I built a 3D network router that "senses" attacks instead of just watching an alarm number

Built a 3D grid network simulator in C++. Packets move between nodes and reroute around traffic jams. On top of that, I built a controller that watches the overall behavior of the network — not just one alarm number — using 4 signals together: how full it is, how much is getting dropped, how fast it recovers after a spike, and how much room is left.

I compared it against a normal "alarm" style monitor — the kind most systems use, which only reacts once one number crosses a fixed line (here: more than 5% of traffic dropped, or the network more than 40% full)..

I threw 5 different fake attacks at both systems, across two network sizes, and added up the totals:

\\-Packets delivered:

my controller 1,091,830 vs normal monitor 613,472

(mine delivered 1.8x more)

\\-Average traffic lost, across ALL 5 attacks: mine (23% ) vs. normal monitor (28%)

(Quick note on those two percentages — some attacks are brutal and cause heavy loss no matter what, others are quiet and barely register. 23% and 28% are just the average across all of them combined. The real story is in the next part.)

Two of the five attacks — a slow quiet flood, and a sneaky targeted overload — never dropped more than 1% of traffic. That means the normal alarm-style monitor never noticed them at all, because it was only built to react once something gets loud, and these two stayed quiet on purpose.

My controller still caught both of them. Even though no single number spiked, the overall pattern still looked different from what normal traffic looks like — kind of like noticing something feels "off" about a room, even when nothing's visibly broken.


Code: https://github.com/Antriksh005/arena3d.

Been working on this for now some months , so Genuinely want criticism, especially on how I'm measuring "detection" — that part deserves scrutiny.

https://redd.it/1v7xg86
@r_cpp