Definition

HAWKEYE is the Prismatic Platform's Visitor Intelligence system, a comprehensive security subsystem that performs real-time behavioral analysis of web visitors, correlates visitor patterns with threat intelligence feeds, and provides continuous security posture awareness. The system combines technical fingerprinting, behavioral profiling, session analysis, and Open Source Intelligence (OSINT) enrichment to classify visitors across a risk spectrum and detect potential threats before they can exploit vulnerabilities in the platform's attack surface.

At its core, HAWKEYE operates on the principle that meaningful security insight comes not from isolated data points but from the fusion of multiple behavioral and technical signals. A single HTTP request reveals little about intent, but when correlated with fingerprint data, navigation patterns, request timing, geolocation intelligence, and known threat indicators, a comprehensive visitor profile emerges. This multi-signal approach aligns with the NABLA Infinity framework's Signal Plurality axiom, which mandates a minimum of two independent signals before establishing any belief about visitor classification.

The name HAWKEYE reflects the system's role as the platform's vigilant observer -- maintaining constant surveillance of visitor activity while operating invisibly to legitimate users. Unlike traditional Web Application Firewalls (WAFs) that operate on static rule sets, HAWKEYE employs adaptive behavioral models that evolve as threat landscapes change, providing defense-in-depth through intelligence rather than mere pattern matching.

Overview

Visitor Intelligence represents a paradigm shift from reactive security (blocking known bad actors) to proactive security (understanding visitor intent through behavioral analysis). Traditional security tools operate at the network or application layer, inspecting individual requests against signature databases. HAWKEYE operates at the intelligence layer, building composite visitor profiles that enable nuanced risk assessment.

The system processes visitor interactions through a multi-stage pipeline. Raw HTTP traffic is first subjected to technical fingerprinting -- extracting browser characteristics, TLS parameters, HTTP header patterns, and JavaScript-derived device properties. This technical profile is then enriched with geolocation data, ASN information, IP reputation scores, and OSINT-derived threat intelligence. Behavioral analysis tracks navigation patterns, request timing distributions, form interaction sequences, and session anomalies to distinguish between human visitors, automated scrapers, vulnerability scanners, and sophisticated adversaries.

HAWKEYE's classification engine assigns visitors to risk categories (benign, suspicious, malicious, unknown) with associated confidence scores. These classifications feed into the platform's broader security ecosystem, providing visitor-level signals that inform access control decisions, rate limiting policies, and incident response workflows. The system's integration with the Color Team security architecture ensures that HAWKEYE findings are consumed by Blue Team defensive agents, correlated by Purple Team synthesis operations, and tested against Red Team adversarial scenarios.

Technical Details

Fingerprinting Architecture

HAWKEYE employs a layered fingerprinting approach that combines passive and active techniques to build robust visitor profiles resistant to spoofing:

Layer	Technique	Signals Extracted	Spoofing Difficulty
Network	TCP/IP analysis	OS fingerprint, MTU, TTL, window size	Medium
TLS	JA3/JA3S fingerprinting	TLS client hello parameters, cipher suites	High
HTTP	Header analysis	User-Agent, Accept-Language, encoding preferences	Low
Browser	JavaScript probing	Canvas fingerprint, WebGL renderer, fonts, plugins	Medium-High
Behavioral	Interaction analysis	Mouse movement, keystroke dynamics, scroll patterns	Very High

Signal Processing Pipeline

Raw Traffic --> Technical Fingerprint --> OSINT Enrichment --> Behavioral Analysis
                     |                        |                       |
                     v                        v                       v
              Device Profile          Threat Context           Intent Assessment
                     |                        |                       |
                     +------------------------+-----------------------+
                                              |
                                              v
                                    Composite Risk Score
                                    (confidence-weighted)
                                              |
                                              v
                                    Classification Decision
                                    [benign|suspicious|malicious|unknown]

Behavioral Profiling Models

HAWKEYE uses statistical models to distinguish between visitor categories based on behavioral patterns:

Behavior	Human Pattern	Bot Pattern	Scanner Pattern
Request timing	Variable, Poisson-distributed	Fixed intervals, burst patterns	Rapid sequential
Navigation	Follows link structure, backtracking	Systematic crawl, no backtracking	Targeted endpoint probing
Mouse movement	Bezier curves, micro-corrections	None or linear	None
Session duration	Minutes to hours, variable	Seconds to minutes, predictable	Seconds, systematic
Error responses	Rare, accidental	Moderate, systematic	High, intentional

Implementation in Prismatic Platform

HAWKEYE is implemented in the prismatic_visitor_intelligence application within the Prismatic Platform's umbrella architecture. The system leverages OTP design patterns for concurrent visitor processing, fault-tolerant data collection, and real-time classification:

defmodule PrismaticVisitorIntelligence.Classifier do
  @moduledoc """
  Visitor classification engine combining technical fingerprints,
  behavioral signals, and OSINT enrichment into risk assessments.
  """

  use GenServer

  alias PrismaticVisitorIntelligence.Fingerprint
  alias PrismaticVisitorIntelligence.BehaviorAnalyzer
  alias PrismaticVisitorIntelligence.OSINTEnricher
  alias PrismaticVisitorIntelligence.RiskScorer

  @type risk_category :: :benign | :suspicious | :malicious | :unknown
  @type classification :: %{
    category: risk_category(),
    confidence: float(),
    signals: list(map()),
    fingerprint_id: String.t()
  }

  @spec classify_visitor(map()) :: {:ok, classification()} | {:error, term()}
  def classify_visitor(visitor_data) do
    with {:ok, fingerprint} <- Fingerprint.extract(visitor_data),
         {:ok, enrichment} <- OSINTEnricher.enrich(fingerprint),
         {:ok, behavior} <- BehaviorAnalyzer.analyze(visitor_data.session),
         {:ok, score} <- RiskScorer.compute(fingerprint, enrichment, behavior) do
      classification = %{
        category: categorize(score),
        confidence: score.confidence,
        signals: score.contributing_signals,
        fingerprint_id: fingerprint.id
      }

      emit_telemetry(:classification, classification)
      {:ok, classification}
    end
  end

  defp categorize(%{risk_score: score}) when score < 0.2, do: :benign
  defp categorize(%{risk_score: score}) when score < 0.5, do: :suspicious
  defp categorize(%{risk_score: score}) when score < 0.8, do: :malicious
  defp categorize(_score), do: :unknown

  defp emit_telemetry(event, data) do
    :telemetry.execute(
      [:prismatic, :visitor_intelligence, event],
      %{timestamp: System.monotonic_time()},
      data
    )
  end
end

HAWKEYE implements privacy-by-design principles to comply with GDPR requirements while maintaining intelligence effectiveness:

defmodule PrismaticVisitorIntelligence.Privacy do
  @moduledoc """
  GDPR-compliant data handling for visitor intelligence.
  Implements data minimization, retention controls, and anonymization.
  """

  @retention_period_days 30
  @anonymization_fields [:ip_address, :user_agent, :cookies]

  @spec anonymize_visitor_data(map()) :: map()
  def anonymize_visitor_data(visitor_data) do
    visitor_data
    |> hash_identifiers()
    |> strip_pii()
    |> apply_retention_metadata()
  end

  @spec purge_expired_records() :: {:ok, non_neg_integer()}
  def purge_expired_records do
    cutoff = DateTime.add(DateTime.utc_now(), -@retention_period_days, :day)

    {count, _} =
      PrismaticVisitorIntelligence.Repo.delete_all(
        from(v in VisitorRecord, where: v.inserted_at < ^cutoff)
      )

    {:ok, count}
  end
end

Comparison with Alternatives

Feature	HAWKEYE	Traditional WAF	Commercial Bot Detection	SIEM Integration
Behavioral analysis	Multi-signal fusion with confidence scoring	Rule-based pattern matching	Machine learning models	Log correlation
OSINT enrichment	250+ providers via GARDEN	IP reputation lists only	Limited threat feeds	External feed integration
Privacy compliance	GDPR-by-design, data minimization	Varies by vendor	Varies, often opaque	Depends on SIEM
Integration depth	Native OTP, Color Team, NABLA	Plugin/middleware	SDK/JavaScript tag	Log forwarding
Real-time classification	Sub-second, confidence-weighted	Millisecond, binary allow/deny	Seconds, score-based	Minutes to hours
Epistemic rigor	NABLA axiom compliance, provenance tracking	None	Proprietary models	Correlation rules

HAWKEYE's primary differentiator is its integration with the Prismatic Platform's epistemic infrastructure. Unlike commercial alternatives that produce opaque risk scores, HAWKEYE classifications carry full provenance metadata, confidence levels, and contributing signal attribution -- enabling analysts to understand not just what was decided but why, satisfying the NABLA framework's Provenance Mandatory axiom.

Best Practices

Signal Plurality Compliance: Never classify a visitor based on a single signal. HAWKEYE enforces the NABLA Signal Plurality axiom by requiring at least two independent signals before establishing any risk assessment. A suspicious IP address alone is insufficient; it must be correlated with behavioral anomalies, fingerprint inconsistencies, or OSINT threat indicators.
Graduated Response: Implement proportional responses to risk classifications. Benign visitors receive unrestricted access, suspicious visitors face enhanced monitoring and CAPTCHA challenges, and malicious visitors are rate-limited or blocked. Avoid binary allow/deny decisions that create false positive cascading.
Continuous Model Calibration: Regularly validate classification accuracy against ground truth data. False positive rates above 1% indicate model drift requiring recalibration. The Quality Floor Guardian monitors classification accuracy as a quality metric.
Privacy-First Architecture: Collect only the minimum data necessary for classification. Anonymize or hash personal identifiers at the collection point, not as an afterthought. Implement automatic data purging based on configurable retention periods.
OSINT Source Diversity: Maintain diverse OSINT enrichment sources to avoid single-source dependency. The GARDEN knowledge base provides access to 250+ providers, but active source rotation ensures continued intelligence quality even when individual providers experience outages or data quality degradation.

Use Cases

Attack Surface Protection: HAWKEYE identifies reconnaissance activity (port scanning, directory enumeration, vulnerability probing) by detecting scanner behavioral patterns. Early detection enables proactive defense before exploitation attempts occur.
Bot Management: Distinguishes between beneficial bots (search engine crawlers, monitoring services) and malicious bots (scrapers, credential stuffers, spam bots) through behavioral fingerprinting that goes beyond User-Agent string analysis.
Threat Intelligence Correlation: Visitor IP addresses, ASNs, and behavioral patterns are correlated with known threat actor infrastructure through OSINT enrichment, enabling attribution of reconnaissance to specific threat groups or campaigns.
Compliance Monitoring: HAWKEYE provides audit trails of visitor activity that satisfy NIS2 and ISO 27001 requirements for access monitoring and incident detection. Classification decisions are logged with full provenance for regulatory review.
Blue Team Signal Feed: HAWKEYE's real-time visitor classifications feed directly into the Blue Team's blue-signal-aggregator agent, providing the visitor intelligence dimension of the platform's multi-layered defensive posture. Suspicious visitor patterns trigger Blue Team investigation workflows.
Security Rating Input: Visitor intelligence contributes to the platform's overall security rating calculation, where the volume and sophistication of detected threats against an asset influences its risk score in the Prismatic Perimeter EASM system.

EASM - External attack surface management complementing HAWKEYE's visitor-facing intelligence
OSINT - Intelligence methodology providing visitor data enrichment sources
Threat Intelligence - Structured threat data providing visitor classification context
Blue Team - Defensive team consuming HAWKEYE's visitor signal feed
Security Rating - Overall security posture score incorporating visitor intelligence
NABLA Infinity - Epistemic framework governing classification confidence requirements
Signal Plurality - NABLA axiom requiring multiple signals for visitor classification
Color Teams - Security operations framework integrating HAWKEYE intelligence
GDPR - Privacy regulation governing HAWKEYE's data handling practices

Advanced Fingerprinting Techniques

HAWKEYE's fingerprinting capabilities extend beyond traditional browser fingerprinting to create robust visitor identification resistant to evasion attempts.

Canvas and WebGL Fingerprinting

defmodule PrismaticVisitorIntelligence.BrowserFingerprint do
  @moduledoc """
  Advanced browser fingerprinting using canvas rendering and WebGL parameters
  to create unique device signatures.
  """

  @spec extract_canvas_fingerprint(map()) :: {:ok, String.t()} | {:error, term()}
  def extract_canvas_fingerprint(browser_data) do
    canvas_operations = [
      "fillText('Prismatic Platform Test', 10, 50)",
      "arc(100, 100, 50, 0, 2 * Math.PI)",
      "beginPath(); moveTo(0,0); lineTo(50,50); stroke()"
    ]

    canvas_hash =
      browser_data
      |> Map.get(:canvas_results, [])
      |> Enum.map(&hash_canvas_operation/1)
      |> Enum.join(":")
      |> sha256()

    webgl_parameters = extract_webgl_parameters(browser_data)

    composite_fingerprint = "#{canvas_hash}:#{webgl_parameters}"
    {:ok, composite_fingerprint}
  end

  defp extract_webgl_parameters(browser_data) do
    webgl_data = Map.get(browser_data, :webgl, %{})

    %{
      renderer: Map.get(webgl_data, :renderer, "unknown"),
      vendor: Map.get(webgl_data, :vendor, "unknown"),
      version: Map.get(webgl_data, :version, "unknown"),
      extensions: Map.get(webgl_data, :extensions, []) |> Enum.sort(),
      max_texture_size: Map.get(webgl_data, :max_texture_size, 0)
    }
    |> Jason.encode!()
    |> sha256()
  end
end

Network-Level Fingerprinting

defmodule PrismaticVisitorIntelligence.NetworkFingerprint do
  @moduledoc """
  TCP/IP and TLS-level fingerprinting for robust visitor identification
  even when browser fingerprints are spoofed.
  """

  @spec analyze_tcp_fingerprint(map()) :: map()
  def analyze_tcp_fingerprint(connection_data) do
    %{
      tcp_window_size: Map.get(connection_data, :window_size),
      mtu_discovery: analyze_mtu(connection_data),
      ttl_analysis: analyze_ttl_pattern(connection_data),
      tcp_options: extract_tcp_options(connection_data),
      timestamp_behavior: analyze_tcp_timestamps(connection_data)
    }
  end

  @spec extract_ja3_fingerprint(map()) :: String.t()
  def extract_ja3_fingerprint(tls_data) do
    # JA3 fingerprint: Version,Ciphers,Extensions,EllipticCurves,EllipticCurvePointFormats
    version = Map.get(tls_data, :version, "")
    ciphers = Map.get(tls_data, :cipher_suites, []) |> Enum.join("-")
    extensions = Map.get(tls_data, :extensions, []) |> Enum.sort() |> Enum.join("-")
    curves = Map.get(tls_data, :elliptic_curves, []) |> Enum.join("-")
    point_formats = Map.get(tls_data, :ec_point_formats, []) |> Enum.join("-")

    ja3_string = "#{version},#{ciphers},#{extensions},#{curves},#{point_formats}"
    Base.encode16(:crypto.hash(:md5, ja3_string), case: :lower)
  end

  defp analyze_mtu(%{packets: packets}) do
    packets
    |> Enum.map(&Map.get(&1, :size, 0))
    |> Enum.max()
    |> case do
      size when size <= 1500 -> :ethernet
      size when size <= 9000 -> :jumbo_frame
      _ -> :custom
    end
  end
end

Machine Learning Models

HAWKEYE employs several machine learning models for different aspects of visitor classification:

Behavioral Anomaly Detection

defmodule PrismaticVisitorIntelligence.BehaviorML do
  @moduledoc """
  Machine learning models for detecting behavioral anomalies
  in visitor interaction patterns.
  """

  @spec train_anomaly_detector(list(map())) :: {:ok, map()} | {:error, term()}
  def train_anomaly_detector(training_data) do
    # Feature extraction for behavioral analysis
    features = Enum.map(training_data, &extract_behavioral_features/1)

    # One-class SVM for anomaly detection
    model_config = %{
      algorithm: :one_class_svm,
      nu: 0.05,  # Expected anomaly rate
      kernel: :rbf,
      gamma: :scale
    }

    case MLTraining.train(features, model_config) do
      {:ok, trained_model} ->
        validation_score = cross_validate(features, trained_model)

        model_metadata = %{
          model: trained_model,
          training_size: length(features),
          validation_score: validation_score,
          trained_at: DateTime.utc_now(),
          feature_count: length(hd(features))
        }

        {:ok, model_metadata}

      error ->
        error
    end
  end

  defp extract_behavioral_features(session_data) do
    %{
      request_interval_mean: calculate_interval_statistics(session_data, :mean),
      request_interval_stddev: calculate_interval_statistics(session_data, :stddev),
      navigation_depth: Map.get(session_data, :max_depth, 0),
      unique_endpoints: session_data |> Map.get(:endpoints, []) |> Enum.uniq() |> length(),
      error_rate: calculate_error_rate(session_data),
      session_duration: Map.get(session_data, :duration_seconds, 0),
      mouse_movement_entropy: calculate_mouse_entropy(session_data),
      keyboard_typing_cadence: analyze_typing_patterns(session_data)
    }
    |> Map.values()
  end
end

Performance and Scaling Characteristics

Throughput Benchmarks

HAWKEYE has been benchmarked under various load conditions within the Prismatic Platform environment:

Metric	Load Level	Performance	Resource Usage
Classifications/second	Light (100 visitors/min)	50 classifications/sec	2% CPU, 50MB RAM
Classifications/second	Medium (1K visitors/min)	400 classifications/sec	15% CPU, 200MB RAM
Classifications/second	Heavy (10K visitors/min)	2,500 classifications/sec	60% CPU, 800MB RAM
Mean classification time	All levels	1.2ms	-
P99 classification time	All levels	8.5ms	-
Memory per visitor profile	-	2.4KB	ETS storage

Horizontal Scaling Architecture

defmodule PrismaticVisitorIntelligence.ClusterCoordinator do
  @moduledoc """
  Coordinates HAWKEYE operations across multiple nodes
  for horizontal scaling of visitor intelligence.
  """

  use GenServer

  @spec start_link(keyword()) :: GenServer.on_start()
  def start_link(opts) do
    GenServer.start_link(__MODULE__, opts, name: __MODULE__)
  end

  @spec distribute_classification(String.t(), map()) :: :ok
  def distribute_classification(visitor_id, visitor_data) do
    target_node = select_processing_node(visitor_id)

    case target_node do
      node when node == node() ->
        # Process locally
        PrismaticVisitorIntelligence.classify_visitor_local(visitor_data)

      remote_node ->
        # Delegate to remote node
        :rpc.cast(remote_node, PrismaticVisitorIntelligence, :classify_visitor_local, [visitor_data])
    end

    :ok
  end

  defp select_processing_node(visitor_id) do
    # Consistent hashing for visitor distribution
    hash = :erlang.phash2(visitor_id)
    available_nodes = [node() | Node.list()]
    node_index = rem(hash, length(available_nodes))
    Enum.at(available_nodes, node_index)
  end

  @impl true
  def init(_opts) do
    # Setup node monitoring
    :net_kernel.monitor_nodes(true)

    state = %{
      active_nodes: [node() | Node.list()],
      node_capacities: %{},
      load_balancer: :consistent_hash
    }

    {:ok, state}
  end
end

Compliance and Auditing

defmodule PrismaticVisitorIntelligence.GDPRCompliance do
  @moduledoc """
  GDPR compliance implementation for visitor intelligence data handling.
  Provides data subject rights, consent management, and audit trails.
  """

  @spec handle_data_subject_request(String.t(), atom()) :: {:ok, map()} | {:error, term()}
  def handle_data_subject_request(visitor_id, request_type) do
    case request_type do
      :access ->
        retrieve_visitor_data(visitor_id)

      :deletion ->
        delete_visitor_data(visitor_id)

      :rectification ->
        {:error, :not_applicable}  # Behavioral data cannot be rectified

      :portability ->
        export_visitor_data(visitor_id)

      _ ->
        {:error, :invalid_request_type}
    end
  end

  @spec anonymize_for_analytics(map()) :: map()
  def anonymize_for_analytics(visitor_data) do
    # Remove direct identifiers, keep behavioral patterns
    visitor_data
    |> Map.drop([:ip_address, :user_agent, :session_id])
    |> Map.put(:visitor_hash, hash_visitor_identity(visitor_data))
    |> Map.put(:anonymized_at, DateTime.utc_now())
  end

  defp retrieve_visitor_data(visitor_id) do
    with {:ok, profile} <- PrismaticStorage.get(:visitor_profiles, visitor_id),
         {:ok, classifications} <- get_visitor_classifications(visitor_id),
         {:ok, sessions} <- get_visitor_sessions(visitor_id) do

      complete_record = %{
        profile: profile,
        classifications: classifications,
        sessions: sessions,
        data_sources: [:behavioral, :fingerprint, :osint],
        retention_period: "30 days",
        legal_basis: "legitimate_interest"
      }

      {:ok, complete_record}
    end
  end
end

Future Enhancements and Roadmap

Advanced Behavioral Modeling

Planned enhancements include deep learning models for more sophisticated behavioral analysis:

defmodule PrismaticVisitorIntelligence.DeepLearning do
  @moduledoc """
  Future: Deep learning models for advanced behavioral pattern recognition
  using transformer architectures for sequence analysis.
  """

  # Planned implementation for behavioral sequence analysis
  @spec train_behavioral_transformer(list()) :: {:ok, map()}
  def train_behavioral_transformer(behavioral_sequences) do
    # Implementation planned for Q2 2026
    {:ok, %{status: :planned}}
  end
end

Federated Learning Integration

Future versions will support federated learning across multiple Prismatic Platform deployments while preserving privacy.

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

GitHub | GitLab | LinkedIn | Contact
Developer Portal | Architecture | Meet the Creator

HAWKEYE

Definition

Overview

Technical Details

Fingerprinting Architecture

Signal Processing Pipeline

Behavioral Profiling Models

Implementation in Prismatic Platform

Comparison with Alternatives

Best Practices

Use Cases

See Also

Advanced Fingerprinting Techniques

Canvas and WebGL Fingerprinting

Network-Level Fingerprinting

Machine Learning Models

Behavioral Anomaly Detection

Performance and Scaling Characteristics

Throughput Benchmarks

Horizontal Scaling Architecture

Compliance and Auditing

Future Enhancements and Roadmap

Advanced Behavioral Modeling

Federated Learning Integration

Connect & Contribute

Glossary

Related Terms

HAWKEYE

Definition

Overview

Technical Details

Fingerprinting Architecture

Signal Processing Pipeline

Behavioral Profiling Models

Implementation in Prismatic Platform

GDPR-Compliant Data Handling

Comparison with Alternatives

Best Practices

Use Cases

Related Concepts

See Also

Advanced Fingerprinting Techniques

Canvas and WebGL Fingerprinting

Network-Level Fingerprinting

Machine Learning Models

Behavioral Anomaly Detection

Performance and Scaling Characteristics

Throughput Benchmarks

Horizontal Scaling Architecture

Compliance and Auditing

GDPR Compliance Implementation

Future Enhancements and Roadmap

Advanced Behavioral Modeling

Federated Learning Integration

Connect & Contribute

Glossary

Related Terms