Pipeline Stage 03

Behavioural Scoring

The real-time behavioural score is statistical: signals are compared with the user's own baseline and with automation indicators. The AI models run separately, after the decision.

Score Fusion

simplified flow

behavioural = zscore(signals vs user baseline) + signal rules
if transaction facts supplied:
    score = behavioural * 0.6 + rules * 0.4
    if behavioural >= 70 or rules >= 70:
        score = max(score, 70)
else:
    score = behavioural

Baselines

Per-user running mean and variance (Welford's method) of typing, pointer, touch, motion and frame-timing signals, scoped to the institution.

Automation indicators

Headless and webdriver signals, user-agent versus TLS (JA3) inconsistencies and implausible device characteristics.

AI tiers (asynchronous)

Sentinel, Inquisitor and Adversarial — locally run Qwen models, three of them fine-tuned — analyse queued cases at temperature 0. Their findings go to analysts.

Limits

No detection or false-positive rate has been measured on a labelled dataset yet; a shadow-mode pilot is designed to measure them.

KB Analytical Solutions Inc. // Behavioural Scoring // Describes QUORUM at code baseline e9c2cf7