AnubisX Framework
A Formal Framework for Behavioral Digital Attribution
AnubisX is an original research framework that formalizes the problem of attributing digital artifacts to their human source through a unified theoretical foundation, mathematical formalism, algorithmic catalog, and open-source prototype.
Scientific Status
The AnubisX framework comprises multiple interdependent components at different stages of formalization and validation. The table below summarizes the current scientific status of each major component as of v3.0.0. Statuses follow a five-stage lifecycle: PRE-SPECIFIED (requirements defined), PROPOSED (formalism introduced), SPECIFIED (fully documented), ESTABLISHED (formal proof or consistent evidence), IMPLEMENTED (prototype exists), and COMPLETED (all criteria satisfied).
| Component | Status |
|---|---|
| Axiomatic Foundation (16 axioms) | PROPOSED |
| Cognitive Centroid Theory | PROPOSED |
| Mathematical Framework (292 objects) | ESTABLISHED |
| Algorithm Catalog (37 algorithms) | 33 ESTABLISHED, 2 PROPOSED, 2 TBD |
| Six-Layer Architecture | SPECIFIED |
| Stylometric Prototype (Anubis Twitter v2.5) | IMPLEMENTED |
| Experimental Validation (15 experiments) | COMPLETED (proof-of-concept) |
| Full Validation Suite (31 criteria, 4 tiers) | PRE-SPECIFIED |
Research Scope
Behavioral digital attribution addresses the problem of determining the human source of digital actions and communications. Current attribution methods rely on technical identifiers — IP addresses, device fingerprints, account credentials — that sophisticated adversaries can spoof, eliminate, or obscure. AnubisX approaches attribution through behavioral signals: patterns in how individuals write, communicate, interact with systems, and generate digital artifacts that are difficult to consciously control.
The framework is designed to be modality-agnostic, platform-independent, and grounded in formal reasoning under uncertainty.
Framework Components
The AnubisX framework is organized into six principal components that together form a complete methodology for behavioral digital attribution:
- Axiomatic Foundation (16 axioms). Six groups of axioms governing attribution reasoning: existence, distinctness, stability, observability, comparability, and accountability. These provide the logical underpinning for all subsequent framework elements.
- Cognitive Centroid Theory. A formal model of behavioral identity as an asymptotic attractor in high-dimensional feature space. The Cognitive Centroid represents the idealized behavioral signature of an individual, toward which empirical observations converge over time and across contexts.
- Mathematical Framework (292 objects, 24 categories). A comprehensive formal apparatus spanning vector spaces, probability distributions, information-theoretic measures, graph-theoretic constructs, and decision-theoretic criteria for attribution under uncertainty.
- Algorithm Catalog (37 algorithms, 5 modalities). Implementable procedures for feature extraction, profile construction, similarity computation, evidence evaluation, and decision fusion across stylometric, chrono-profiling, terminal profiling, network analysis, and media forensics modalities.
- Six-Layer Architecture. A modular architectural pattern comprising Data, Feature, Profile, Comparison, Evidence, and Decision layers. Each layer exposes a well-defined interface, enabling independent implementation, testing, and substitution of components.
- Validation Infrastructure (31 criteria, 4 tiers). A pre-specified four-tier validation framework with a priori thresholds for unit, component, system, and operational verification. Designed to prevent post-hoc justification and ensure reproducible evaluation.
Behavioral Modalities
The framework defines five behavioral modalities, each capturing a distinct class of behavioral signal. The stylometric modality is the most mature, with a validated prototype implementation.
| Modality | Behavioral Signal | Algorithms | Status |
|---|---|---|---|
| Stylometric | Vocabulary, syntax, discourse patterns | ALG-001–004 | VALIDATED |
| Chrono-Profiling | Circadian rhythms, temporal activity patterns | ALG-005–008 | FUTURE |
| Terminal Profiling | Command sequences, navigation patterns | ALG-009–012 | FUTURE |
| Network Analysis | Graph topology, community structure | ALG-013–016 | FUTURE |
| Media Forensics | File structure, metadata, naming conventions | ALG-017–020 | FUTURE |
Six-Layer Architecture
Validation Summary
The framework defines 31 acceptance criteria across four verification tiers, with thresholds specified a priori to prevent post-hoc justification.
| Tier | Focus | Criteria | Key Thresholds |
|---|---|---|---|
| Tier 1 | Unit | 6 | 100% pass on synthetic tests |
| Tier 2 | Component | 8 | Variance reduction ≥ 30%, d' ≥ 1.50 |
| Tier 3 | System | 10 | AUC ≥ 0.95, EER ≤ 0.08, Rank-1 ≥ 0.90 |
| Tier 4 | Operational | 7 | FAR drift < 0.1%/month, throughput ≥ 100/s |
Experimental Results
Proof-of-concept validation conducted on 31 Egyptian Twitter accounts (EXP-001 through EXP-015). Key results from the stylometric prototype are summarized below.
| Experiment | Metric | Result |
|---|---|---|
| EXP-001 | Fingerprint dimensional consistency | 31/31 accounts at 372-dim (100%) |
| EXP-002 | Cross-user similarity distribution | μ = 0.697, σ = 0.105, N = 465 pairs |
| EXP-006 | FAISS search latency | 6–8 µs per query |
| EXP-004 | Lexical feature discriminability | Variation across 31 users confirmed |
| EXP-015 | Egyptian content verification | 144 keywords, 58 slang expressions, 12 locations |
Research Origin
The AnubisX framework is the work of an independent researcher and is not affiliated with any academic institution, government agency, or commercial entity. The framework was conceived, developed, and documented solely by its author as an original contribution to the field of behavioral digital attribution.
Author. Ahmed Awad (nullc0d3) — independent security researcher, OSINT practitioner, and author of the AnubisX Framework. Research focus: behavioral digital attribution, formal methods for attribution under uncertainty, stylometric analysis, and multi-modal behavioral profiling.
How to Cite
APA Format
Awad, A. (2026). AnubisX: A Formal Framework for Behavioral Digital Attribution (Version 3.0.0) [Computer software]. https://doi.org/10.5281/zenodo.21393392
Frequently Asked Questions
What is behavioral digital attribution?
Behavioral digital attribution is the process of linking digital artifacts — text, commands, network activity, files — to their human source based on behavioral patterns rather than technical identifiers. It relies on the premise that individuals exhibit consistent, distinctive patterns in how they generate digital content, and that these patterns are difficult to consciously control or spoof.
Read the framework introduction →What makes AnubisX different from existing attribution methods?
Existing attribution methods depend on technical identifiers (IP addresses, cookies, device fingerprints) that sophisticated adversaries can easily spoof, rotate, or eliminate. AnubisX approaches attribution through behavioral signals that are intrinsic to the individual and costly to mimic. Additionally, AnubisX provides a formal, transparent framework with pre-specified validation criteria — unlike existing approaches that often lack rigorous methodological documentation.
See research contributions →Is the framework ready for operational use?
The AnubisX framework is a research contribution at the PROPOSED/ESTABLISHED stage. The stylometric prototype (Anubis Twitter v2.5) demonstrates proof-of-concept feasibility on a limited dataset. The full validation suite (31 criteria, 4 tiers) is pre-specified but has not yet been empirically evaluated. Operational deployment would require substantial additional development, data acquisition, and validation.
View validation status →