{
  "_meta": {
    "__meta__": "synthetic",
    "disclaimer": "Synthetic demo data inspired by real Baltic geography, MMSI/OUI conventions, and infrastructure. Not real observations.",
    "dataset": "s3-loitering-critical-infra/weights",
    "version": "1.0"
  },
  "scenario_id": "s3-loitering-critical-infra",
  "alert_threshold": 0.70,
  "weights": {
    "temporal_dwell_score": 0.25,
    "spatial_proximity_infra_score": 0.25,
    "mac_count_zscore": 0.20,
    "mac_manufacturer_jsd_score": 0.20,
    "ais_type_behavior_mismatch_score": 0.10
  },
  "rationale": {
    "temporal_dwell_score": "Loitering duration over a critical-infrastructure polygon is the defining behaviour; weighted equal-highest with spatial proximity.",
    "spatial_proximity_infra_score": "Proximity to the cable/pipeline JUNCTION (500 m buffer) drives consequence; equal-highest with dwell.",
    "mac_count_zscore": "Anomalous unique-MAC count at MAC-PRK-COAST-01 (vs MAC-INK-COAST-01 / port baseline) is a strong but noise-prone secondary signal.",
    "mac_manufacturer_jsd_score": "An almost-pure Espressif / Texas Instruments / u-blox mix is highly diagnostic of deposited industrial-IoT hardware vs the consumer-dominated baseline.",
    "ais_type_behavior_mismatch_score": "Binary directional signal (declared ais_type=70 bulk carrier sustaining SOG < 1 kn over critical infra); lowest weight by design."
  },
  "notes": "Weights sum to 1.0. All five signals are canonical (see catalogs/ontology.md and generators/scoring.py). Alert threshold is tunable from the web demo. The decoy M/V VENLA RESEARCH (ais_type=52 research vessel doing a legitimate seabed survey 3.7 NM SE of the JUNCTION polygon) is suppressed by spatial_proximity_infra_score = 0, ais_type_behavior_mismatch_score = 0 and a consumer-OUI MAC mix → composite score ≪ 0.70."
}