Cyber Attack Classification: Nearest-Centroid Decision Landscape

Real security-operations triage scores an incoming event against known attack profiles and assigns it to whichever one it statistically resembles most. This 2D simulator makes the classifier's actual decision-making visible as a computed landscape rather than a rotating scene: six attack classes — DDoS/flooding, ransomware, phishing & social engineering, advanced persistent threat espionage, insider data exfiltration and insider sabotage — sit at fixed centroids on a stealth × exposure plane, and every pixel of that plane is shaded by which class a real nearest-centroid classifier would assign there, with confidence encoded as brightness. Every spawned event is a noisy sample of one true class; a real nearest-centroid rule with a softmax confidence score assigns it to the class it is closest to, animates it toward that centroid, and marks whether the prediction matched the ground truth. Raise the noise slider to watch classification accuracy degrade exactly as it does when real attacks blend their traffic patterns to evade detection.