IoT Telemetry Drift Monitor: EWMA Control-Chart Intrusion Detection

A ring of 24 IoT sensor devices streams noisy telemetry around a shared baseline, rendered in 3D as pillars around a central hub whose height tracks each device's smoothed deviation. A handful of devices are silently compromised and their true readings begin drifting away from baseline — a stand-in for spoofed sensor data, tampered firmware, or a hijacked device feeding fabricated telemetry into the fleet. An EWMA (exponentially weighted moving average) statistical control chart, the same class of detector real IoT monitoring and SIEM pipelines use for baseline-drift anomaly detection, watches every device independently and raises an alarm the moment a device's smoothed statistic crosses its time-varying control limits. Tune the smoothing factor λ, the control-limit width L, and the attacker's drift rate to see the fundamental trade-off between fast detection and false alarms play out live, with mean-time-to-detect and false-positive counters tracking the arms race in real time.