Abuse Investigation Platform
SHIPPED · IN PRODUCTION USE
A solo-authored suite of analyst tools sharing one detector core across every surface: a rule engine, behavioral time-series scoring, and graph-based clustering that turn scattered signals into ranked, human-reviewed leads.
Problem
Coordinated adversarial behavior surfaced only after damage was visible, because no shared system existed to detect it. Analysts correlated signals by hand across disconnected surfaces, and every investigation rebuilt the same pattern-matching logic from memory instead of a tested, shared system.
Approach
Designed and built the investigative tooling layer solo, anchored on one detector core so every surface reasons from the same math: a rule engine flags known-bad configurations, sliding-window behavioral scoring surfaces coordinated timing across accounts, and graph-based similarity (cosine, Jaccard, k-core cohesion) clusters fragmented identities into ranked candidate networks.
Every surface, from a lightweight analyst tool to a coordinated command-line pipeline, calls the same core rather than reimplementing its own logic, and every output lands with a human reviewer. The system proposes; it does not enforce.
Outcome
The detector core now runs the daily investigative workflow in production, checked against more than 60,000 regression tests on its own math, and is the tooling layer behind the detection-time result on Plate 01: coordinated-network detection cut from roughly 30 days of manual correlation to under two hours.