Every host on the map sends packets at some rate. Clean hosts chat with a few neighbours a couple of times a minute; a bot beacons to the command-and-control (C2) server on a tight, regular interval and sometimes floods it — its packet rate sits far outside the crowd. The detector doesn't know which hosts are infected. Every second it measures each host's packet rate over a rolling window, then scores it against the whole population:
rate_i = packets(host i, last 4s) / 4s
μ = mean(rate) over all active hosts
σ = stdev(rate) over all active hosts
z_i = (rate_i − μ) / σ
flag host i if z_i > threshold
- Infected hosts — ground-truth fraction of the population running the bot; more infected hosts pull μ and σ upward and make outliers harder to see, exactly like a real detector's blind spot at high infection rates.
- Lateral spread rate — chance per second an infected, non-quarantined host recruits a neighbour it talks to, growing the botnet over time unless you intervene.
- Z-score threshold — the σ multiple a host's rate must clear to be flagged. Drag it down and the detector gets trigger-happy (more true positives, more false alarms); drag it up and it only flags the loudest, most obvious bots.
- Click any host highlighted with an amber ring to quarantine it — it stops sending and receiving traffic and drops out of both the botnet and the detector's population statistics.
Real-world relevance: this rolling-window z-score is a simplified version of the volumetric/behavioural anomaly detection network defenders run against NetFlow data to spot C2 beaconing and DDoS staging before the attack payload fires.