Framework Architecture

The AnubisX Framework defines a six-layer processing architecture for behavioral digital attribution. Each layer encapsulates a distinct phase of the attribution pipeline, from raw data acquisition through evidence generation, enabling modular development, testing, and extension.

Architecture Diagram

Six-Layer Architecture

Layer Specifications

L1 — Data Acquisition

Ingestion and validation of raw digital artifacts from platform-specific sources. The acquisition layer handles authentication, rate limiting, pagination, and initial structural validation of incoming data, producing a standardized intermediate representation for downstream processing.

Input: Raw API responses / exported datasets  |  Output: Validated artifact records
Processing: Platform adapters authenticate to source APIs, retrieve requested data windows, validate response structure and field completeness, and emit parsed records with attached provenance metadata.
Status: Implemented (Twitter adapter via API v2)

L2 — Data Normalization

Cleaning, standardization, and temporal alignment of acquired artifacts. Normalization resolves inconsistencies in field naming, data types, timestamps, and encoding across heterogeneous sources, producing a uniform schema for feature computation.

Input: Validated artifact records  |  Output: Normalized records (canonical schema)
Processing: Field mapping resolves source-specific naming to canonical attributes; timestamp normalization converts all temporal fields to UTC epoch; text encoding is unified to UTF-8; missing and malformed fields are flagged or imputed.
Status: Implemented

L3 — Feature Extraction

Modality-specific feature computation producing a 372-dimensional behavioral feature vector. Extraction covers stylometric, temporal, and interaction-based modalities, each computed by a dedicated extractor module with configurable parameters.

Input: Normalized records  |  Output: 372-dim feature vector
Processing: Stylometric analysis computes character/word n-gram distributions, syntactic patterns, and readability indices; temporal analysis extracts posting rhythms, inter-arrival times, and burst patterns; interaction analysis derives reply/retweet/like ratios and network centrality proxies.
Status: Implemented

L4 — Behavioral Profiling

Fingerprint generation and profile construction from extracted feature vectors. The profiling layer aggregates feature vectors across the available observation window, applies optional weighting and decay functions, and stores the resulting behavioral fingerprint in a persistent profile store.

Input: 372-dim feature vectors  |  Output: Behavioral fingerprint + profile record
Processing: Vectors are aggregated via configurable fusion strategy (mean, weighted moving average, or exponential decay); fingerprint quality metrics are computed (coverage, recency, consistency); profiles are indexed and persisted via the storage backend.
Status: Implemented (SQLite + NumPy)

L5 — Similarity & Attribution

Distance computation and similarity search across behavioral profiles. The attribution layer compares a probe fingerprint against enrolled profiles using configurable distance metrics, returning ranked candidate lists with per-dimension contribution analysis.

Input: Probe fingerprint + enrolled profile set  |  Output: Ranked similarity list
Processing: Distance computation supports cosine, Euclidean, Manhattan, and Mahalanobis metrics; FAISS indexing enables approximate nearest-neighbor search at scale; per-dimension contribution scores identify which behavioral axes drive the similarity signal.
Status: Proposed (FAISS integrated in prototype, full search pending)

L6 — Evidence Generation

Likelihood ratio computation, score calibration, and multi-evidence fusion. The evidence layer transforms raw similarity scores into calibrated likelihood ratios, fuses evidence across multiple modalities, and produces a final attribution decision with quantified uncertainty.

Input: Ranked similarity list  |  Output: Attribution report (LR + decision)
Processing: Score calibration via logistic regression or PAV transformation; likelihood ratio computation using kernel density estimation of within-source and between-source score distributions; fusion across modalities weighted by calibrated log-likelihood ratios; decision threshold optimization via cost-minimization curves.
Status: Proposed

Processing Pipeline

Six-Stage Pipeline
  1. Ingestion — Data acquisition through platform-specific adapters with authentication, rate-limit handling, and pagination. Produces validated artifact records with provenance metadata.
  2. Feature Extraction — Modality-specific feature computation across stylometric, temporal, and interaction domains. Outputs normalized 372-dimensional feature vectors.
  3. Profile Construction — Fingerprint generation via configurable vector aggregation with quality assessment. Fingerprints are indexed and persisted in the profile store.
  4. Comparison — Similarity computation using configurable distance metrics (cosine, Euclidean, Manhattan). FAISS indexing supports approximate nearest-neighbor search over enrolled profiles.
  5. Evidence Evaluation — Score calibration and likelihood ratio computation. Raw similarity scores are transformed into calibrated LRs via density estimation over score distributions.
  6. Decision — Threshold-based classification with confidence quantification. The decision stage applies cost-minimization rules to produce a final attribution verdict.

Stages 1–4 are implemented in the prototype. Stages 5–6 are Proposed and are the subject of ongoing research.

Prototype Implementation

The current prototype, Anubis Twitter v2.5, implements the first four layers of the architecture through five modular packages:

Each package is independently testable and publishes typed interfaces consumed by the next layer. The comparison package includes a preliminary L5 implementation; full evidence generation (L6) and decision automation remain in design.