- TAS gate states: gateStateChanged, guardBandStateChanged

- PSFP meters/filters: packetPushed{,Out}, packetFiltered, packetDropped

- App sinks: packetReceived (for E2E delay)

- MAC, Queues, gPTP, Sinks

1 ms fixed windows (windowLength)

Fixed, anchored timer (decoupled from inference)

Runs on inferenceInterval timer

Decoupled from windowing timer

sum/max/mean/std

Queue length average is time-integral (area under Qlen vs time / window)

Two sets:

- Legacy 7-feature vector

- Extended 15-feature vector (preferred)

15 features order:

throughput_bps_tx, packets_sent, packets_received, packets_dropped, drop_rate, queue_length_max, ptp_offset_mean, ptp_offset_max, rate_ratio_mean, peer_delay_mean, e2e_delay_avg, e2e_delay_max, e2e_delay_std, has_ptp, has_e2e

drop_rate = dropped / (enqueued_ok + dropped)

Timing features (indices 6–12):

- -1 → NaN → z-score → NaN → 0

Presence flags: has_ptp, has_e2e

Sentinel handling explicit

Z-score using mean/std from JSON file (if found)

Binary anomaly score (p_anomaly from 1- or 2-logit head)

Thresholding → flag

No multi-class decision implied

tokensChanged, etc.

Not included in feature vector

- throughput: bps

- PTP offsets, peer delay, E2E delay: seconds

- queue length: packets