Signal Format

The signal format for the GSE has been designed to be simple to support a variety of different signal types whilst allowing flexibility in providing more data where available and useful.

The minimum data set required for sharing a signal is as follows:

Signal - The signal itself (e.g. a URL, a phone number, a bank account number etc)

Signal Type - The type of signal (e.g. URL, phone number etc). This can often be auto detected according to the format of the signal but must be supplied in some case.

Abuse Type - The type of abuse for which this signal has been reported (e.g. scam, fraud, phishing etc)

Report Date - The data that this report was made to the supplier of the signal. This enables us to measure the age of signal reports.

Additional data items which can be supplied are:

Confidence Score - A vendor assessed confidence level for a signal - this is often supplied where signals are not based on confirmed reports but generated via AI or other predictive means but can also be supplied to reinforce confidence for high confidence provider.

Predictive Indicator - Used to indicate that a signal has been detected using predictive means (e.g.using AI or statistical assessments) rather than as a confirmed report of abuse.

Extra Data - Additional data supplied by the vendor to further qualify signals. This is flexible in structure and allows for additional context or further sub-categorisation of signals where extra data is available.