A framework for identifying when a team is attacking against a set (organized) defense using only event data. Since no data feed labels "set defense" directly, four proxy thresholds are applied simultaneously to each event: (1) duration — event must be ≥20 seconds into the possession (defense has finished its transition), (2) pinballing — attacking team must control ≥80% of actions in the preceding window (not chaotic back-and-forth), (3) height — 3-event rolling average of ball distance from own goal must exceed the 60th percentile of center-back pass locations (~60m threshold), indicating attacking intent, (4) verticality — vertical speed must be <4.3 m/s (derived from the boundary between counter-attack and regular play distributions). When all four conditions are satisfied simultaneously, the event is classified as "attacking against a set defense."
Filter to attacking possessions that reach the final third (exclude set pieces — they introduce noise). For each event in qualifying possessions: check all four thresholds simultaneously. Events meeting all four = "true" (probing against set defense). Events failing one or more = "false" (transition moments, resets, or acceleration attempts). A possession against a set defense consists of alternating true and false blocks. Both matter: true blocks are the probing state; false blocks are the team's attempts to break the structure. Analyze both.
Key threshold derivations: