Decision pipeline
Waiting for the first 2-second window…1 · Flow counters
What the switches reported for this host in the last window.
2 · Features
14 values computed from the counters. Bold = top SHAP drivers.
3 · Random Forest
Share of 150 trees voting for each class.
Ticks: act at 0.70 · block at 0.90
4 · SHAP explanation
Why the model chose this class.
supportsargues against
5 · Safety gates
6 · Decision
Network
Select a host to inspect it. ↑ sent ↓ received in packets/s. Moving dashes = active traffic.Packets sent per host
Up to the last 10 minutes · log scale · shaded = launched episode · red line = mitigationDecision log
Every window the model classified as an attack, with its explanation and gate results| Time | Host | Prediction | Why (top SHAP features) | Gates | Action |
|---|
No attack-like traffic yet. Launch an attack from Controls to see the pipeline react.
Active mitigations
Rules expire on their ownControls
Watching is open to everyone. Sign in to launch attacks or change protection.
Launched episodes
Measured live: time from launch to first detection and to mitigation| Start | Episode | Detected | Mitigated | Result |
|---|
Nothing launched yet.
