IoT Telemetry Drift Monitor: EWMA Control-Chart Intrusion Detection

Attack Configuration

Compromised devices 3

Spoof drift rate (σ/tick) 0.06

EWMA Detector

Smoothing λ 0.20

Control limit L (×σ) 3.0

Live Detection Stats

Alerts raised

Quarantined

0/24

False positives

Mean time to detect

— s

Normal — inside control limits
Compromised — drifting, not yet caught
Alarmed / quarantined

How it works

24 IoT sensors each stream a noisy telemetry reading around a shared baseline μ₀. An EWMA (exponentially weighted moving average) control chart smooths each device's stream independently:

z_t = λ·x_t + (1-λ)·z_(t-1),  z_0 = μ0

Time-varying control limits (Lucas & Saccucci 1990):
UCL_t = μ0 + L·σ·√[ λ/(2-λ)·(1-(1-λ)^(2t)) ]
LCL_t = μ0 - L·σ·√[ λ/(2-λ)·(1-(1-λ)^(2t)) ]

Alarm when z_t leaves [LCL_t, UCL_t]

A compromised device's true mean starts drifting away from μ₀ at the configured rate — a proxy for firmware tampering, sensor spoofing, or a hijacked device injecting fabricated readings into the fleet's telemetry pipeline. The EWMA statistic lags the raw signal on purpose: a larger λ tracks a sudden shift faster but also passes more noise through, so an attacker can tune drift rate against detector responsiveness exactly as in a real intrusion-vs-detection arms race.

λ (smoothing) — higher values react faster to sudden shifts but raise the false-positive rate on ordinary noise.
L (control limit width) — higher values tolerate more deviation before alarming, trading detection speed for fewer false alarms.
Drift rate — how aggressively a compromised device's true baseline moves per tick; slow drift is the harder case to catch.
Once alarmed, a device is quarantined (frozen, shown red) — the same automated-response step a real SOC/SOAR pipeline would trigger.

This is the same statistical-process-control math used by real IoT fleet-monitoring and SIEM anomaly pipelines to flag a device whose behaviour has quietly drifted from its historical baseline, long before a signature-based rule would catch it.

t = 0.0s

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.