IoT Telemetry Drift Monitor (2D): EWMA Control-Chart Intrusion Detection

A ring of 24 IoT sensor devices streams noisy telemetry around a shared baseline, rendered here as a top-down 2D radial topology map: each device is a dot on the ring with a radial bar whose length tracks its smoothed deviation, and you can drag the ring to rotate it. A handful of devices are silently compromised and their true readings begin drifting away from baseline — a stand-in for spoofed sensor data, tampered firmware, or a hijacked device feeding fabricated telemetry into the fleet. An EWMA (exponentially weighted moving average) statistical control chart, the same class of detector real IoT monitoring and SIEM pipelines use for baseline-drift anomaly detection, watches every device independently and raises an alarm the moment a device's smoothed statistic crosses its time-varying control limits. Click any device to open a live control-chart strip tracing its raw readings, EWMA statistic, and control-limit band over time. Tune the smoothing factor λ, the control-limit width L, and the attacker's drift rate to see the fundamental trade-off between fast detection and false alarms play out live, with mean-time-to-detect and false-positive counters tracking the arms race in real time.