Cross-sessioncorrelation
Cluster related sessions by fingerprint similarity and TTP-sequence distance. Not attribution.
Sessions that look alike get grouped. Similarity comes from two directions: the fingerprint side (JA4, HASSH, tooling, timing) and the behavioural side (how close the technique sequences are as ordered sequences, not just as sets).
The output is a campaign, meaning a claim that these sessions resemble each other. It is not a claim about who ran them.
Takes
- Completed session cases
- Fingerprints
- Technique sequences
Emits
- Campaign clusters
- Shared indicators
- Sequence similarity
Rules this layer holds to
Each of these is written down because relaxing it would be locally convenient and globally wrong.
Behavioural clustering is never presented as attribution.
A campaign is a similarity statement about sessions, not about people or groups.
Where this is uncertain
Shared tooling is cheap. Two unrelated operators running the same public toolkit will cluster, and the design accepts that rather than papering over it with a confident label.