Overview

Informative. SPEC.md controls.

The question

Which control actually stopped the attack?

Proof of Attribution is the claim that a stopped attack is credited to a named control at a named level (SUT, DUT or CUT). It is established only by differential attribution: matched runs in an otherwise identical environment, one with the control active and one with it disabled, each with fresh canaries of the same technique class. The difference between the two runs is the control's share.

Why it matters

A log naming the rule that fired is a claim. A matched run with the rule off is a fact. A buyer, insurer or regulator relying on a proof of efficacy also needs this question answered, and answered by evidence the measured party did not produce.

What it is not

• It is not a device log or alert naming the rule that fired.
• It does not attribute anything at a level finer than the matched runs isolated.

The three answers

• proven: The Attributed Share for a technique class exceeds the declared minimum and the Splitting Limit of PP-SPEC-081 Section 7, with both runs valid.
• refuted: The Attributed Share is within the declared noise limit: the control made no measurable difference for that technique class.
• insufficient: Either run is invalid, fingerprints differ beyond the named control, or Units of Proof per technique class fall below the declared minimum.