Cyber Attack Classification: Nearest-Centroid Decision Landscape

Event Stream

Spawn rate 3.0 / s

Feature noise σ 0.08

Playback speed 1.0×

Classifier Readouts

Accuracy

—

Avg. confidence

—

Events classified

Attack Taxonomy (nearest centroid)

How it works

Real security triage does not need three separate axes to be useful — the same stealth / origin / objective taxonomy can be honestly compressed onto a 2D plane: the x-axis is stealth (covert vs. overt) and the y-axis is exposure, the average of the origin and objective scores. Six attack classes sit at fixed centroids c_k on this plane (legend, right). Instead of orbiting a 3D cube, this view renders the classifier's actual decision landscape: every pixel of the plane is evaluated once against all six centroids and shaded by the predicted class, so the boundaries you see are the real, computed regions where the nearest-centroid rule switches its answer — brighter where the classifier is confident, greyer near a boundary where two classes are nearly tied.

v = c_true + N(0, σ²)             (noisy 2D sample)
d_k   = ‖v − c_k‖
ŷ     = argmin_k d_k
conf  = softmax(−d_k / T)[ŷ]      (T = 0.25 temperature)

Every spawned event is a real sample of one true class, drawn with Gaussian noise of the size set by the σ slider. The dot appears at its actual noisy measured position on the landscape, and animates toward the centroid of the class the classifier assigned it to — the same computation that colors the field, just applied to one drawn sample at a time. A green ring means the assigned class matched the ground truth; red means the noise pushed the sample across a boundary into the wrong region. Raising σ pushes samples further from their true centroid — exactly like real attacks that blend traffic patterns to evade classification — and the live accuracy/confidence readouts track how the classifier degrades as the classes overlap.

Spawn rate — how many new attack events arrive per second.
Feature noise σ — how much a sample's measured position drifts from its true class centroid; low σ = clean separation, high σ = overlapping, ambiguous classes.
Show decision landscape — toggles the computed background shading that visualizes the classifier's real decision regions.

stealth → exposure ↑

Correctly classified Misclassified