🚨 Network Intrusion Detector — Anomaly Scoring Live

Once score exceeds the threshold, the simulation looks at which individual z-scores are driving the anomaly. If the distinct-ports z-score is strongly positive while the duration z-score is strongly negative, the signature matches many ports touched in very little time — classified as a port scan. If the bytes-per-packet and duration z-scores are both strongly positive while distinct ports stays low, the signature matches a large, sustained, narrow data transfer — classified as exfiltration. Anything flagged that does not clearly match either signature is labelled a generic anomaly. This mirrors how real SOC analysts triage an alert: the raw anomaly score says something is unusual, but the feature breakdown says what kind of unusual it is.

Lowering the threshold flags more connections: recall rises (fewer real intrusions slip through as false negatives) but precision falls (more ordinary traffic gets wrongly flagged as false positives, an effect analysts call alert fatigue). Raising the threshold does the opposite — fewer alerts, higher precision, but a growing chance that real scans or exfiltration sessions go unflagged. There is no universally correct setting: a bank's SOC might tolerate a higher false-positive rate to catch more real threats, while a service with a small security team might raise the threshold simply because it cannot triage a flood of alerts.

Real network traffic drifts constantly — a new application rolls out, a backup schedule changes, remote work shifts the time-of-day traffic profile — a phenomenon called concept drift. A detector trained once on last month's traffic and never updated will slowly drift out of calibration: either flagging more and more normal-but-new behaviour as false positives, or (worse) treating a slow, deliberate attack as the new normal because it crept in gradually. Recomputing mean and standard deviation from a rolling window of recently-unflagged connections lets the baseline track legitimate drift while still resisting attacks that arrive as a sudden burst, at the cost of being vulnerable to attackers who deliberately ramp up slowly enough to be absorbed into the baseline — a well-known limitation sometimes called boiling-frog poisoning.

Treating the four features as uncorrelated (summing independent z-scores) ignores real correlations — for example, high packet rate and low bytes-per-packet tend to co-occur naturally in normal short requests, so a full covariance matrix would draw a tilted, elliptical normal region instead of this simulation's axis-aligned one, and would flag fewer of those naturally-correlated points as anomalous. Production systems go further still: isolation forests, autoencoders, and other machine-learning models capture nonlinear and higher-order structure across dozens of features, and are typically combined with signature rules, threat-intelligence feeds, and human analyst review rather than relying on a single statistical score in isolation.

A false negative — a missed intrusion — can mean data actually leaves the network or a foothold goes undetected, with costs measured in breach remediation, regulatory exposure, and reputational damage. A false positive costs analyst time: someone has to open the alert, pull the logs, and conclude it was benign. Because analyst time is finite and every real SOC receives far more alerts than it can fully investigate, a detector tuned only for recall (catch everything) can be self-defeating if it buries genuine alerts under a flood of false ones — which is exactly why the precision/recall tradeoff exposed by this simulation's threshold slider is the central operational decision in real intrusion detection, not just a statistical curiosity.