fix: resolve lab12 timeline anomaly variable flow

[depalmar]

Summary

• fix Lab 12 timeline block to score with X_scaled instead of undefined X_test_scaled
• ensure df['iso_pred'] is populated from iso_pred before anomaly filtering
• replace missing df['bytes'] reference with df['bytes_sent'] + df['bytes_recv']

Test plan

• Execute notebooks/lab12_anomaly_detection.ipynb with jupyter nbconvert --execute
• Confirm no X_test_scaled NameError in timeline cell
• Confirm timeline chart renders using total bytes over time

---

Note

Low Risk
Low risk: notebook-only fixes to variable references and plotting inputs; behavior change is limited to the timeline visualization and anomaly flagging logic.

Overview
Fixes the Lab 12 attack timeline cell to compute Isolation Forest scores against X_scaled (avoiding an undefined X_test_scaled) and to explicitly store iso_pred on df before deriving is_anomaly using the correct -1 anomaly convention.

Updates the traffic-volume plot to use total bytes (bytes_sent + bytes_recv) instead of a missing bytes column so the timeline chart renders correctly.

^{Written by Cursor Bugbot for commit b1b68da. This will update automatically on new commits. Configure here.}

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[cursor]

No high-confidence vulnerabilities found in this PR.

Security review of the diff in notebooks/lab12_anomaly_detection.ipynb found only notebook-local dataflow/visualization fixes:

• score_samples input changed from X_test_scaled to X_scaled
• anomaly flag logic corrected to iso_pred == -1
• traffic plot y-axis changed to bytes_sent + bytes_recv

These changes do not introduce new external input processing, auth logic, command/query construction, deserialization, network request handling, or secret management paths.

Residual risk / validation note:

• This is a notebook change and appears non-production, but if notebook outputs are later operationalized, keep the same controls around input validation and logging hygiene.

  

_{Sent by Cursor Automation: Find vulnerabilities}