发表机构
University of Minnesota（明尼苏达大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
Harbormaster 是 AWS 上的海事异常检测系统，通过物理检查、幂等存储和门控发布确保警报可归因、可审查、可恢复，并验证了回放安全性与性能。
AI 中文摘要
船舶通过自动识别系统（AIS）广播其位置，而这些报告可能为虚假或缺失。操作员若依据异常警报采取行动，需要该警报在故障后具备可归因性、可审查性和可恢复性。本文描述了 Harbormaster，一个部署在 AWS 上的生产形态系统，遵循三条规则。物理检查在每条报告上运行，先于任何学习模型。DynamoDB 读取存储是 PostgreSQL 的幂等投影，且对每次写入的日志序列号（LSN）进行守卫保护。候选模型必须通过保留门控和影子比较，之后金丝雀发布才分配流量，且燃烧率检查守卫每个金丝雀步骤。本文证明，重放变更日志的任何前缀或后缀都会使每个投影键保持在其最高已应用 LSN 的值。本文还指出了该结果未涵盖的影响，例如重复缓存失效和重复审计行。在受限的 AWS 窗口中，一小时的浸泡测试对 36,000 个请求返回了 35,999 个 HTTP 200 响应，95 百分位（p95）客户端延迟为 142.751 毫秒。在另一次 900 秒的受限 AWS 运行中，流路径接收了每秒 400 条记录的突发，其消费者滞后随后降至零。论文中的每个数字都带有标签，标明测量位置，并列出设计中从未构建的部分。
英文摘要
Ships broadcast their positions through the Automatic Identification System (AIS), and those reports can be false or missing. An operator who acts on an anomaly alert needs that alert to be attributable, reviewable, and recoverable after a failure. This paper describes Harbormaster, a production-shaped system on AWS that follows three rules. Physics checks run on every report before any learned model runs. The DynamoDB read store is an idempotent projection of PostgreSQL, and a guard on the log sequence number (LSN) of each change protects every write to it. A candidate model must pass a holdout gate and a shadow comparison before a canary gives it traffic, and a burn-rate check guards each canary step. The paper proves that replaying any prefix or suffix of the change log leaves each projected key at the value of its highest applied LSN. It also notes effects this result does not cover, such as repeated cache invalidations and repeated audit rows. In a bounded AWS window, a one-hour soak returned 35,999 HTTP 200 responses to 36,000 requests, with a 95th-percentile (p95) client latency of 142.751 ms. In a separate bounded AWS run of 900 s, the stream path received a burst of 400 records/s, and its consumer lag later drained to zero. Every number in the paper carries a label that says where it was measured, and the paper lists the parts of the design that were never built.
