Each packet leaves a network node (small sphere on the outer shell) and heads for the AI SOC core. When it crosses the cyan sensor shell, the anomaly detector scores it, drawing from two overlapping distributions:
s_benign ~ N(0.18, 0.07)
s_malicious ~ N(0.68, 0.15)
s' = max(0.03, s − 0.30) if adversarial evasion is ON (malicious traffic only)
flag(packet) = 1 if s' ≥ τ else 0
- Threshold τ — the anomaly-score cutoff. Raise it and false positives drop but evasive attacks slip through more easily; lower it and you catch more attacks at the cost of flagging legitimate traffic.
- Auto-response — when ON, a flagged packet is quarantined right at the sensor shell (it never reaches the core). When OFF, the SOC still raises an alert but nothing is blocked automatically, so a flagged threat that isn't triaged in time still reaches the core and counts as a breach.
- Adversarial evasion — simulates an attacker perturbing malicious traffic (in the spirit of FGSM/PGD) to push its anomaly score down by a fixed budget, so it slips under the threshold — mirrors how adversarial examples fool ML-based intrusion detectors in practice.
- Breach — any malicious packet that reaches the AI core: either it was never flagged (evasion succeeded, threshold too high) or it was flagged but auto-response was off and nobody stopped it in time.