How bavan1223/major-project works
This is a SAFE_LAB_MODE ransomware-behavior detection and response system with a SOC dashboard. Its main workflow is safe simulation or monitored system activity → telemetry events → behavioral/rule and advisory ML assessment → risk and incident management → dry-run containment or lab-file recovery → dashboard. The README documents several subsystems whose source was not sampled; their paths and broad roles are represented, but uncertain internal wiring is omitted.
Main entry points: detection_pipeline.py Detection pipeline · event_logger.py Event logger · prevention_engine.py Prevention and recovery · dashboard.py Flask API
Components 22
Telemetry and Detection
- Safe simulator
simulator/safe_simulator.py - File monitor
monitor/file_monitor.py - Process monitor
monitor/process_monitor.py - Network monitor
monitor/network_monitor.py - Event logger
event_logger.py - Event log
event_logger.py - Detection pipeline
detection_pipeline.py - Feature extraction
core/feature_extractor.py - Rule detection
detection_engine.py
Risk and Incidents
- Canary checks
core/canary_manager.py - ML inference
ml/inference/integration.py - Risk engine
core/risk_engine.py - Event correlation
core/correlation_engine.py - Incident lifecycle
core/incident_manager.py
Response and Recovery
- Response decisions
core/response_controller.py - Protection simulation
core/protection_controller.py - Prevention and recovery
core/prevention_engine.py - Audit attribution
core/audit_attributor.py
SOC Interface
- Flask API
dashboard.py - Dashboard state and API client
frontend/src/context/SocContext.tsx - SOC dashboard
frontend/src/App.tsx
Other components
- Lab operator
Connections 25
- Lab operator → Safe simulator: runs safely
- Safe simulator → File monitor: changes test files
- File monitor → Event logger: logs telemetry
- Process monitor → Event logger: logs telemetry
- Network monitor → Event logger: logs telemetry
- Event logger → Event log: persists events
- Detection pipeline → Event log: reads event window
- Detection pipeline → Feature extraction: extracts features
- Detection pipeline → Rule detection: checks behavior
- Detection pipeline → Canary checks: checks decoys
- Detection pipeline → ML inference: requests advisory signal
- Detection pipeline → Risk engine: submits assessment inputs
- Detection pipeline → Event correlation: collects process context
- Detection pipeline → Incident lifecycle: creates and updates
- Risk engine → Detection pipeline: returns risk decision
- Detection pipeline → Response decisions: requests response decision
- Response decisions → Protection simulation: passes decision
- Protection simulation → Event logger: logs protection event
- Detection pipeline → Prevention and recovery: initiates incident actions
- Prevention and recovery → Incident lifecycle: updates lifecycle
- Prevention and recovery → Audit attribution: records action evidence
- Lab operator → Flask API: requests status or action
- Flask API → Dashboard state and API client: serves API data
- Dashboard state and API client → Flask API: fetches and posts
- SOC dashboard → Dashboard state and API client: reads shared state