Abstract
Classification-based intrusion detection establishes whether an attack is present, but it does not indicate how much time remains before an adversary reaches a critical objective. Survival analysis and time-to-event modelling address this temporal question, yet the resulting work remains scattered across the risk-management, detection, and reliability literature and is thinner than the raw publication counts suggest. Following the PRISMA 2020 guidelines, 534 records were retrieved from five bulk-exportable databases (IEEE Xplore, Web of Science, ScienceDirect, Scopus, and the ACM Digital Library), supplemented by a manual SpringerLink search and by citation chasing, and, after de-duplication and screening against a strict estimand-based eligibility criterion (an attack-related time as the reported outcome, with explicitly claimed temporal contributions audited against the implemented analysis), 22 studies were retained, 18 from database searching and four from citation chasing. The retained work forms a continuous but thin line from 2006 onward. Time to compromise is the dominant temporal quantity (twelve studies); eight studies use methods built to accommodate censoring, although explicit treatment of censored observations (a censoring rule carried into the fit) is documented in five. Mapping the corpus against five checkable requirements—a censoring-aware time-to-event method, explicit treatment of censoring, a per-stage unit of analysis, residual time to compromise as the estimand, and validation on real stage-labelled traffic—shows that no retained study satisfies their conjunction. Two of the requirements—a censoring-aware method and explicit treatment of censoring—are met individually within the corpus, while a per-stage unit of analysis, residual time to compromise as the estimand, and validation on real stage-labelled traffic are each met by no retained study, the last because the real data used carry no annotated stage boundaries; the gap lies at their conjunction. The review’s contribution is threefold: an estimand-based reframing that separates residual time to compromise from conventional time to compromise, a five-requirement specification for an operational residual-time estimator, and a staged research roadmap toward it that includes integration with security-monitoring pipelines. This absence within the searched and retained corpus, rather than any single missing method, defines what residual time-to-compromise estimation must supply; it characterises the surveyed literature and is not a claim that no such estimator exists anywhere.