statistics, chart, abnormal log

app.py

@@ -4,22 +4,74 @@ import pandas as pd
 import joblib
 from sklearn.cluster import HDBSCAN
 import numpy as np
-import logger_service  # 🌟 保持：匯入外部日誌服務模組
+import logger_service
+import os
+import urllib.request
+import matplotlib.pyplot as plt
+import seaborn as sns
+import matplotlib.font_manager as fm
+
+# --- 🌟 解決 Matplotlib 中文顯示問題 ---
+# 啟動時自動下載並套用 SimHei (黑體) 字型，避免圖表出現方塊豆腐字
+font_path = 'SimHei.ttf'
+if not os.path.exists(font_path):
+    try:
+        print("📥 正在下載中文字型...")
+        urllib.request.urlretrieve('https://github.com/StellarCN/scp_zh/raw/master/fonts/SimHei.ttf', font_path)
+    except Exception as e:
+        print(f"⚠️ 字型下載失敗: {e}")
+
+if os.path.exists(font_path):
+    fm.fontManager.addfont(font_path)
+    plt.rc('font', family='SimHei')
+plt.rcParams['axes.unicode_minus'] = False
+
+# --- 全域統計狀態變數 ---
+global_stats = {
+    "total_count": 0,
+    "abnormal_count": 0,
+    "start_time": datetime.datetime.now()
+}
+
+# --- 13 個系統按鈕的對應字典 ---
+ACTION_MAP = {
+    "教務系統: 期末網路教學評量": "click_eval_system",
+    "教務系統: 期末網路預選系統": "click_pre_select_system",
+    "教務系統: 開學後加退選系統": "click_add_drop_system",
+    "教務系統: 北科i學園PLUS": "click_istudy",
+    "教務系統: 學生證掛失及補發系統": "click_card_loss",
+    "教務系統: 課程系統": "click_course_system",
+    "教務系統: 學業成績查詢系統": "click_score_query",
+    "學務系統: 學生請假系統": "click_leave_system",
+    "學務系統: 學生宿舍登錄(抽籤)系統": "click_dorm_system",
+    "學務系統: 獎助學金申請系統": "click_scholarship",
+    "資訊服務: 網路郵局 WebMail": "click_webmail",
+    "資訊服務: 北科軟體雲": "click_vdesk",
+    "惡意測試: 嘗試偷改成績 (SQL Injection)": "malicious_sql_injection"
+}
 
-# 初始化歷史日誌串列
 log_history = []
+initial_df_abn = pd.DataFrame(columns=["timestamp", "ip_address", "cookie_id", "account", "role", "action", "status"])
 
 # --- 1. 載入模型與歷史資料 ---
 try:
     le_action = joblib.load('le_action.pkl')
     le_ip = joblib.load('le_ip.pkl')
     
+    # 🌟 啟動時一次性載入歷史資料，供後續繪圖快速讀取
     baseline_df = pd.read_csv('baseline_logs.csv')
     baseline_df['timestamp'] = pd.to_datetime(baseline_df['timestamp'])
     
-    # 🌟 保持：預載歷史日誌顯示
+    global_stats["total_count"] = len(baseline_df)
+    global_stats["abnormal_count"] = baseline_df[baseline_df['status'].str.contains("異常", na=False)].shape[0]
+    print(f"📊 統計初始化：總監測量 {global_stats['total_count']}, 異常數 {global_stats['abnormal_count']}")
+
     log_history = baseline_df.sort_values(by='timestamp', ascending=False).head(20).to_dict('records')
     
+    initial_abnormal_logs = [log for log in log_history if "異常" in str(log.get("status", ""))]
+    if initial_abnormal_logs:
+        initial_df_abn = pd.DataFrame(initial_abnormal_logs)
+    
     baseline_df['month'] = baseline_df['timestamp'].dt.month
     baseline_df['day'] = baseline_df['timestamp'].dt.day
     baseline_df['hour'] = baseline_df['timestamp'].dt.hour
@@ -36,6 +88,8 @@ try:
     print("✅ AI 模組與歷史基準資料載入成功！")
 except Exception as e:
     AI_READY = False
+    global_stats["total_count"] = 0
+    global_stats["abnormal_count"] = 0
     print(f"⚠️ AI 模組載入失敗，請確認檔案。錯誤: {e}")
 
 USER_DB = {
@@ -43,17 +97,188 @@ USER_DB = {
     "admin": ["1234", "管理", "管理員"],
 }
 
+# --- 儀表板 HTML ---
+def get_dashboard_html():
+    total = global_stats["total_count"]
+    abnormal = global_stats["abnormal_count"]
+    rate = (abnormal / total * 100) if total > 0 else 0
+    
+    if not AI_READY:
+        status_icon, status_text, status_color, status_desc = "🔴", "系統錯誤", "#ef4444", "AI 模型載入失敗，防護停用中。"
+    elif rate > 10: 
+        status_icon, status_text, status_color, status_desc = "🟡", "高風險警告", "#f59e0b", "近期異常行為頻發，請立刻檢查 Log。"
+    else:
+        status_icon, status_text, status_color, status_desc = "🟢", "正常執行", "#10b981", "HDBSCAN 與 Agent 服務運作正常。"
+
+    return f"""
+    <div class="stat-dashboard">
+        <div class="stat-card card-total">
+            <div class="card-icon">📊</div>
+            <div class="card-content">
+                <div class="card-label">總監測量 (預警流量)</div>
+                <div class="card-value">{total:,} <span class="card-unit">筆 Log</span></div>
+                <div class="card-sub-text">自系統啟動起統計 (+今日即時)</div>
+            </div>
+        </div>
+        <div class="stat-card card-anomaly">
+            <div class="card-icon">⚠️</div>
+            <div class="card-content">
+                <div class="card-label">異常率 (平均數值)</div>
+                <div class="card-value-container">
+                    <div class="card-value" style="color: #ef4444;">{rate:.2f} %</div>
+                    <div class="card-trend trend-up">↑即時</div>
+                </div>
+                <div class="card-sub-text">共 {abnormal:,} 筆監測到異常行為</div>
+            </div>
+        </div>
+        <div class="stat-card card-status" style="border-top-color: {status_color};">
+            <div class="card-icon">{status_icon}</div>
+            <div class="card-content">
+                <div class="card-label">系統狀態</div>
+                <div class="card-value" style="font-size: 24px; color: {status_color};">{status_text}</div>
+                <div class="card-sub-text">{status_desc}</div>
+            </div>
+        </div>
+    </div>
+    """
+
+# --- 🌟 完美整合 Seaborn 的圖表繪製函式 ---
+def get_plot_data(selected_key):
+    if not selected_key:
+        return None
+        
+    action_code = ACTION_MAP.get(selected_key)
+    try:
+        plt.close('all') # 釋放舊記憶體，確保系統不卡頓
+        
+        # 1. 直接從記憶體中提取歷史基準資料 (完全免除讀檔延遲)
+        df_hist = baseline_df[baseline_df['action'] == action_code].copy()
+        
+        # 2. 從 log_history 抓出「剛產生的即時紀錄」
+        df_live = pd.DataFrame(log_history)
+        if not df_live.empty:
+            df_live['timestamp'] = pd.to_datetime(df_live['timestamp'])
+            df_live = df_live[df_live['action'] == action_code].copy()
+        
+        # 3. 完美合併：將歷史訓練資料與即時資料無縫接合
+        if not df_live.empty:
+            df_combined = pd.concat([df_hist, df_live], ignore_index=True)
+            # 使用 timestamp 移除可能重複計算的資料
+            df_combined = df_combined.drop_duplicates(subset=['timestamp', 'account', 'action'])
+        else:
+            df_combined = df_hist.copy()
+            
+        if df_combined.empty:
+            fig, ax = plt.subplots(figsize=(12, 6))
+            if os.path.exists(font_path): plt.rc('font', family='SimHei')
+            ax.text(0.5, 0.5, f"【{selected_key}】目前尚無資料", ha='center', va='center', fontsize=15)
+            return fig
+
+        # 4. 計算 X 軸(月份) 與 Y 軸(時間小數)
+        df_combined['month'] = df_combined['timestamp'].dt.month
+        df_combined['time_of_day'] = df_combined['timestamp'].dt.hour + df_combined['timestamp'].dt.minute / 60.0
+        
+        # 5. 精準分類：區分「綠色正常」與「紅色異常」
+        is_abnormal = df_combined['status'].astype(str).str.contains("異常", na=False)
+        df_normal = df_combined[~is_abnormal]
+        df_abnormal = df_combined[is_abnormal]
+
+        # 開始繪圖
+        fig, ax = plt.subplots(figsize=(12, 6))
+        sns.set_theme(style="whitegrid")
+        if os.path.exists(font_path): plt.rc('font', family='SimHei')
+        plt.rcParams['axes.unicode_minus'] = False
+
+        has_data = False
+        months_order = list(range(1, 13)) # 確保 1 到 12 月依序排列
+
+        # 🟢 繪製正常紀錄 (綠色點)
+        if not df_normal.empty:
+            has_data = True
+            sns.stripplot(
+                data=df_normal, x='month', y='time_of_day',
+                jitter=0.3, alpha=0.4, size=5, color='#10b981',
+                order=months_order, ax=ax, label='正常資料'
+            )
+
+        # 🔴 繪製異常紀錄 (紅色大叉叉)
+        if not df_abnormal.empty:
+            has_data = True
+            sns.stripplot(
+                data=df_abnormal, x='month', y='time_of_day',
+                jitter=0.3, alpha=0.9, size=9, color='#ef4444', marker='X',
+                order=months_order, ax=ax, label='異常資料'
+            )
+            
+        if not has_data:
+            ax.text(0.5, 0.5, f"【{selected_key}】目前尚無資料", ha='center', va='center', fontsize=15)
+            return fig
+
+        # 🌟 已經將標題 ax.set_title 移除
+        ax.set_xlabel('月份 (1 ~ 12月)', fontsize=12)
+        ax.set_ylabel('時間 (24小時制)', fontsize=12)
+        
+        # 設定 Y 軸為 0~24 點並倒轉 (早上在上面，半夜在下面)
+        ax.set_yticks(np.arange(0, 25, 2))
+        ax.set_ylim(24.5, -0.5)
+
+        # 整理圖例 (避免 Seaborn 重複生成標籤)
+        handles, labels = ax.get_legend_handles_labels()
+        by_label = dict(zip(labels, handles))
+        if by_label:
+            ax.legend(by_label.values(), by_label.keys(), loc='upper right', bbox_to_anchor=(1.15, 1))
+
+        plt.tight_layout()
+        return fig
+    except Exception as e:
+        print(f"繪圖失敗: {e}")
+        return None
+
+# --- 定時器觸發同步更新 ---
+def timer_update(selected_key):
+    return get_dashboard_html(), get_plot_data(selected_key)
+
+# --- Groq AI Agent 呼叫函式 ---
+def explain_abnormal_log(log_text):
+    if not log_text or log_text.strip() == "":
+        return "⚠️ 請先提供異常 Log 資訊以進行分析。"
+    try:
+        from groq import Groq
+    except ImportError:
+        return "⚠️ 未安裝 groq 套件。請在終端機執行 `pip install groq`。"
+        
+    groq_api_key = os.environ.get("GROQ_API_KEY", "")
+    if not groq_api_key:
+        return "⚠️ 未設定 GROQ_API_KEY。請設定環境變數或直接在程式碼中填寫您的 API Key。"
+        
+    try:
+        client = Groq(api_key=groq_api_key)
+        response = client.chat.completions.create(
+            messages=[
+                {
+                    "role": "system",
+                    "content": "你是一位專業的資安分析師。請根據使用者提供的系統 Log，用繁體中文簡單解釋為什麼這筆 Log 會被標記為異常，並指出可能的資安風險（例如：撞庫攻擊、自動化腳本、半夜作息異常等）。請保持說明在 100 字以內，精簡扼要。"
+                },
+                {
+                    "role": "user",
+                    "content": f"請分析這筆異常 Log：\n{log_text}"
+                }
+            ],
+            model="llama-3.1-8b-instant", 
+            temperature=0.5,
+            max_tokens=300
+        )
+        return response.choices[0].message.content
+    except Exception as e:
+        return f"⚠️ 呼叫 API 發生錯誤: {str(e)}"
+
 # --- 2. 核心邏輯與真實 HDBSCAN 異常偵測 ---
 def check_anomaly(ip, action, log_time, overall_w, time_w, ip_w, dev_w):
     if not AI_READY: return "success" 
     if action in ["login_attempt", "logout"]: return "success"
 
     try:
-        ow = float(overall_w)
-        tw = float(time_w)
-        iw = float(ip_w)
-        dw = float(dev_w)
-        
+        ow, tw, iw, dw = float(overall_w), float(time_w), float(ip_w), float(dev_w)
         clean_ip = str(ip).split(" ")[0] 
         ip_code = float(le_ip.transform([clean_ip])[0])
         action_code = float(le_action.transform([action])[0])
@@ -81,43 +306,29 @@ def check_anomaly(ip, action, log_time, overall_w, time_w, ip_w, dev_w):
         
         new_data_point = np.array([[v_month, v_day, v_hour, v_ip, v_action]], dtype=float)
         
-        # 🌟 智能特徵抽樣 (Smart Sampling) 核心邏輯
-        # 1. 找出歷史資料中，跟「當下準備執行的行為」完全一樣的紀錄 (保留季節性與週期性記憶)
         same_action_mask = (baseline_X[:, 4] == action_code)
         relevant_history = scaled_baseline[same_action_mask]
         
-        # 2. 隨機抽取一部分其他的背景資料 (維持模型對「一般常規作息」的認知)
         other_history = scaled_baseline[~same_action_mask]
         if len(other_history) > 800:
-            # 固定隨機種子，確保相同情境下的抽樣穩定度
             np.random.seed(int(current_day + current_hour)) 
             indices = np.random.choice(len(other_history), 800, replace=False)
             other_history = other_history[indices]
             
-        # 3. 組合出兼顧「運算速度」與「全域歷史視野」的精華資料集
         fit_X = np.vstack((other_history, relevant_history, new_data_point))
-        
         strictness = max(2, int(2 + (ow / 100.0) * 4))
         
-        model = HDBSCAN(
-            min_cluster_size=strictness, 
-            min_samples=2
-        )
-        
-        # 改用濃縮後的 fit_X 進行快速分群
+        model = HDBSCAN(min_cluster_size=strictness, min_samples=2)
         clusters = model.fit_predict(fit_X)
         
         if clusters[-1] == -1: 
             return "⚠️異常_作息或行為不符"
 
-        # 距離計算邏輯保持不變
         if np.any(same_action_mask):
             history_points = scaled_baseline[same_action_mask]
             distances = np.linalg.norm(history_points - new_data_point[0], axis=1)
             min_distance = np.min(distances)
-            
             max_tolerance_distance = time_multiplier * 15.0 + 1.0
-            
             if min_distance > max_tolerance_distance:
                 return "⚠️異常_作息或行為不符"
                 
@@ -144,77 +355,84 @@ def record_log(ip, cookie, account, role, action, status, time_mode, custom_time
         "account": account, "role": role, "action": action, "status": status
     }
     
-    # 🌟 保持：整合外部日誌服務
     try:
         logger_service.push_new_log(new_log)
-    except Exception as e:
-        print(f"⚠️ 外部日誌推送失敗: {e}")
+    except:
+        pass
+
+    global_stats["total_count"] += 1
+    if "異常" in str(status):
+        global_stats["abnormal_count"] += 1
 
     log_history.insert(0, new_log)
 
     if status == "success" and AI_READY:
         try:
             pd.DataFrame([new_log]).to_csv('baseline_logs.csv', mode='a', header=False, index=False, encoding='utf-8-sig')
-            
             current_time = pd.to_datetime(str(log_time))
             clean_ip = str(ip).split(" ")[0]
             new_row = np.array([[
-                float(current_time.month), 
-                float(current_time.day), 
-                float(current_time.hour), 
-                float(le_ip.transform([clean_ip])[0]), 
-                float(le_action.transform([action])[0])
+                float(current_time.month), float(current_time.day), float(current_time.hour), 
+                float(le_ip.transform([clean_ip])[0]), float(le_action.transform([action])[0])
             ]], dtype=float)
             baseline_X = np.vstack((baseline_X, new_row))
-        except Exception as e:
+        except:
             pass 
 
-    return pd.DataFrame(log_history)
+    df_all = pd.DataFrame(log_history)
+    abnormal_logs = [log for log in log_history if "異常" in str(log.get("status", ""))]
+    df_abnormal = pd.DataFrame(abnormal_logs) if abnormal_logs else pd.DataFrame(columns=df_all.columns)
+    
+    if "異常" in str(status):
+        latest_str = f"時間: {log_time} | IP: {ip} | 帳號: {account} | 動作: {action} | 狀態: {status}"
+        input_update = gr.update(value=latest_str)
+    else:
+        input_update = gr.update()
+        
+    return df_all, df_abnormal, input_update
 
-# --- 3. 視角切換與登入控制邏輯 ---
 def fast_login(target_account, ip, cookie, time_mode, custom_time, ow, tw, iw, dw):
     role, name = USER_DB[target_account][1], USER_DB[target_account][2]
-    df = record_log(ip, cookie, target_account, role, "login_attempt", "success", time_mode, custom_time, ow, tw, iw, dw)
+    df_all, df_abn, inp_upd = record_log(ip, cookie, target_account, role, "login_attempt", "success", time_mode, custom_time, ow, tw, iw, dw)
     welcome_msg = f"**{name}** 歡迎您  |  線上人數: 938 (⚡快速登入模式)"
     target_tab = "student_tab" if role == "學生" else "admin_tab"
-    return gr.update(visible=False), gr.update(visible=True), gr.update(selected=target_tab), "", welcome_msg, df, target_account
+    return gr.update(visible=False), gr.update(visible=True), gr.update(selected=target_tab), "", welcome_msg, df_all, df_abn, inp_upd, target_account
 
 def process_login(ip, cookie, account, password, captcha, time_mode, custom_time, ow, tw, iw, dw):
     valid_captcha = "FEIK"
-    def fail_response(msg, df):
-        return gr.update(visible=True), gr.update(visible=False), gr.update(), msg, gr.update(), df
+    def fail_response(msg, df_all, df_abn, inp_upd):
+        return gr.update(visible=True), gr.update(visible=False), gr.update(), msg, gr.update(), df_all, df_abn, inp_upd
 
     if account not in USER_DB: 
-        df = record_log(ip, cookie, account, "Unknown", "login_attempt", "failed_no_account", time_mode, custom_time, ow, tw, iw, dw)
-        return fail_response("帳號不存在！", df)
+        df_all, df_abn, inp_upd = record_log(ip, cookie, account, "Unknown", "login_attempt", "failed_no_account", time_mode, custom_time, ow, tw, iw, dw)
+        return fail_response("帳號不存在！", df_all, df_abn, inp_upd)
         
     role, name = USER_DB[account][1], USER_DB[account][2]
-    
     if captcha.upper() != valid_captcha: 
-        df = record_log(ip, cookie, account, role, "login_attempt", "failed_captcha", time_mode, custom_time, ow, tw, iw, dw)
-        return fail_response("驗證碼錯誤！", df)
+        df_all, df_abn, inp_upd = record_log(ip, cookie, account, role, "login_attempt", "failed_captcha", time_mode, custom_time, ow, tw, iw, dw)
+        return fail_response("驗證碼錯誤！", df_all, df_abn, inp_upd)
         
     if USER_DB[account][0] == password:
         welcome_msg = f"**{name}** 歡迎您  |  線上人數: 938"
-        df = record_log(ip, cookie, account, role, "login_attempt", "success", time_mode, custom_time, ow, tw, iw, dw)
+        df_all, df_abn, inp_upd = record_log(ip, cookie, account, role, "login_attempt", "success", time_mode, custom_time, ow, tw, iw, dw)
         target_tab = "student_tab" if role == "學生" else "admin_tab"
-        return gr.update(visible=False), gr.update(visible=True), gr.update(selected=target_tab), "", welcome_msg, df
+        return gr.update(visible=False), gr.update(visible=True), gr.update(selected=target_tab), "", welcome_msg, df_all, df_abn, inp_upd
         
-    df = record_log(ip, cookie, account, role, "login_attempt", "failed_password", time_mode, custom_time, ow, tw, iw, dw)
-    return fail_response("密碼錯誤！", df)
+    df_all, df_abn, inp_upd = record_log(ip, cookie, account, role, "login_attempt", "failed_password", time_mode, custom_time, ow, tw, iw, dw)
+    return fail_response("密碼錯誤！", df_all, df_abn, inp_upd)
 
 def toggle_role(current_account, ip, cookie, time_mode, custom_time, ow, tw, iw, dw):
     target_account = "student" if current_account == "admin" else "admin"
     role, name = USER_DB[target_account][1], USER_DB[target_account][2]
-    df = record_log(ip, cookie, target_account, role, "login_attempt", "success", time_mode, custom_time, ow, tw, iw, dw)
+    df_all, df_abn, inp_upd = record_log(ip, cookie, target_account, role, "login_attempt", "success", time_mode, custom_time, ow, tw, iw, dw)
     welcome_msg = f"**{name}** 歡迎您  |  線上人數: 938 (⚡單鍵切換模式)"
     target_tab = "student_tab" if role == "學生" else "admin_tab"
-    return gr.update(selected=target_tab), welcome_msg, df, target_account
+    return gr.update(selected=target_tab), welcome_msg, df_all, df_abn, inp_upd, target_account
 
 def logout(ip, cookie, account, time_mode, custom_time, ow, tw, iw, dw):
     role = USER_DB.get(account, ["", "Unknown"])[1]
-    df = record_log(ip, cookie, account, role, "logout", "success", time_mode, custom_time, ow, tw, iw, dw)
-    return gr.update(visible=True), gr.update(visible=False), "", "", "", "", df
+    df_all, df_abn, inp_upd = record_log(ip, cookie, account, role, "logout", "success", time_mode, custom_time, ow, tw, iw, dw)
+    return gr.update(visible=True), gr.update(visible=False), "", "", "", "", df_all, df_abn, inp_upd
 
 def simulate_click(ip, cookie, account, button_name, time_mode, custom_time, ow, tw, iw, dw):
     role = USER_DB.get(account, ["", "Unknown"])[1]
@@ -235,9 +453,81 @@ custom_css = """
 .weight-card { padding: 10px; background: white; border-radius: 8px; box-shadow: 0 1px 3px rgba(0,0,0,0.1); margin-top: 10px; }
 .headless-tabs > div:first-child { display: none !important; }
 .headless-tabs { border: none !important; background: transparent !important; }
+
+/* 🌟 新增：統計儀表板 CSS，嘗試重現圖片樣式 (已加入深色模式強制白底黑字覆蓋) */
+.stat-dashboard {
+    display: flex;
+    gap: 15px;
+    margin-bottom: 20px;
+    justify-content: space-between;
+}
+.stat-card {
+    flex: 1;
+    background-color: #ffffff !important; /* 強制卡片底色為白色 */
+    padding: 15px;
+    border-radius: 10px;
+    box-shadow: 0 4px 6px rgba(0,0,0,0.05);
+    display: flex;
+    align-items: center;
+    gap: 15px;
+    border-top: 4px solid transparent; /* 用於狀態卡的頂部顏色 */
+}
+.card-total { border-left: 4px solid #10b981; } /* Green left border */
+.card-anomaly { border-left: 4px solid #ef4444; } /* Red left border */
+.card-status { border-left: 4px solid #3b82f6; } /* Blue left border */
+
+.card-icon {
+    font-size: 30px;
+    width: 40px;
+    text-align: center;
+}
+.card-content {
+    flex: 1;
+}
+.card-label {
+    color: #374151 !important; /* 強制標題文字為深灰色 */
+    font-size: 13px;
+    margin-bottom: 2px;
+    font-weight: bold !important;
+}
+.card-value-container {
+    display: flex;
+    align-items: baseline;
+    gap: 8px;
+}
+.card-value {
+    font-size: 24px;
+    font-weight: bold;
+}
+/* 針對「總監測量」的數字強制設為黑色，不影響異常率與狀態的專屬顏色 */
+.card-total .card-value {
+    color: #000000 !important;
+}
+.card-unit {
+    font-size: 14px;
+    color: #4b5563 !important; /* 強制單位文字為深灰色 */
+    font-weight: normal;
+}
+.card-trend {
+    font-size: 12px;
+    padding: 2px 6px;
+    border-radius: 4px;
+}
+.trend-up {
+    background-color: #fee2e2 !important;
+    color: #ef4444 !important;
+}
+.card-sub-text {
+    color: #6b7280 !important; /* 強制副標題說明文字為中灰色 */
+    font-size: 11px;
+    margin-top: 2px;
+}
 """
 
-with gr.Blocks(title="模擬校園入口與資安防護系統", css=custom_css) as demo:
+with gr.Blocks(title="模擬校園入口與資安防護系統") as demo:
+
+    dashboard_timer = gr.Timer(value=60)
+
     with gr.Row():
         with gr.Column(scale=1, elem_classes="mock-panel"):
             gr.Markdown("### ⚙️ 環境變數模擬器")
@@ -291,6 +581,18 @@ with gr.Blocks(title="模擬校園入口與資安防護系統", css=custom_css)
                             btn_hack_score = gr.Button("💀 嘗試偷改成績 (SQL Injection)", variant="stop", size="sm")
 
                     with gr.Tab("🛡️ 管理員專區", id="admin_tab"):
+                        
+                        stat_dashboard_display = gr.HTML(value=get_dashboard_html())
+
+                        with gr.Accordion("▼ 系統操作時間分佈圖 (即時監控)", open=True, elem_classes="weight-card"):
+                            gr.Markdown("<span style='color:gray; font-size:0.9em;'>選擇下方系統以檢視該系統在歷史與即時紀錄中的時間分佈狀況。圖表每分鐘會自動同步更新，歷史紀錄為綠點，即時攔截之異常為紅叉。</span>")
+                            action_dropdown = gr.Dropdown(
+                                choices=list(ACTION_MAP.keys()),
+                                label="選擇要檢視的系統資料分佈",
+                                value=None
+                            )
+                            action_plot = gr.Plot(show_label=False)
+
                         with gr.Accordion("▼ 防護強度微調 (AI 敏感度)", open=True, elem_classes="weight-card"):
                             gr.Markdown("<span style='color:gray; font-size:0.9em;'>手動輸入 0~100 的數值。提高強度會增加誤報率，但能更有效攔截新型攻擊。</span>")
                             with gr.Row():
@@ -300,6 +602,20 @@ with gr.Blocks(title="模擬校園入口與資安防護系統", css=custom_css)
                                 ip_weight = gr.Number(label="IP 聲譽權重 (%)", value=65, minimum=0, maximum=100)
                                 device_weight = gr.Number(label="裝置指紋/行為權重 (%)", value=45, minimum=0, maximum=100)
                         
+                        with gr.Accordion("▼ 異常 Log 分析 (Groq AI Agent)", open=True, elem_classes="weight-card"):
+                            gr.Markdown("<span style='color:gray; font-size:0.9em;'>顯示所有被判定為異常的 Log。點擊分析可讓 AI 代為判讀潛在風險。</span>")
+                            abnormal_log_display = gr.Dataframe(
+                                value=initial_df_abn,
+                                headers=["timestamp", "ip_address", "cookie_id", "account", "role", "action", "status"],
+                                datatype=["str", "str", "str", "str", "str", "str", "str"],
+                                interactive=False, wrap=True
+                            )
+                            with gr.Row():
+                                abnormal_log_input = gr.Textbox(label="要分析的異常 Log", placeholder="系統若偵測到新異常將會自動填入，您也可以手動修改...", scale=4)
+                                btn_explain_log = gr.Button("🧠 Groq AI 分析", variant="primary", scale=1)
+                            
+                            ai_explanation_output = gr.Textbox(label="AI 分析結果與說明", lines=4, interactive=False, placeholder="等待分析中...")
+                        
                         with gr.Accordion("▼ HDBSCAN 異常辨識自動化測試區", open=True, elem_classes="weight-card"):
                             gr.Markdown("<span style='color:gray; font-size:0.9em;'>點擊按鈕將直接以指定時間點執行該系統的操作，結果將顯示於左側 Log 區。</span>")
                             
@@ -334,31 +650,33 @@ with gr.Blocks(title="模擬校園入口與資安防護系統", css=custom_css)
                                 t_vdesk_norm = gr.Button("✅ 正常: 軟體雲/WebMail (03-22 18:00)", size="sm"); t_vdesk_anom = gr.Button("⚠️ 異常: 軟體雲/WebMail (08-10 00:00)", size="sm")
 
     # --- 綁定事件 ---
+    
+    demo.load(fn=timer_update, inputs=[action_dropdown], outputs=[stat_dashboard_display, action_plot])
+    dashboard_timer.tick(fn=timer_update, inputs=[action_dropdown], outputs=[stat_dashboard_display, action_plot])
+    
+    action_dropdown.change(fn=get_plot_data, inputs=[action_dropdown], outputs=[action_plot])
+
     time_mode.change(fn=toggle_time_input, inputs=time_mode, outputs=custom_time_input)
+    btn_explain_log.click(fn=explain_abnormal_log, inputs=[abnormal_log_input], outputs=[ai_explanation_output])
     
     weight_inputs = [overall_weight, time_weight, ip_weight, device_weight]
+    update_outputs = [login_view, dashboard_view, role_tabs, login_msg, welcome_text, log_display, abnormal_log_display, abnormal_log_input]
     
     login_btn.click(
-        fn=process_login, 
-        inputs=[mock_ip, mock_cookie, acc_input, pwd_input, captcha_input, time_mode, custom_time_input] + weight_inputs, 
-        outputs=[login_view, dashboard_view, role_tabs, login_msg, welcome_text, log_display] 
+        fn=process_login, inputs=[mock_ip, mock_cookie, acc_input, pwd_input, captcha_input, time_mode, custom_time_input] + weight_inputs, outputs=update_outputs
     )
-    
     logout_btn.click(
-        fn=logout, 
-        inputs=[mock_ip, mock_cookie, acc_input, time_mode, custom_time_input] + weight_inputs, 
-        outputs=[login_view, dashboard_view, acc_input, pwd_input, captcha_input, login_msg, log_display] 
+        fn=logout, inputs=[mock_ip, mock_cookie, acc_input, time_mode, custom_time_input] + weight_inputs, outputs=[login_view, dashboard_view, acc_input, pwd_input, captcha_input, login_msg, log_display, abnormal_log_display, abnormal_log_input] 
     )
 
     fast_inputs = [mock_ip, mock_cookie, time_mode, custom_time_input] + weight_inputs
-    
-    btn_fast_student.click(fn=lambda ip, c, tm, ct, ow, tw, iw, dw: fast_login("student", ip, c, tm, ct, ow, tw, iw, dw), inputs=fast_inputs, outputs=[login_view, dashboard_view, role_tabs, login_msg, welcome_text, log_display, acc_input])
-    btn_fast_admin.click(fn=lambda ip, c, tm, ct, ow, tw, iw, dw: fast_login("admin", ip, c, tm, ct, ow, tw, iw, dw), inputs=fast_inputs, outputs=[login_view, dashboard_view, role_tabs, login_msg, welcome_text, log_display, acc_input])
+    fast_outputs = update_outputs + [acc_input] 
+
+    btn_fast_student.click(fn=lambda ip, c, tm, ct, ow, tw, iw, dw: fast_login("student", ip, c, tm, ct, ow, tw, iw, dw), inputs=fast_inputs, outputs=fast_outputs)
+    btn_fast_admin.click(fn=lambda ip, c, tm, ct, ow, tw, iw, dw: fast_login("admin", ip, c, tm, ct, ow, tw, iw, dw), inputs=fast_inputs, outputs=fast_outputs)
 
     btn_toggle_role.click(
-        fn=toggle_role, 
-        inputs=[acc_input, mock_ip, mock_cookie, time_mode, custom_time_input] + weight_inputs, 
-        outputs=[role_tabs, welcome_text, log_display, acc_input]
+        fn=toggle_role, inputs=[acc_input, mock_ip, mock_cookie, time_mode, custom_time_input] + weight_inputs, outputs=[role_tabs, welcome_text, log_display, abnormal_log_display, abnormal_log_input, acc_input]
     )
 
     action_mapping = [
@@ -375,7 +693,7 @@ with gr.Blocks(title="模擬校園入口與資安防護系統", css=custom_css)
         btn.click(
             fn=lambda ip, c, acc, t_mode, t_custom, ow, tw, iw, dw, n=action_name: simulate_click(ip, c, acc, n, t_mode, t_custom, ow, tw, iw, dw), 
             inputs=[mock_ip, mock_cookie, acc_input, time_mode, custom_time_input] + weight_inputs, 
-            outputs=[log_display]
+            outputs=[log_display, abnormal_log_display, abnormal_log_input]
         )
         
     test_mapping = [
@@ -396,8 +714,8 @@ with gr.Blocks(title="模擬校園入口與資安防護系統", css=custom_css)
         btn.click(
             fn=lambda ip, c, acc, ow, tw, iw, dw, n=action_name, t_str=test_time_str: test_anomaly(ip, c, acc, n, t_str, ow, tw, iw, dw),
             inputs=[mock_ip, mock_cookie, acc_input, overall_weight, time_weight, ip_weight, device_weight],
-            outputs=[log_display]
+            outputs=[log_display, abnormal_log_display, abnormal_log_input]
         )
 
 if __name__ == "__main__":
-    demo.launch()
+    demo.launch(css=custom_css)