Cyber Confidence Half-Life - EMBER2018 measurement data

Per-month measurement data and figures supporting the study "The Cyber Confidence Half-Life: A First Empirical Measurement of Detection-Confidence Decay under Natural Concept Drift." A LightGBM malware detector was trained on the first month of the public EMBER2018 static-feature corpus (feature version 2), its decision threshold frozen at a 1% false-positive rate, and its true-positive rate at a fixed 1% alarm budget measured across six successive 2018 months without retraining. The measured confidence follows an exponential decay with a half-life of 23.2 months (95% CI 5.7–40.7; R²=0.77). Files: thalf_monthly.csv (per-month TPR, FPR, AUC, normalised confidence C), thalf_results.json (fit results and metadata), and two figures. Feature extraction was validated against the corpus's own reference model (AUC 1.00). The EMBER2018 corpus is openly available from Elastic (Anderson & Roth, 2018, arXiv:1804.04637).