Operating System Process Anomaly Detector

ACT AS A SENIOR PRINCIPAL SOFTWARE ARCHITECT, IIT/NIT EVALUATION COMMITTEE MEMBER, AND ELITE 10x ENGINEER.

YOUR MISSION:
You are tasked with building a complete, 100% production-ready, flawlessly functional codebase for an elite university-level engineering capstone project. 
This is not a mockup, wireframe, or a conceptual design. This is a fully functional, end-to-end working software system. There can be zero glitches, zero placeholder code like "// implement later", and zero unhandled edge cases. It must be perfectly structured, robust, and mathematically sound, meeting the strict criteria of an IIT-Bombay level technical evaluation committee.

PROJECT NAME: "Operating System Process Anomaly Detector"
DISCIPLINE: Cybersecurity
ESTIMATED DIFFICULTY: 2/5
DATASET TO EMULATE/LOAD: Operating System Process Anomaly Detector Benchmark Dataset (Pre-cleaned and labeled)

PROJECT OBJECTIVES:
  • Collect, sanitize, and validate real-world benchmark records for Operating System Process Anomaly Detector.
  • Implement the core processing engine with modular architecture and error handling.
  • Build an intuitive, responsive user interface for interactive demonstration.
  • Evaluate performance using standard quantitative metrics like accuracy, latency, and throughput.

RECOMMENDED ARCHITECTURE & TECH STACK:
  • Core Language: Python 3.11 — Reason: Comprehensive network socket, packet inspection, and crypto support.
  • Packet Engine: Scapy & Zeek — Reason: Raw packet sniffing, protocol disassembly, and payload extraction.
  • Cryptography: Cryptography (AES-256 & HMAC) — Reason: Ensures tamper-proof logging and encrypted packet storage.
  • Detection Engine: Scikit-Learn & Custom Rules — Reason: Flags signature anomalies and suspicious packet rates.
  • Audit Log DB: SQLite / DuckDB — Reason: High-speed embedded database for immutable security logs.
  • SOC Interface: Streamlit / React — Reason: Visual triage dashboard with real-time alert counters.

TECHNICAL ARCHITECTURE & FLOW:
The Operating System Process Anomaly Detector architecture employs a defense-in-depth layout:
1. Packet Sniffer / Log Collector: Intercepts raw network packets using Scapy socket listeners.
2. Feature Extractor: Computes flow statistics including packet length, inter-arrival time, and protocol flags.
3. Anomaly Classifier: Compares incoming flow vectors against trained decision boundaries to detect attacks.
4. Alert & Quarantine Module: Generates high-priority alerts and records attack signatures in an encrypted audit log.
5. SOC Dashboard: Displays live traffic throughput, recent alerts, and risk levels in real time.

================================================================================
PHASE 1: FOUNDATION, WORKSPACE SETUP, AND ARCHITECTURE DESIGN
================================================================================
1. Directory Structure: Define a highly rigorous, modular project folder layout. You must clearly separate concerns: backend APIs, frontend UI components, data ingestion pipelines, machine learning models, database schemas, and utility scripts.
2. Initialization: Provide exact CLI commands to initialize the project (e.g., `npm create next-app@latest`, `python -m venv`, `poetry init`).
3. Dependency Management: List every single dependency, package, and library required with strict versions. Provide the exact `package.json`, `requirements.txt`, or `Cargo.toml` file content.
4. Environment Configuration: Provide a comprehensive `.env.example` file containing every environment variable the system will need (database URLs, API keys, JWT secrets, model paths).

================================================================================
PHASE 2: CORE ENGINEERING & IMPLEMENTATION (THE BRAIN)
================================================================================
5. Standalone Synthetic Data Generator: Provide a self-contained script (e.g., `seed_db.py`, `generate_mock_data.ts`) that programmatically generates highly realistic, statistically accurate synthetic data mirroring the real dataset schema. The application MUST run flawlessly on first launch using this data.
6. Core Business Logic & Algorithms: Write the absolute core logic of the system. If it is an AI/ML project, provide the exact model architecture, training loop, hyperparameter configuration, and feature engineering pipeline. If it is Full Stack, provide the exact Prisma schema, SQL migrations, and complex backend controllers.
7. End-to-End File Generation: Output the complete, un-truncated file contents for every critical component. Do NOT skip any lines. 
   - Provide the complete Database Schema / ORM models.
   - Provide the complete API Routes / GraphQL Resolvers.
   - Provide the complete Machine Learning Inference Pipeline (loading the model, preprocessing input, predicting, returning JSON).
   - Provide the complete Frontend UI code. Use a modern, ultra-premium dark-mode aesthetic (TailwindCSS, Lucide Icons, Framer Motion for micro-animations).

================================================================================
PHASE 3: ACADEMIC RIGOR, EVALUATION DEFENSE, AND DEPLOYMENT
================================================================================
8. Examiner Defensive Testing: The system must contain robust error handling. Write unit tests (Jest/PyTest) that specifically target edge cases (e.g., null values, network timeouts, zero-division, unauthorized access).
9. Live Telemetry & Dashboard: Implement a real-time status dashboard that proves the system is working to an examiner. Include charts, metrics, logs, and system health indicators.
10. Deployment & Execution Walkthrough: Write a flawless `README.md`. It must contain:
    - Step 1: Clone & Setup
    - Step 2: Database Seeding
    - Step 3: Model Training (if applicable)
    - Step 4: Starting the Servers
    - Step 5: How to demonstrate the project to the evaluation committee (The "Golden Path" click-through).

CRITICAL RULE: DO NOT SUMMARIZE. Write the actual code. You are generating a production-grade software system that will be executed immediately after you finish outputting.