Fix analytics data inconsistency on live dashboard

Update analytics aggregator to correctly count attack occurrences and fix type hinting for daily aggregation.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 7a657272-55ba-4a79-9a2e-f1ed9bc7a528
Replit-Commit-Checkpoint-Type: intermediate_checkpoint
Replit-Commit-Event-Id: f54e3953-68c3-42e1-be9d-1d1db98db671
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/449cf7c4-c97a-45ae-8234-e5c5b8d6a84f/7a657272-55ba-4a79-9a2e-f1ed9bc7a528/F6DiMv4

python_ml/analytics_aggregator.py

@@ -7,7 +7,7 @@ Mantiene dati permanenti per analytics long-term
 import psycopg2
 from psycopg2.extras import RealDictCursor
 import os
-from datetime import datetime, timedelta
+from datetime import datetime, timedelta, date
 import json
 from typing import Dict, List, Optional
 from collections import defaultdict
@@ -258,7 +258,7 @@ class AnalyticsAggregator:
             cursor.close()
             conn.close()
     
-    def aggregate_daily(self, target_date: Optional[datetime] = None):
+    def aggregate_daily(self, target_date: Optional[date] = None):
         """
         Aggrega statistiche giornaliere (somma delle ore)
         Se target_date è None, usa giorno precedente

replit.md

@@ -50,6 +50,21 @@ The IDS employs a React-based frontend for real-time monitoring, detection visua
 
 ## Recent Updates (Novembre 2025)
 
+### 🔧 Analytics Aggregator Fix - Data Consistency (24 Nov 2025 - 17:00)
+- **BUG FIX CRITICO**: Risolto mismatch dati Dashboard Live
+- **Problema**: Distribuzione traffico mostrava 262k attacchi ma breakdown solo 19
+- **ROOT CAUSE**: Aggregatore contava **occorrenze** invece di **pacchetti** in `attacks_by_type` e `attacks_by_country`
+- **Soluzione**:
+  1. Spostato conteggio da loop detections → loop pacchetti  
+  2. `attacks_by_type[tipo] += packets` (non +1!)
+  3. `attacks_by_country[paese] += packets` (non +1!)
+  4. Fallback "unknown"/"Unknown" per dati mancanti (tipo/geo)
+  5. Logging validazione: verifica breakdown_total == attack_packets
+- **Invariante matematica**: `Σ(attacks_by_type) == Σ(attacks_by_country) == attack_packets`
+- **Files modificati**: `python_ml/analytics_aggregator.py`
+- **Deploy**: Restart ML backend + aggregator run manuale per testare
+- **Validazione**: Log mostra `match: True` e nessun warning mismatch
+
 ### 📊 Network Analytics & Dashboard System (24 Nov 2025 - 11:30)
 - **Feature Completa**: Sistema analytics con traffico normale + attacchi, visualizzazioni grafiche avanzate, dati permanenti
 - **Componenti**: