Each packet leaves a network node on the outer ring and heads for the AI SOC core. When it crosses the cyan sensor ring, the anomaly detector scores it, drawing from two overlapping distributions:
s_benign ~ N(0.18, 0.07)
s_malicious ~ N(0.68, 0.15)
s' = max(0.03, s − 0.30) if adversarial evasion is ON (malicious traffic only)
flag(packet) = 1 if s' ≥ τ else 0
- Threshold τ — the anomaly-score cutoff. Raise it and false positives drop but evasive attacks slip through more easily; lower it and you catch more attacks at the cost of flagging legitimate traffic.
- Auto-response — when ON, a flagged packet is quarantined right at the sensor ring (it never reaches the core). When OFF, the SOC still raises an alert but nothing is blocked automatically, so a flagged threat that isn't triaged in time still reaches the core and counts as a breach.
- Adversarial evasion — simulates an attacker perturbing malicious traffic (in the spirit of FGSM/PGD) to push its anomaly score down by a fixed budget, so it slips under the threshold — mirrors how adversarial examples fool ML-based intrusion detectors in practice.
- Breach — any malicious packet that reaches the AI core: either it was never flagged (evasion succeeded, threshold too high) or it was flagged but auto-response was off and nobody stopped it in time.