Prismatic Traits

Overview

Prismatic Traits implements a comprehensive behavioral trait system built on Elixir behaviours and protocols. Rather than storing static attributes about entities, Traits computes dynamic behavioral fingerprints from observed data across multiple intelligence dimensions. Each entity receives scores along axes such as security posture, compliance responsiveness, risk appetite, and operational maturity, producing a multi-dimensional vector that enables comparison, clustering, and anomaly detection at scale.

The trait computation pipeline ingests evidence from across the platform -- OSINT collections, security scans, compliance assessments, and historical observations -- and distills them into normalized trait scores with confidence weights. Traits evolve over time as new evidence arrives, with temporal decay ensuring that recent observations carry more weight than historical data. This evidence-based approach aligns with the platform's NABLA epistemic framework, where every trait score maintains full provenance traceability.

The system serves as the foundation for entity intelligence throughout the Prismatic Platform. Downstream consumers such as Prismatic Detection Engine use trait vectors to establish behavioral baselines, while Prismatic Perimeter Core leverages trait scores as inputs to security rating algorithms.

Architecture

Evidence Sources --> Trait Computation Pipeline --> Trait Store (ETS/Ecto)
      |                    |                          |
  OSINT Data         Score Normalization        Query Interface
  Scan Results       Confidence Weighting       Similarity Search
  Compliance Data    Temporal Decay             Clustering Engine

The architecture follows OTP principles with dedicated GenServer processes managing trait computation queues and an ETS-backed cache for high-throughput trait lookups. The computation pipeline uses GenStage for backpressure-aware processing of large evidence batches.

Trait Computation Pipeline

The trait computation pipeline transforms raw evidence from diverse platform sources into normalized trait scores through a multi-stage process. Understanding this pipeline is essential for interpreting trait scores and their confidence weights.

Evidence Collection. The first stage gathers evidence from all available sources for a given entity. For a domain entity, this might include Shodan scan results (open ports, services, TLS configuration), DNS records, certificate transparency logs, WHOIS data, and historical vulnerability scan results. The collection stage queries each source through the platform's OSINT adapter layer and assembles the raw evidence into a structured evidence set.

Feature Extraction. The second stage extracts trait-relevant features from the raw evidence. From Shodan data, it extracts features like "patch cadence" (estimated from service version dates), "TLS configuration strength" (cipher suite analysis), and "exposed service count." From DNS data, it extracts "DNSSEC adoption," "SPF/DKIM/DMARC configuration," and "DNS provider diversity." Each feature extraction function is a pure function that maps raw evidence to a numeric value with an associated confidence weight.

Score Normalization. The third stage normalizes extracted features into trait scores on a 0.0 to 1.0 scale. Normalization uses percentile ranking against a peer population -- an entity's "security posture" score of 0.78 means it ranks at the 78th percentile among entities of the same type. This relative scoring enables meaningful comparison across entities regardless of the absolute values of underlying features.

Confidence Weighting. Each trait score carries a confidence weight between 0.0 and 1.0 that reflects the quality and quantity of evidence supporting it. A trait computed from five independent sources with consistent results receives higher confidence than one computed from a single source. When evidence sources disagree, the confidence weight is reduced to reflect the uncertainty, following the NABLA Contradiction Preservation axiom.

Temporal Decay. Trait scores are time-weighted to ensure that recent evidence has more influence than historical observations. The decay function follows an exponential model with configurable half-life per trait dimension. Security posture traits have shorter half-lives (30 days) because security configurations change frequently, while compliance traits have longer half-lives (180 days) because compliance postures evolve slowly.

Key Features

Trait Computation

• Multi-dimensional entity profiling across 12+ trait axes
• Evidence-based trait scoring with confidence weights
• Temporal trait evolution tracking with configurable decay rates
• Confidence-weighted trait assignment following NABLA axioms

Trait Catalog

The platform defines the following standard trait dimensions:

Analysis Capabilities

• Entity similarity comparison via cosine distance on trait vectors
• Peer group identification and industry benchmarking
• Trait-based anomaly detection for behavioral drift alerts
• Predictive trait trajectory modeling using historical trends

Similarity and Clustering

The trait vector representation enables powerful analytical capabilities through vector space operations. Each entity's trait profile is a point in a multi-dimensional space, and the distance between points quantifies behavioral similarity.

Cosine similarity measures the angular distance between trait vectors, providing a scale-invariant similarity metric. Two entities with similar security postures and compliance behaviors will have high cosine similarity regardless of their absolute scores. This metric powers the peer discovery function, which identifies entities with behavioral profiles most similar to a given target.

Clustering groups entities with similar behavioral profiles into natural clusters using k-means or DBSCAN algorithms. These clusters often correspond to meaningful categories -- well-managed enterprises, neglected infrastructure, newly deployed systems -- that emerge from the data without requiring manual categorization. Cluster membership provides context for individual entity analysis: an entity that changes clusters may be undergoing significant operational changes.

Anomaly detection identifies entities whose trait profiles deviate significantly from their historical patterns or their peer group. A sudden drop in security posture for an entity that has historically maintained high scores triggers an anomaly alert, as does a gradual drift in compliance responsiveness across multiple assessment cycles.

Usage

# Compute entity traits from all available evidence
{:ok, traits} = PrismaticTraits.compute("example.com")
# => %{security_posture: 0.78, compliance: 0.82, risk_appetite: 0.45, ...}

# Compare two entities across all trait dimensions
{:ok, similarity} = PrismaticTraits.compare("entity_a.com", "entity_b.com")
# => %{score: 0.91, divergent_traits: [:risk_appetite], aligned_traits: [...]}

# Find peer entities with similar behavioral profiles
{:ok, peers} = PrismaticTraits.find_peers("example.com", threshold: 0.8)
# => [%{entity: "similar.org", similarity: 0.87}, ...]

# Track trait evolution over time
{:ok, history} = PrismaticTraits.history("example.com", window: :last_90_days)

Testing

mix test apps/prismatic_traits/test
mix test apps/prismatic_traits/test --cover

Integration Points

• Prismatic Detection Engine -- Trait vectors establish behavioral baselines for anomaly detection
• Prismatic Perimeter Core -- Trait scores feed into security rating computation
• Prismatic Signals -- Trait changes emit signals for downstream processing
• Prismatic Storage Core -- Trait data persisted through the unified storage adapter protocol

NABLA Compliance

Every trait score maintains full provenance traceability through the evidence chain, satisfying the Provenance Mandatory axiom. The confidence weighting system implements Signal Plurality by computing independent scores from multiple sources and combining them with explicit uncertainty. The Contradiction Preservation axiom is satisfied by reducing confidence weights rather than resolving contradictory evidence -- when Shodan and Censys report different service configurations for the same entity, both observations are preserved and the confidence weight is reduced to reflect the disagreement. Temporal decay implements the Time Decay axiom at the entity intelligence level, ensuring that stale evidence gradually loses influence over trait scores.

Performance

Related Components

• Prismatic OSINT Core -- Primary evidence source for trait computation
• Prismatic Algorithms -- Mathematical foundations for similarity and clustering
• Prismatic Quality Intelligence -- Applies similar trait-based profiling to code quality

Related Agents

• Evolution Analyzer Specialist -- Analyzes trait evolution patterns over time to identify behavioral drift and trend shifts
• Cross-Pollination Specialist -- Transfers trait computation techniques across security, compliance, and operational intelligence domains
• Elixir Architect -- Designs the OTP process topology for GenStage-based trait computation pipelines and ETS-backed caching

Related Capabilities

• NABLA Axioms -- Every trait score maintains full provenance traceability with confidence weights per epistemic axioms
• Intelligence Synthesis -- Multi-dimensional evidence fusion from OSINT, scans, and compliance data into normalized trait vectors
• Quality Gates -- Trait computation validation ensuring scores are bounded, confidence-weighted, and temporally decayed

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

• GitHub | GitLab | LinkedIn | Contact
• Developer Portal | Architecture | Meet the Creator