Research / FACE-EO

Behavior is not a feature we added. It is the model we started from.

FACE-EO represents security behavior through execution context, capability, actions, immediate effects, persistent effects and observability.

Explore the model Review publication status

Why representation

Security telemetry preserves fragments. The model preserves their relationship.

Event streams preserve sequence. Process trees preserve lineage. Attack labels preserve interpretation. FACE-EO asks what a shared intermediate representation must carry so several downstream systems can reason over the same behavior. [research]

The six questions a behavior answers Six stacked rows, each a plain-language question: who or what acted, what it can do, what it did, what changed immediately, what remained afterward, and how certain we are. The sixth row is drawn dashed and hatched because it represents what was not observed. Every behavior answers six questions 1 Who or what acted? execution context 2 What can it do? functional profile 3 What did it do? actions 4 What changed immediately? immediate effects 5 What remained afterward? persistent effects 6 How certain are we? observability The sixth question is the one most systems never ask.
Six questions define the model in the language used by investigators.

The model

Six dimensions, stated as operational questions.

01 / Execution context

Who or what acted?

Identity, process lineage, host, session and privilege.

02 / Functional profile

What could it do?

Capabilities relevant to the activity, separate from actions taken.

03 / Actions

What did it do?

The discrete operations performed.

04 / Immediate effects

What changed immediately?

State changed during execution.

05 / Persistent effects

What remained afterward?

State that survived the process, session or reboot.

06 / Observability

How certain are we?

Direct observation, inference, partial observation and known gaps.

Model

FACE-EO in detail

Read the six dimensions, intermediate-layer argument and explicit evidence boundary.

Explore Register

Publications

The FACE-EO paper presented at FPS 2026, plus technical references and protocols.

Explore Protocols

Method before result

Inspect proposed measures and the conditions that would count as a negative result.

Explore Artifacts

Schema, specimen, mapping, code

Browse available references and the artifacts that have not yet been published.

Explore

Next step

Read the model before reading a claim about it.

The FACE-EO page separates what the representation proposes, what its evaluation can support, and what the FPS 2026 publication will add.

Read FACE-EO