Part 2 — From “Anomaly Detected” to “Who Did What?” (Top Talkers + Context + Live Mode)

In Part 1, you built the core mini IDS: parse traffic → window it → extract features → baseline → flag anomalies.