Static · synthetic-only · reproducible

SysMon Anomaly Calibration

Explore one research decision from SysMon: choose an anomaly threshold from a separate normal calibration window instead of using an arbitrary raw score cutoff. Isolation Forest scores below were precomputed offline; thresholding and metrics are recomputed in your browser.

Target calibration false-positive rate

5.0%

Injected anomaly prevalence

Held-out test window

Precomputed experiment seed

Isolation Forest · contamination 5%

Anomaly precision–

Anomaly recall–

Anomaly F1–

Observed test FPR–

Accuracy–

Calibrated threshold–

The blue trace is the held-out anomaly score. Red points are injected anomalies. The dashed line is the threshold selected from a separate all-normal calibration window. A requested calibration FPR is a target on that window—not a guarantee of the same FPR after distribution shift.

What this demonstrates

Model evaluation includes operating-point selection. This demo isolates that decision from SysMon's larger time-series feature and monitoring pipeline. It is deliberately synthetic and should not be interpreted as a production benchmark.

GitHub source ↗ Portfolio ↗