AI SOC Alert Fatigue: Detection Threshold vs Dwell Time

AI-driven security operations centers score every event — network flow, login, file access — with an anomaly model, then flag anything above a detection threshold for a human analyst. This simulator renders that pipeline as a live 3D stream: benign traffic and active intrusions crawl down a timeline toward a glowing detection plane set at your chosen threshold θ. Raising θ cuts false alarms but lets stealthier attacks (low signal separation Δμ) slip through; lowering it catches more attacks but floods the analyst queue, and once the alert rate exceeds their capacity a fatigue penalty kicks in that makes even correctly flagged intrusions likelier to be missed. Live readouts track the true/false positive rate implied by the underlying Gaussian score distributions alongside the actually-simulated alert rate, fatigue factor, mean dwell time (how long an intrusion survives before being caught), and breach count — the exact operational trade-off real SOC teams tune every day.