Mathematical Foundations
A comprehensive mathematical framework for behavioral forensics: 292 formally defined objects organized into 24 categories across six abstraction layers, enabling rigorous attribution analysis through the Behavioral Signal Model and Likelihood Ratio evidence evaluation.
Framework Structure
The framework is organized into six hierarchical layers. Each layer defines its own categories of mathematical objects, with strict dependency ordering — higher layers build upon the types and transformations defined below.
| Layer | Categories | Objects |
|---|---|---|
| L1 — Foundation Types | 4 categories (primitives, sets, scalars, constants) | 39 |
| L2 — Structured Types | 4 categories (vectors, matrices, tensors, indexed collections) | 26 |
| L3 — Transformations | 4 categories (functions, mappings, normalizations, aggregations) | 31 |
| L4 — Comparison & Evaluation | 4 categories (metrics, distances, similarities, ranking functions) | 26 |
| L5 — Uncertainty & Decision | 5 categories (probabilities, likelihoods, confidences, scores, decision rules) | 32 |
| L6 — Constraint & Optimization | 3 categories (constraints, objective functions, solvers) | 15 |
Behavioral Signal Model
The observed behavioral signal produced by a source s at time t, on platform p, in context c, is decomposed into four additive components:
y(s, t, c, p) = ycog(s, t) + yctx(c) + yplat(p) + ε(s, t, c, p)
where each component captures a distinct generative factor:
- ycog — cognitive signature: the stable, individual-specific component arising from the source's underlying cognitive processes and behavioral routines.
- yctx — contextual modulation: systematic variation introduced by the situational context (e.g., task type, time of day, environmental conditions).
- yplat — platform bias: device- or platform-specific distortion of the observed signal (e.g., sensor noise, interface constraints, sampling rate).
- ε — irreducible observation noise: stochastic error term, assumed E[ε] = 0 with finite variance, encompassing measurement error and unmodeled transient effects.
Likelihood Ratio Framework
Evidence evaluation is grounded in the likelihood ratio framework, the foundational standard for forensic inference under uncertainty. The weight of evidence comparing two competing hypotheses — same source (Hsame) versus different source (Hdiff) — is quantified as:
LR = P(E | Hsame) / P(E | Hdiff)
where E is the observed behavioral evidence. The posterior odds are obtained by multiplying the prior odds by the likelihood ratio:
P(Hsame | E) / P(Hdiff | E) = LR × P(Hsame) / P(Hdiff)
Evidence strength is interpreted according to the following calibrated scale:
| LR Range | Verbal Scale | Interpretation |
|---|---|---|
| LR < 1 | Negative evidence | Supports different-source hypothesis |
| 1 ≤ LR < 10 | Weak evidence | Limited support for same-source hypothesis |
| 10 ≤ LR < 100 | Moderate evidence | Appreciable support for same-source hypothesis |
| 100 ≤ LR < 1,000 | Strong evidence | Convincing support for same-source hypothesis |
| LR ≥ 1,000 | Very strong evidence | Extremely compelling support for same-source hypothesis |
Key Mathematical Objects
Behavioral Fingerprint
A behavioral fingerprint F is a finite-dimensional real vector representing the aggregation of cognitive and behavioral features extracted from a source's observed signal over a reference window. Formally, given a source s and a reference window W = [t0, t1], the fingerprint is defined as the image of the observed signal under a feature extraction mapping φ followed by a normalization ν:
F(s, W) = ν ∘ φ [ y(s, ·, ·, ·) | _W ] ∈ ℝd
where d is the dimensionality of the fingerprint space. The mapping φ selects and transforms behavioral features, while ν ensures unit-length normalization (||F||2 = 1) so that similarity comparisons are scale-invariant.
Similarity Measure
The similarity between two behavioral fingerprints Fi and Fj is computed via cosine similarity, which measures the cosine of the angle between the two vectors in ℝd:
sim(Fi, Fj) = (Fi · Fj) / (||Fi|| × ||Fj||)
Since fingerprints are unit-normalized, the denominator equals 1, and the similarity reduces to the dot product: sim(Fi, Fj) = Fi · Fj. The resulting similarity takes values in [−1, 1], where 1 indicates identical direction (maximal similarity), 0 indicates orthogonality (no linear association), and −1 indicates opposite direction (maximal dissimilarity). For behavioral attribution, only positive similarity values are considered interpretable; negative values are taken as evidence of dissimilar source characteristics.
Attribution Decision
The attribution decision for a questioned sample against a known source is formalized as a hypothesis test. Given a set of known-source fingerprints K = {F1, …, Fn} and a questioned fingerprint Fq, the attribution function A returns a decision d ∈ {same, diff, inconclusive} together with a likelihood ratio LR quantifying the strength of evidence:
A(Fq, K) = (d, LR) where LR = supθ ∈ Θsame L(θ) / supθ ∈ Θdiff L(θ)
The decision rule is parameterized by two threshold values τlo and τhi:
d = same if LR ≥ τhi d = diff if LR ≤ τlo d = inconclusive otherwise
Default thresholds are set at τlo = 1 and τhi = 10, consistent with established forensic guidelines.