Zscaler telemetry pipelines receive network logs in stream order. Given a finite representation of that stream, identify events whose byte volume is unusually high compared with recent events from the same source IP.
For each log, compare bytes with the previous window_size logs having the same source_ip. An event is anomalous when it is greater than mean + z_threshold * standard_deviation of that prior window. Do not use the current event when computing statistics. If fewer than two prior events exist, the event is not anomalous. If the prior standard deviation is zero, treat a strictly larger value as anomalous.
Implement detect_anomalies(logs, window_size, z_threshold). logs is a list of dictionaries with integer timestamp, string source_ip, and nonnegative integer bytes fields. Return a list of zero-based indices of anomalous logs in input order. Timestamps are nondecreasing, and logs from multiple source IPs may be interleaved.
def detect_anomalies(logs, window_size, z_threshold):