The Universal FIP dimensions create a complete investigation lens for examining activity and understanding whether it represents an attack.
Each dimension provides three things: the concept, what it measures, and why it matters.
Together, the five dimensions are:
Amount measures intensity.
Distribution measures spread.
Over Time measures rhythm.
Request Structure measures technical form.
Context Likelihood measures business meaning.
Every SIN, AMO, and attack family fits inside these five dimensions. This is the invariant forensic framework.
1. Amount
Amount measures the intensity of activity. It answers the basic investigative question: how much is happening?
This includes request rate, failed login counts, session creation, signature hits, payload frequency, or backend resource usage.
Volume alone does not prove an attack, but abnormal intensity is often the first friction signal.
The value of Amount analysis is speed. It allows rapid anomaly detection and early invocation. It helps distinguish normal business growth from sudden abuse, identify spikes versus background noise, and quantify impact.
Without measuring volume, an incident response team reacts emotionally. With it, they respond mathematically.
2. Distribution
Distribution measures spread and entropy. It answers: how widely is this behavior distributed?
This includes IP spread, geographic spread, ASN clustering, username distribution, endpoint coverage, object traversal range, or session dispersion.
The value of Distribution analysis is classification power.
A single IP behaving badly is different from 10,000 rotating IPs. A focused attack is different from random scanning.
Distribution transforms raw volume into intelligence by revealing coordination, automation level, and likely attacker capability.
3. Over Time
Over Time measures behavioral rhythm. It answers: how does this activity evolve?
This includes burst waves, oscillation patterns, low-and-slow persistence, steady repetition, or multi-stage sequencing such as reconnaissance followed by exploitation.
The value of Time analysis is intent recognition.
Human behavior and automation have different temporal fingerprints. The time dimension exposes stealth tactics, distinguishes flash events from sustained campaigns, and prevents missing attacks that deliberately avoid volume thresholds.
4. Request Structure
Request Structure measures how the request is constructed. It answers: what does the traffic look like technically?
This includes parameters, headers, cookies, payload encoding, meta characters, JSON nesting, content-type anomalies, and protocol manipulation.
The value of Structure analysis is precision.
While volume and distribution identify suspicious behavior, structure confirms technical intent: exploitation, fuzzing, bypass attempts, automation artifacts, or malformed payloads.
This dimension is where detection becomes forensic evidence.
5. Context Likelihood
Context Likelihood measures business plausibility. It answers: does this make sense here and now?
This includes comparing traffic to expected business patterns, marketing events, typical geographic behavior, normal user flows, and historical baselines.
The value of Context is judgment.
Not every spike is malicious, and not every anomaly is dangerous. Context prevents false positives, protects user experience, and ensures security actions align with operational reality.
It is the bridge between technical signals and business decision-making.
Why These Five Are Enough
Together, the Universal FIP dimensions create a complete investigation lens.
Amount provides intensity.
Distribution provides spread.
Over Time provides rhythm.
Request Structure provides technical form.
Context Likelihood provides business meaning.
Every SIN, AMO, and attack family fits inside these five.
This is the invariant forensic framework.