Behavioral observation spec for adversarial network attribution. BEHAVE defines a structured observation envelope (core) and two domain registries — shell-session (BEHAVE-SHELL) and text/messaging (BEHAVE-TEXT) — used to build behavioral signatures over collected operator activity.

Packages

Package	Description	Path
`behave-core`	Shared observation envelope — schema contract used by all registries	`core/`
`behave-shell`	Shell-session behavioral observation registry	`BEHAVE-SHELL/`
`behave-text`	Text/messaging-domain behavioral observation registry	`BEHAVE-TEXT/`

Install

All packages are available on PyPI:

pip install behave-core
pip install behave-shell
pip install behave-text

behave-core is pulled in automatically as a dependency of the registries.

For local development (includes pytest + ruff):

pip install -e "core/[dev]"
pip install -e "BEHAVE-SHELL/[dev]"
pip install -e "BEHAVE-TEXT/[dev]"

Test

pytest core/
pytest BEHAVE-SHELL/
pytest BEHAVE-TEXT/

Licensing

This repository uses a dual license:

Content	License
Code, JSON schemas, tests (`.py`, `.json`, `pyproject.toml`)	GNU GPL v3.0 or later
Spec prose and attribution recipes (`*.md` files)	CC-BY-SA-4.0

SPDX identifiers are present in individual files.