Skip to content

Forensic Analysis

Forensic analysis is the baseline battery in openentropy. It evaluates six properties expected in random data and runs in every profile.

Implemented in openentropy_core::analysis.

Measures serial dependence across lags.

MetricDescription
max_abs_correlationMaximum `
thresholdApproximate significance threshold (2/sqrt(n))
violationsNumber of lags exceeding threshold

Low correlation and few violations indicate independence over time.

Measures frequency-domain structure via DFT.

MetricDescription
flatnessSpectral flatness (0..1), higher is whiter
dominant_frequencyStrongest normalized frequency component
peaksTop power-spectrum peaks

Flatness near 1.0 and weak dominant peaks are expected for white-noise-like sources.

Measures per-bit deviation from 50/50.

MetricDescription
bit_probabilitiesP(1) for each bit position
overall_biasMean deviation from 0.5
chi_squaredUniformity statistic
p_valueApproximate p-value
has_significant_biasAny bit with meaningful bias

Low overall bias and no significant per-bit bias indicate healthy bit-level behavior.

Compares byte-value distribution to uniform [0, 255].

MetricExpected (uniform)
mean127.5
skewness~0
kurtosis~1.8
ks_p_valuePrefer >= 0.01

Large skew/kurtosis drift or very low KS p-values indicate non-uniform output.

Tests whether statistical behavior remains stable over time using 10 windows.

MetricDescription
is_stationaryHeuristic stationarity flag
f_statisticANOVA-like F statistic
window_meansMean per window
window_std_devsStandard deviation per window

Non-stationary behavior can indicate drift from temperature, scheduler load, or source-state transitions.

Measures run structure in repeated values.

MetricDescription
longest_runLongest identical-value streak
expected_longest_runExpected longest streak
total_runsTotal run count
expected_runsExpected total runs

Run metrics far from expectation can indicate stickiness or insufficient mixing.