omarash/sysmon-anomaly-calibration

SysMon Anomaly Calibration

A browser-only reproducibility demo derived from my SysMon AI project.

The Space uses precomputed Isolation Forest scores on synthetic telemetry. Training and scoring were performed offline with scikit-learn; the browser only changes the calibration threshold and recomputes the held-out metrics. This keeps the Space fully static while preserving the experimental idea being demonstrated.

Protocol

1. 1.Fit Isolation Forest on synthetic normal telemetry.
2. 2.Score a separate normal calibration window.
3. 3.Select a threshold from a requested calibration false-positive rate.
4. 4.Apply that threshold to a separate test window containing injected anomalies.
5. 5.Report spam-style minority metrics: precision, recall, F1, observed false-positive rate, and accuracy.

Important limitation

This is a synthetic methodological demonstration, not a claim of production workstation performance. The full SysMon engineering project and case study remain the canonical sources for system-level results.

• —GitHub: https://github.com/oashraff/sysmon-ai
• —Portfolio: https://omarash.vercel.app