity classification + notification routing

The Detection Pipeline accepts raw communication content (emails, messages, documents), applies NLP preprocessing, extracts manipulation features using a configurable feature extractor, and scores the result using a weighted model trained on labeled social engineering datasets. The Training Generator inverts this pipeline -- given a tactic specification and difficulty level, it produces synthetic communications that exhibit those tactics for training purposes.

Both components run as supervised GenServers with the Detection Pipeline accepting async submissions through a Broadway-backed queue for high-throughput email scanning.

Key Modules

Configuration

config :prismatic_manipulation,
  # Detection thresholds
  phishing_threshold: 0.7,
  social_engineering_threshold: 0.6,

  # Cialdini principle weights
  cialdini_weights: %{
    reciprocity: 0.15, commitment: 0.15,
    social_proof: 0.10, authority: 0.25,
    liking: 0.10, scarcity: 0.25
  },

  # Broadway pipeline
  broadway_concurrency: 10,
  broadway_batch_size: 50,
  broadway_batch_timeout_ms: 5_000,

  # Alert routing
  alert_channels: [:email, :webhook, :pubsub]

API Reference

# Analyze a communication for manipulation indicators
{:ok, analysis} = PrismaticManipulation.analyze(email_content,
  context: %{sender: sender_address, subject: subject_line})
# => %{manipulation_score: 0.82,
#      tactics: [:urgency, :authority_impersonation],
#      phishing: true,
#      confidence: 0.91,
#      cialdini_scores: %{authority: 0.9, scarcity: 0.7, reciprocity: 0.1}}

# Batch scan an email inbox for social engineering
{:ok, results} = PrismaticManipulation.scan_inbox(
  mailbox: "security@example.com",
  period: :last_24h,
  threshold: 0.6)

# Assess sender reputation from historical patterns
{:ok, reputation} = PrismaticManipulation.sender_reputation(email_address,
  factors: [:domain_age, :authentication, :historical_scores])

# Generate training material for security awareness
{:ok, example} = PrismaticManipulation.training_example(
  tactic: :pretexting,
  difficulty: :advanced,
  industry: :financial_services)

Testing

# Run all manipulation detection tests
cd apps/prismatic_manipulation && mix test

# Run with coverage
mix test --cover

# Run detection pipeline tests
mix test test/prismatic_manipulation/detection_pipeline_test.exs

# Run feature extraction property tests
mix test test/prismatic_manipulation/feature_extractor_test.exs

Testing includes labeled dataset validation for detection accuracy, property-based tests (via StreamData) for feature extraction consistency, Broadway pipeline throughput tests, and sender reputation baseline comparison tests. Training generator output is validated against tactic specifications to ensure generated examples accurately exhibit the requested manipulation techniques.

Integration Points

NABLA Compliance

Detection results are treated as intelligence signals under the NABLA framework, requiring the same confidence scoring and multi-source validation as any other platform intelligence output.

Performance

Related Resources

• Prismatic Influence -- Strategic influence operation detection
• Prismatic CER -- Security incident logging for detected attempts
• Prismatic Deduction -- Rule-based risk classification
• Prismatic Suppression -- Alert noise management
• Intelligence Synthesis -- Cross-domain intelligence fusion
• Color Teams -- Adversarial simulation validating detection effectiveness
• Real-Time Monitoring -- Continuous communication monitoring

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

• GitHub | GitLab | LinkedIn | Contact
• Developer Portal | Architecture | Meet the Creator