Instead of following one attacker through a rotatable 3D graph, this version runs a whole swarm of independent attackers at once across a 2D concentric-ring identity graph, and plots how many probes each one takes before a honeytoken trips an alert. That turns the theoretical law into something you can watch converge live:
p = d·s (chance any single probe both hits a honeytoken AND is caught)
P(detected exactly on probe k) = p·(1−p)^(k−1) — geometric distribution
E[MTTD] = 1/p = 1/(d·s) — its mean
d = honeytoken density among identities
s = monitoring sensitivity (chance a touch is actually caught)
- Ring graph — three concentric rings (Tier 0 outer, Tier 1 middle, Tier 2 inner core) laid out directly in 2D with golden-angle spacing, linked by the same trust-path rules as the directory: users reach a few privileged accounts, privileged accounts reach the admin core, the core is a small clique.
- Ensemble — every attacker walks the graph independently and in parallel; the moment one is detected it is replaced by a fresh attacker at a random Tier 0 identity, so the histogram keeps filling in.
- Histogram vs theory — the bar chart is the empirical distribution of probes-to-detection collected so far; the overlaid curve is the theoretical geometric PMF scaled to the same sample count. They should converge as more samples accumulate — a direct visual proof of the 1/(d·s) law.
- Strategy — "Random" samples any reachable neighbour uniformly; "Targeted" biases the walk toward higher tiers, changing which honeytokens get found first and how quickly the admin core is reached.