Firewall & IDS Threshold Simulator

Traffic

Attack traffic share 30%

Packet rate 18 /s

Firewall / IDS

Block threshold 0.55

Attacker evasion (score noise σ) 0.16

Confusion Matrix (session)

Blocked attacks (TP)

Missed attacks (FN)

Blocked legit (FP)

Allowed legit (TN)

Detection rate (TPR)

False-positive rate

Accuracy

Total packets

Legitimate packet

Malicious packet

Blocked at gate

How it works

Every packet is assigned a hidden anomaly score s ∈ [0,1] drawn from a normal distribution centered on its true class:

legit:      s ~ N(0.30, σ)
malicious:  s ~ N(0.70, σ)
firewall rule:  block if  s > threshold  else allow

This is the same signal-detection-theory setup behind every real IDS: an anomaly/reputation score is compared to a cutoff. Raising the threshold blocks less traffic overall (fewer false positives, but more attacks slip through). Raising evasion noise σ makes malicious traffic statistically mimic legitimate traffic — exactly what IP spoofing, low-and-slow scans and encrypted C2 channels do in practice — widening the overlap between the two curves so no single threshold can separate them perfectly.

TPR (recall) = TP / (TP + FN) — the share of real attacks actually blocked.
FPR = FP / (FP + TN) — the share of legitimate users wrongly blocked.
Sweeping the threshold traces a classic ROC trade-off: push it down and TPR rises but so does FPR; push it up and the reverse happens. There is no threshold that maximizes both at once when the score distributions overlap.

throughput: 0 pkt/s

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.