Timetodetect

Timetodetect is a metric used to quantify the latency between the occurrence of an event and its detection by a monitoring or recognition system. It is commonly applied in fields such as cybersecurity intrusion detection, industrial process monitoring, and computer vision, where timely identification of events is critical. The metric provides a single-number summary of detection speed and is often analyzed alongside accuracy metrics to assess overall system performance.

Calculation: The timetodetect for a single event is t_detection minus t_event. t_event is the timestamp when the event is believed to have occurred, while t_detection is when the system raises an alert or marks the event as detected. In practice, both times should be based on the same clock domain, and events may be matched to detections via identifiers to avoid double counting.

Applications and interpretation: Timetodetect is used to evaluate and compare systems, set expectations in service level agreements, and guide improvements. It can be reported as a distribution, with median timetodetect and percentiles to reflect variability. In streaming or real-time systems, timetodetect can be summarized as mean timetodetect (MTTD) across incidents.

Challenges: Accurate measurement requires synchronized clocks; differences in clocks create apparent delays. Other issues include event timestamping accuracy, queueing delays, batching, and multiple detections for a single event. In some domains, the exact event time is uncertain, which introduces bounds on timetodetect.

Related metrics and improvements: Timetoalert and mean time to detect (MTTD) are common variants. Improvements include synchronized timing using NTP or PTP, hardware timestamping, end-to-end logging, and cross-correlation of event streams to reduce misattribution.