AI-Based Network Behaviour Profiling System

Composite Anomaly Score

score threshold injected attack

Alerts

Simulation

Inject Attack Scenario

Temporarily shifts traffic to simulate an attack, so you can watch the detector respond in real time.

Detector Tuning

Sensitivity (z-score threshold): 4.0σ Baseline adaptation rate: 0.05

The baseline deliberately stops updating on any tick it flags as anomalous — otherwise a sustained attack would get smoothed into "normal" and the detector would go blind to its own alert. This rate instead controls how fast the baseline settles after warm-up, and how fast it re-stabilizes once an attack ends.

Detector Performance

Computed against the ground truth of when an attack was actually injected. Precision drops with false alarms; recall drops with missed attacks.

Precision—

Recall—

TP0

FP0

FN0

About

Baseline "normal" behaviour is learned live via an EWMA mean/variance per traffic metric (packets/sec, bytes/sec, avg packet size, unique destination ports). Each new sample gets a z-score against that baseline; a composite anomaly score is the largest absolute z-score across metrics. The baseline only updates on ticks that aren't flagged, so a sustained attack can't smooth itself into "normal." A separate detector tracks the regularity (coefficient of variation) of new-connection timing to catch beaconing — a pattern that's deliberately invisible to the magnitude-based z-scores, to demonstrate why one technique alone isn't enough.