The instruments in this series — the shield, the pulsar, the reactive armor, the singularity well — are visual metaphors for defensive postures. This companion does the unglamorous, defensible work: it maps each metaphor onto established intrusion-detection theory and lets you operate the three ideas that actually matter, with correct math you can check.
Strip the sci-fi skin and every device in the series corresponds to a recognized class of defensive control. The metaphor is the teaching aid; the right-hand column is the actual computer science a reviewer can check against the literature.
| Instrument | Metaphor action | Real defensive concept | Core tradeoff |
|---|---|---|---|
| Aegis-0 | reflect · clamp · fold | Layered filtering / defense-in-depth — input rejection, rate-limiting, quarantine | Cheap, but only stops what each rule anticipates |
| Witness Shield | absorb known · learn the rest | Signature (misuse) detection + online feature learning | Near-zero false positives on known threats; blind to novel ones |
| Pulsar v2.1 | life · death · spark sweep | Continuous monitoring + active response + self-repair (heal/block/regenerate) | High coverage, high operational cost |
| Reactive Armor | detect → detonate → deplete | Active response / IPS with finite capacity (rate-limited blocking, honeypots) | Effective until a focused load exhausts it |
| Singularity Well | capture → spiral → swallow | Sinkholing / tarpitting / blackhole routing — containment, nothing returns | Contains everything it catches — including benign traffic |
The well's defining trait — it swallows everything that crosses the horizon — is exactly the property that makes containment dangerous in practice: capacity is not the same as judgment. The next three sections are the judgment.
Benign and malicious events both produce a score (anomaly score, model confidence, rule weight). If the distributions were perfectly separated, detection would be trivial. They never are. You choose a threshold; everything above it fires an alarm. Move it and you trade missed attacks against false alarms — there is no setting that escapes the trade. The locus of all those trades is the ROC curve.
Mapping back: raising the threshold is the Aegis clamp tightening; AUC is how good the underlying sensor is before you pick any operating point. A perfect well has AUC near 1; a coin flip is 0.5.
This is the result every security analyst learns the hard way, formalized by Axelsson (2000): when genuine attacks are rare, even an excellent detector produces alarms that are mostly false — because the vast benign population generates more false positives than the tiny malicious population generates true ones. It's just Bayes' theorem, but it governs whether an alerting system is usable at all.
seed_packet is a Bloom filter.Throughout the series the core "learns" by folding an attack into a 16-bit seed_packet with XOR, then "absorbs" a future hit if it matches. That is a real data structure: a Bloom filter (Bloom, 1970) — a bit array with several hash functions that answers set membership in constant time and constant space. Its bargain is precise: it can say "definitely never seen" or "probably seen" — it never misses a known signature, but as it fills it produces false positives. Add known-bad tokens below and probe it.
A capstone artifact has to be honest about its own model. Here is the clean separation, so nothing above is mistaken for a literal claim about how production systems work.
The ROC curve, TPR/FPR from two Gaussians, and AUC = Φ(d′/√2). The confusion matrix. Bayesian precision under varying base rate. The Bloom filter's hashing, true-positive guarantee, and rising false-positive rate. All of this runs live and matches the closed-form theory.
The taxonomy mapping each instrument to a defensive control class (filtering, signature detection, anomaly detection, active response, sinkholing) reflects standard categorization in the literature.
Verification artifact: the ROC/AUC, Bayesian precision, and Bloom false-positive rate in this page were checked against their closed-form expressions before publication (AUC at d′=2 → 0.9214; precision at TPR .99 / FPR .01 / prevalence 1e-4 → ~0.98%).