If my correction is correct, we do have evidence of something rarely occurring.
Thank you for undertaking this.
What we have in that sample is evidence that there are inaccurate clocks in some miners. (This much is clear from a time stamp preceding a block it has hashed as the previous in the chain.)
Those time stamps come from the computers of the miners, they are not the times that blocks are received.
NTP (network time protocol, used for clock syncing on computers) is a UDP protocol, it is not reliable, and miners may not even use it. It also has exploitable holes, MITM vulnerabilities and other issues. So yes, it could be malice (to generate unjustified fear), it could also be laziness, carelessness or even miner caution or tuning (avoiding an unprofitable process). What it isn't is evidence of an attack vector. There is no significant damage resulting from this sort of activity.
I looked at this earlier and wrote a bit more about it up-thread, here:
https://bitcointalk.org/index.php?topic=789978.msg9039996#msg9039996If your curiosity compels you, it may be interesting to analyze this sample against the data set from the rest of the chain to more accurately assess how much of an anomaly it is (though it may not be worth the bother considering the negligible consequences), and so your calculations here, while accurate, start with this mistaken premise.
What I wrote in red clearly indicates I was not alleging an abnormality nor an attack.
So you can view my point in red above as the beginning of an investigation into modeling.
If the timestamps are basically meaningless then we won't know if an attack is underway or not, i.e. there is no possible model
thus claiming "nothing is going on" is a lie (if there is no model to inform us). And I that is the most relevant point.
And if the timestamps are very unreliable, then perhaps the loose rules about timestamps are exploitable.
And maybe not. Any proof one way or the other?
I suppose you assume that with checkpoints the block chain can't be rewound, but are you sure that eliminates all possible damage that can be done by manipulating timestamps?
What about amplifying selfish mining attacks by causing oscillation in the difficulty adjustment via timestamp planting, e.g. to take advantage of the fact that 20% of the timestamps are discarded when the difficulty is calculated. Have ideas like this been analyzed?