Cyber Attack Classification: Nearest-Centroid Taxonomy Engine

Event Stream

Spawn rate 3.0 / s

Feature noise σ 0.08

Playback speed 1.0×

Classifier Readouts

Accuracy

—

Avg. confidence

—

Events classified

Attack Taxonomy (nearest centroid)

How it works

Real threat classification sorts an incoming event along several independent axes at once — how covert it is, where it originates, and what it is trying to achieve. This simulator encodes three of the standard criteria as a 3D feature space:

x = stealth   (0 = overt/active,  1 = covert/passive)
y = origin    (0 = internal,      1 = external)
z = objective (0 = sabotage,      1 = data theft / espionage)

Six attack classes each sit at a fixed centroid c_k in this cube (right panel legend). Every spawned event is a real sample drawn as v = c_true + N(0, σ²) — the true class centroid plus Gaussian noise of the size you set with the σ slider. A nearest-centroid classifier then assigns the event to the class it is closest to in Euclidean distance:

d_k   = ‖v − c_k‖
ŷ     = argmin_k d_k
conf  = softmax(−d_k / T)[ŷ]      (T = 0.25 temperature)

The particle flies toward its predicted centroid and is colored by that predicted class; a thin ring shows whether the prediction matched the ground-truth class it was actually spawned from (green = correct, red = misclassified). Raising σ pushes samples further from their true centroid — exactly like real-world attacks that deliberately blend traffic patterns to evade classification — and the live accuracy/confidence readouts track how the classifier degrades as classes overlap.

Spawn rate — how many new attack events arrive per second.
Feature noise σ — how much a sample's measured features drift from its true class centroid; low σ = clean separation, high σ = overlapping, ambiguous classes.
Show class centroids — toggles the labelled anchor spheres and their connecting axis frame.

Correctly classified Misclassified

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.