Intelligence Fusion

osint

Intelligence Fusion

Definition

Intelligence Fusion is the analytical discipline of correlating information from multiple independent sources, assigning confidence scores based on source reliability and corroboration strength, resolving contradictions through structured methodology, and producing unified intelligence products that represent the best available understanding of a subject. Unlike simple data aggregation (combining all available information into a single view), fusion applies structured analytical techniques that weigh evidence quality, assess source independence, track information provenance, and explicitly handle conflicting signals -- producing intelligence products where the whole is demonstrably greater than the sum of its parts.

The fusion process operates on a fundamental premise: no single source provides a complete or perfectly reliable picture of any subject. Every data source has inherent biases, coverage gaps, temporal limitations, and error rates. Intelligence fusion compensates for these individual weaknesses through source diversity, requiring that conclusions be supported by converging evidence from independent collection methods. A domain's association with a suspicious IP address observed by Shodan carries moderate confidence; when corroborated by anomalous certificate patterns from Censys and behavioral indicators from GreyNoise, the confidence in malicious association increases substantially.

The discipline has deep roots in military and national intelligence analysis, where the fusion of signals intelligence (SIGINT), human intelligence (HUMINT), imagery intelligence (IMINT), and open source intelligence (OSINT) has been practiced for decades. In the cybersecurity domain, intelligence fusion applies similar principles to correlate network telemetry, threat feeds, vulnerability data, asset inventories, and behavioral analytics into actionable security intelligence. The structured analytical techniques used -- Analysis of Competing Hypotheses, Structured Analytic Techniques, Bayesian updating -- ensure that fusion outputs are rigorous, transparent, and auditable.

Overview

The intelligence fusion lifecycle consists of five interconnected stages that transform raw data into actionable intelligence:

Collection Planning

Effective fusion begins with identifying what intelligence gaps exist and which sources can address them. Collection planning maps intelligence requirements to available sources, ensuring diverse coverage and identifying single-source dependencies that create blind spots.

Source Integration

Raw data from heterogeneous sources must be normalized into a common format before correlation is possible. Source integration handles format differences, semantic mapping, temporal alignment, and deduplication while preserving source attribution metadata.

Correlation and Analysis

The core of the fusion process involves identifying relationships between normalized data elements across sources. Correlation techniques range from simple attribute matching (same IP address in multiple feeds) to complex behavioral pattern recognition (similar attack methodologies across different campaigns).

Confidence Assessment

Every fused intelligence product receives a confidence score reflecting the strength of supporting evidence, source reliability, temporal freshness, and corroboration depth. Confidence scores enable downstream consumers to calibrate their responses proportionally to the certainty of the intelligence.

Product Dissemination

Fused intelligence products are formatted and delivered to consumers based on their roles and requirements. Tactical consumers need real-time alerts with minimal context; strategic consumers need comprehensive assessments with full analytical detail.

Technical Details

Fusion Levels

Intelligence fusion operates at multiple levels of analytical sophistication:

LevelDescriptionInputOutputExample
Level 0: Sub-SourceSingle-source data refinementRaw sensor dataCleaned, normalized dataDNS record parsing
Level 1: ObjectMulti-source entity resolutionNormalized data streamsUnified entity profilesMerging Shodan + Censys host data
Level 2: SituationRelationship and pattern analysisEntity profilesSituational assessmentsAttack surface topology
Level 3: ImpactRisk and consequence analysisSituational assessmentsImpact predictionsSecurity rating computation
Level 4: ProcessMeta-analysis of fusion effectivenessFusion outputs + ground truthProcess improvementsCollection gap identification

Confidence Scoring Framework

FactorWeightDescriptionExample
Source reliability30%Historical accuracy of the data sourceCensys: 0.95, unknown source: 0.50
Corroboration25%Number of independent sources confirming3 sources: 0.90, 1 source: 0.60
Temporal freshness20%Recency of the observation< 24h: 1.0, > 30d: 0.50
Internal consistency15%Absence of self-contradictionsConsistent: 1.0, contradictory: 0.30
Collection method10%Reliability of the collection techniqueActive scan: 0.95, passive: 0.80

Contradiction Handling

Source A: "Domain X resolves to IP 1.2.3.4" (confidence: 0.90, observed: 2h ago)
Source B: "Domain X resolves to IP 5.6.7.8" (confidence: 0.85, observed: 1d ago)

Fusion Output:
  - Primary: Domain X -> 1.2.3.4 (confidence: 0.90, more recent)
  - Historical: Domain X -> 5.6.7.8 (confidence: 0.85, preserved as historical)
  - Assessment: Possible DNS migration or load balancing
  - CONTRADICTION PRESERVED per NABLA Axiom 2
  - Both records retained with temporal context

Implementation in Prismatic Platform

Within the Prismatic Platform, Intelligence Fusion is governed by NABLA Infinity's axioms and implemented through a structured fusion pipeline:

defmodule PrismaticIntelligence.FusionEngine do
  @moduledoc """
  Multi-source intelligence fusion engine implementing NABLA Infinity
  axioms for evidence correlation, confidence scoring, and
  contradiction preservation.
  """

  alias PrismaticIntelligence.SourceIntegrator
  alias PrismaticIntelligence.ConfidenceScorer
  alias PrismaticIntelligence.ContradictionPreserver

  @minimum_sources 2  # NABLA Signal Plurality axiom
  @critical_confidence_threshold 0.95
  @standard_confidence_threshold 0.80

  @type intelligence_product :: %{
    subject: String.t(),
    assessment: map(),
    confidence: float(),
    sources: list(map()),
    contradictions: list(map()),
    provenance: map()
  }

  @spec fuse(String.t(), list(map())) :: {:ok, intelligence_product()} | {:error, term()}
  def fuse(subject, source_data) when length(source_data) >= @minimum_sources do
    with {:ok, normalized} <- SourceIntegrator.normalize(source_data),
         {:ok, correlated} <- correlate_signals(normalized),
         {:ok, contradictions} <- ContradictionPreserver.identify(correlated),
         {:ok, confidence} <- ConfidenceScorer.compute(correlated, contradictions),
         {:ok, product} <- build_product(subject, correlated, confidence, contradictions) do
      emit_fusion_telemetry(product)
      {:ok, product}
    end
  end

  def fuse(_subject, source_data) when length(source_data) < @minimum_sources do
    {:error, :insufficient_sources_for_signal_plurality}
  end

  defp correlate_signals(normalized_data) do
    correlated =
      normalized_data
      |> group_by_entity()
      |> Enum.map(&merge_entity_observations/1)
      |> Enum.map(&compute_entity_confidence/1)

    {:ok, correlated}
  end

  defp build_product(subject, correlated, confidence, contradictions) do
    product = %{
      subject: subject,
      assessment: synthesize_assessment(correlated),
      confidence: confidence,
      sources: extract_source_attribution(correlated),
      contradictions: contradictions,
      provenance: %{
        fused_at: DateTime.utc_now(),
        source_count: length(correlated),
        fusion_method: :multi_source_correlation,
        nabla_compliant: true
      }
    }

    {:ok, product}
  end
end

Source Integration Pipeline

defmodule PrismaticIntelligence.SourceIntegrator do
  @moduledoc """
  Normalizes heterogeneous OSINT source data into a common
  format for fusion processing. Preserves source attribution
  per NABLA Provenance Mandatory axiom.
  """

  @spec normalize(list(map())) :: {:ok, list(map())}
  def normalize(source_data) do
    normalized =
      source_data
      |> Enum.map(&normalize_source/1)
      |> Enum.map(&attach_provenance/1)
      |> Enum.map(&apply_time_decay/1)

    {:ok, normalized}
  end

  defp normalize_source(%{source: :shodan} = data) do
    %{
      entity_type: :host,
      identifiers: %{ip: data.ip, port: data.port},
      attributes: extract_shodan_attributes(data),
      observed_at: data.timestamp,
      source: :shodan,
      source_reliability: 0.90
    }
  end

  defp normalize_source(%{source: :censys} = data) do
    %{
      entity_type: :host,
      identifiers: %{ip: data.ip, certificate: data.cert_fingerprint},
      attributes: extract_censys_attributes(data),
      observed_at: data.timestamp,
      source: :censys,
      source_reliability: 0.92
    }
  end

  defp apply_time_decay(record) do
    age_days = DateTime.diff(DateTime.utc_now(), record.observed_at, :day)
    decay_factor = max(0.1, 1.0 - age_days * 0.01)
    Map.update!(record, :source_reliability, &(&1 * decay_factor))
  end
end

Comparison with Alternatives

ApproachNABLA-Governed FusionTraditional SIEM CorrelationThreat Intel PlatformManual Analysis
Contradiction handlingPreserved per axiomResolved (highest confidence wins)Vendor-dependentAnalyst judgment
Confidence scoringMulti-factor, NABLA-compliantRule-basedProprietary scoringSubjective
Source pluralityEnforced (minimum 2 sources)OptionalVariesBest practice
Provenance trackingMandatory per axiomLog-basedSource attributionDocumentation
Time decayAutomatic, configurableManual thresholdVariesManual assessment
Epistemic rigorTrinity Gate verificationNot applicableNot applicableAnalyst-dependent

Best Practices

  1. Enforce Source Plurality: Never form intelligence assessments from a single source. The NABLA Signal Plurality axiom exists because single-source conclusions are inherently fragile -- subject to source errors, biases, and blind spots. Require minimum two independent sources for any actionable intelligence product.

  2. Preserve Contradictions: When sources disagree, preserve both positions with their respective confidence scores and temporal context. Silently discarding contradictory evidence (the "cherry picking" anti-pattern) produces intelligence products that appear more certain than the evidence warrants, leading to overconfident decisions.

  3. Track Provenance End-to-End: Every claim in a fused intelligence product must be traceable to its originating source(s), collection method, and observation time. Provenance tracking enables consumers to assess intelligence quality and enables analysts to investigate when fused products prove incorrect.

  4. Apply Time Decay: Intelligence degrades over time. Infrastructure changes, threats evolve, and organizational relationships shift. Apply configurable time decay to source observations, reducing confidence as observations age without reconfirmation.

  5. Calibrate Confidence Thresholds: Match confidence requirements to decision criticality. Critical decisions (security ratings, compliance assessments) require 0.95 confidence with Trinity Gate verification. Exploratory analysis can proceed with 0.60 confidence. Mismatched thresholds cause either analysis paralysis or premature action.

  6. Diversify Collection Methods: Source independence requires method independence. Two sources that ultimately derive their data from the same collection infrastructure do not provide genuine corroboration. Map source dependencies to identify hidden single points of failure in the collection architecture.

Use Cases

  • EASM Asset Discovery: Intelligence fusion correlates DNS records, certificate transparency logs, Shodan scans, and WHOIS data to build comprehensive attack surface maps. Each asset's existence and properties are confirmed by multiple independent observations.

  • Security Rating Computation: Prismatic Perimeter security ratings (A-F) are computed through fusion of multiple security signal categories, with each contributing factor confidence-weighted and provenance-tracked per NABLA requirements.

  • Sanctions Screening: Entity names from business records are fused with sanctions lists, adverse media, and politically exposed person (PEP) databases. Fuzzy entity matching across languages and transliterations requires fusion to resolve identity ambiguity.

  • Threat Actor Attribution: Behavioral patterns, infrastructure indicators, and tactical signatures from multiple monitoring points are fused to attribute malicious activity to threat groups or campaigns.

  • Supply Chain Risk Assessment: Organization relationships, certificate sharing patterns, hosting dependencies, and vulnerability exposure data are fused to assess supply chain risk for monitored entities.

See Also

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

Back to Glossary