Data may be unstable over time.
For example, the content of a monitored directory or file can change.
This produces "motion blur" (ie, timing-based inconsistencies)
in and between data snapshots.
If taking a snapshot takes a small amount of time,
relative to the gap between snapshots (ie, time ticks),
changes are more likely to show up as differences between snapshots.
However, given that a snapshot will always take some
there is always a chance that a given snapshot will be blurry.
We can reduce the impact of these problems by waiting for the data to stabilize.
If a snapshot has had the same value for N consecutive time ticks,
we can be more confident that it is internally consistent.
framework provides the infrastructure
for tracking the values and time stamps of all data used by Arti.
However, Arti's rules must still define the applicable policies.
For example, how many time ticks are needed for a particular type of snapshot
to stabilize enough to be used for a particular type of analysis?
This wiki page is maintained by Rich Morin
an independent consultant specializing in software design, development, and documentation.
Please feel free to email
comments, inquiries, suggestions, etc!