Behavioral Intelligence
QUORUM looks at how a session behaves — typing, pointer and touch dynamics, device characteristics and automation indicators — and compares it with that user's own history.
01 // Signals
Interaction
Typing speed and variance, pointer-movement entropy, touch force and area, motion, frame-timing jitter.
Automation
Headless-browser and webdriver signals; user-agent versus TLS (JA3) inconsistencies; implausible device characteristics.
Device
WebGL renderer hash, audio-context entropy, touch-point count, timezone and its consistency with the IP location.
Network
IP reputation from threat feeds and honeypot observations; proxy, VPN and Tor indicators.
02 // Baselines
Each user's baseline is a running mean and variance of their signals (Welford's method), kept per institution. A new session is scored by how far it departs from that baseline, together with rule-like checks on automation signals.
A Rust/WebAssembly module in the browser SDK extracts the hardware and timing signals, and raw keystroke and pointer streams are reduced to derived values before they leave the browser.
03 // During the Session
On authenticated institutional requests, QUORUM re-checks behaviour on every call. By default a score of 55 adds a warning header and 82 blocks the request as identity drift.
Where enabled, the optional relationship graph adds risk from connected accounts, devices and IP addresses.
04 // Measurement
No bot-detection or account-takeover catch rate has been measured on a labelled dataset, and no uniqueness rate is claimed for device fingerprints. A shadow-mode pilot with an institution is designed to measure detection, false positives and analyst effort.