Evidence & Provenance Engine

The Trust Layer of Hermes

In traditional vulnerability databases, claims like “actively exploited by threat actor X” are presented without evidence. Hermes requires every significant intelligence assertion to trace back through an unbroken provenance chain.

1. The Provenance Chain

  PRIMARY SOURCE (e.g. CISA KEV, Vendor Security Advisory, GitHub Commit)
        │
        ▼
 EVIDENCE OBJECT (Empirical observation, packet capture, exploit sample)
        │
        ▼
  FORMAL CLAIM (Classified assertion with mathematical confidence)
        │
        ▼
   RELATIONSHIP (Directed edge in Knowledge Graph)
        │
        ▼
 OPERATIONAL SCORE (Hermes Threat Score / HASS)

Whenever Hermes asserts a relationship or elevates a threat score, analysts can query:

1. Why does Hermes believe this?
2. What exact evidence would refute or overturn this conclusion?

---

2. Four-Tier Claim Taxonomy

Hermes enforces a strict epistemic taxonomy. AI pipelines are forbidden from presenting inferences or predictions as facts:

1. FACT

An assertion directly corroborated by verifiable physical, mathematical, or authoritative primary evidence.

• Example: “A public proof-of-concept exploit script was committed to GitHub on September 5.”
• Criteria: Verifiable SHA256, URL timestamp, or signed vendor release.

2. INFERENCE

A logical conclusion deduced from one or more corroborated facts.

• Example: “The availability of an unauthenticated token forgery script significantly lowers the exploitation barrier for script kiddies.”
• Criteria: Explicit causal chain linking observations.

3. HYPOTHESIS

A plausible operational explanation that has not yet been independently verified.

• Example: “The observed scanning pattern may be attributed to Void Arachne preparing a wider ransomware wave.”
• Criteria: Must be explicitly labeled with CONTESTED or UNDER_REVIEW lifecycle status.

4. PREDICTION

A forward-looking probabilistic forecast with an explicit evaluation window.

• Example: “CVE-2026-59822 is likely to be incorporated into automated botnet loaders within 14 days.”
• Criteria: Audited post-facto to calculate calibration curves for the Hermes Prediction Engine.

---

3. Evidence Strength & Types

Evidence objects are weighted according to empirical reliability:

Evidence Type	Description	Baseline Strength
direct_observation	Direct telemetry, honeypot capture, or network dump	0.98
vendor_confirmation	Official vulnerability disclosure or patch commit	0.98
government_confirmation	Inclusion in official catalogs (CISA KEV, CERT-FR)	0.99
exploit_code	Functional, independently verified PoC code	0.95
technical_analysis	Deep forensic teardown by recognized security lab	0.92
telemetry	Aggregated sensor counts or port scanning spikes	0.85
researcher_statement	Public disclosure by credited vulnerability finder	0.88
secondary_reporting	Tech journalism or secondary aggregator	0.65