Your question is Detect Anomalies in Network Log Streams. Start with the requirements on the right.
Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.
Zscaler telemetry pipelines receive network logs in stream order. Given a finite representation of that stream, identify events whose byte volume is unusually high compared with recent events from the same source IP.
For each log, compare bytes with the previous window_size logs having the same source_ip. An event is anomalous when it is greater than mean + z_threshold * standard_deviation of that prior window. Do not use the current event when computing statistics. If fewer than two prior events exist, the event is not anomalous. If the prior standard deviation is zero, treat a strictly larger value as anomalous.
Implement detect_anomalies(logs, window_size, z_threshold). logs is a list of dictionaries with integer timestamp, string source_ip, and nonnegative integer bytes fields. Return a list of zero-based indices of anomalous logs in input order. Timestamps are nondecreasing, and logs from multiple source IPs may be interleaved.
def detect_anomalies(logs, window_size, z_threshold):