{
  "_meta": {
    "__meta__": "synthetic",
    "disclaimer": "Synthetic demo data inspired by real Baltic geography, MMSI/OUI conventions, and infrastructure. Not real observations.",
    "dataset": "s4-spoofed-ais-identity/weights",
    "version": "1.0"
  },
  "scenario_id": "s4-spoofed-ais-identity",
  "alert_threshold": 0.70,
  "weights": {
    "duplicate_mmsi_score": 0.30,
    "ais_radar_delta_score": 0.25,
    "dimension_speed_plausibility_score": 0.20,
    "mac_fingerprint_anomaly_score": 0.25
  },
  "rationale": {
    "duplicate_mmsi_score": "Two simultaneous AIS positions for MMSI 230199540 separated by ~78 NM is the highest-confidence single signal of an identity spoof; weighted highest.",
    "ais_radar_delta_score": "Independent RAD-PLN-01 ground truth showing the spoof hull at a position diverging from the AIS-claimed track; corroborates which AIS copy is the lie.",
    "dimension_speed_plausibility_score": "Radar length-estimate (28-34 m) and sustained 17 kn speed are physically incompatible with the AIS-claimed 12 m fishing-vessel doing 6 kn; lowest weight because dimension estimation has the largest measurement uncertainty.",
    "mac_fingerprint_anomaly_score": "Zero Jaccard overlap with the >=10-visit TAHTI baseline plus Huawei/ZTE-dominated manufacturer mix at MAC-HEL-PORT-04 makes this a powerful corroborating signal in port; tied with the radar-delta signal."
  },
  "notes": "Weights sum to 1.0. Alert threshold is tunable. The decoy F/V SILAKKA (MMSI 230888022, ais_type=30 fishing) transits Porkkala -> Helsinki with consistent AIS, no duplicate MMSI, no radar/AIS delta and its own MAC fingerprint at MAC-HEL-PORT-05 that matches its (separate) baseline -> composite score < 0.05 -> no alert. This proves selectivity."
}