Reporting Derived Metrics

A derived metric is a number computed from a sample and then compared against a threshold to produce a flag, a score, or a sentence a user reads as a finding. The bugs are almost never in the arithmetic. They are at the two ends: what the function returns when the sample is too small to support the statistic, and what the flag layer does with that value.

An undefined statistic is not zero

Dispersion — standard deviation, variance, coefficient of variation, burstiness, mean gap between events — needs at least two observations. Ratios and rates need a non-zero denominator. The reflex on the short-sample branch is return 0.0, and that is the worst available answer, because 0 is a real and extreme point on the same scale the threshold lives on.

Two shapes, both of which turn "no data" into a confident verdict: