| Idx | Phase | Signal | Perf (Δ%) | Dist (μ) | KS (D) | RS | Status |
|---|
| Idx | Phase | Signal | Perf (Δ%) | Dist (μ) | KS (D) | RS | Status |
|---|
Based on: Silva et al., "A Repair-Time Trigger for Cyberattack Classifiers", MILCOM.
The Repair-Time Trigger is an observability mechanism designed to detect Concept Drift and regime degradation in non-stationary time series, without relying on external ground truth labels in real-time.
Unlike traditional monitoring systems that measure error (which requires knowing the correct answer), this system measures the statistical plausibility of current behavior relative to a historical reference period.
The scientific integrity of the system depends on the strict definition of a Reference Regime (Baseline). All normalization statistics (μ, σ, min, max) and the reference distribution for the KS test are calculated exclusively on the first N observations.
Adjust the Baseline size. The green area represents the system's "frozen" knowledge.
The Repair Score is composed of three orthogonal indicators of degradation.
In supervised systems, we use F1-Score. In unlabeled time series, we use Magnitude of Variation (Derivative) or Short-term Prediction Error as a proxy.
Measures how far the current system state is from the "center of gravity" (centroid) of the normal regime.
A non-parametric test comparing the cumulative distribution function (CDF) of the current sliding window against the full baseline CDF.
The red line (D-stat) represents the maximum distance between the curves.
The final score is a weighted linear aggregation of the normalized metrics.
Where Mn(t) are metrics normalized by baseline stats.
Note: Since the future can be more extreme than the past, it is mathematically expected for Mn(t) > 1.0 in severe anomalies.
Absolute thresholds (e.g., "Alert if RS > 0.5") are arbitrary and fail in different contexts. This system uses a data-driven approach based on historical percentiles.
| ✔ The System DOES | ✖ The System DOES NOT |
|---|---|
| Detects statistical regime change (Concept Drift) in real-time. | Does not forecast future price or market direction. |
| Quantifies the magnitude of anomaly relative to history. | Does not classify the root cause (e.g., sensor error vs. market event). |
| Works in an unsupervised manner (no labels). | Does not replace human validation for corrective action. |
| Adapts thresholds to baseline volatility. | Does not automatically fix the model (only triggers the repair signal). |