- Add /api/active-anomalies endpoint — latest snapshot per PID where is_anomaly=1
- Active threats card with pulsing indicator, CPU/RAM/TCP per process
- Alerts by severity donut chart (high/medium/low)
- Top processes horizontal bar chart weighted by alert count
- Replace IsolationForest with voting ensemble (IF + LOF + OC-SVM),
anomaly flagged when ≥ 2/3 models agree
- Normalise per-process cpu_percent by CPU count to prevent false
positives from multi-threaded processes (e.g. Firefox 130% → 65%)
- Deduplicate alerts: same PID anomalous within 30s updates last_seen
and count instead of inserting a new row; WS broadcast only on first
occurrence
- Show Duration column in Alerts table (e.g. "2м 30с ×28")
- Increase synthetic training data from 2000 to 10000 rows
- Add DB migration for last_seen/count columns on existing databases
kilyabin
