Cross-sessioncorrelation
Cluster related sessions by fingerprint similarity and TTP-sequence distance. Not attribution.
Sessions that look alike get grouped. Similarity comes from two directions: the fingerprint side (JA4, HASSH, tooling, timing) and the behavioural side (how close the technique sequences are as ordered sequences, not just as sets).
The output is a campaign, meaning a claim that these sessions resemble each other. It is not a claim about who ran them.
In this build similarity is the overlap of indicators and of techniques, compared as sets and weighted 0.6 and 0.4 over whichever of the two a session has. Fingerprint similarity and sequence distance are designed, not built.
- Completed session cases
- Fingerprints
- Technique sequences
- Campaign clusters
- Shared indicators
- Sequence similarity
Rules this layer holds to
Each of these is written down because relaxing it would be locally convenient and globally wrong.
Shared tooling is cheap. Two unrelated operators running the same public toolkit will cluster, and the design accepts that rather than papering over it with a confident label.