# bavan1223/major-project architecture

> Architecture diagram of the GitHub repository bavan1223/major-project, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/bavan1223/major-project
- Repository: https://github.com/bavan1223/major-project

## Overview

This is a SAFE_LAB_MODE ransomware-behavior detection and response system with a SOC dashboard. Its main workflow is safe simulation or monitored system activity → telemetry events → behavioral/rule and advisory ML assessment → risk and incident management → dry-run containment or lab-file recovery → dashboard. The README documents several subsystems whose source was not sampled; their paths and broad roles are represented, but uncertain internal wiring is omitted.

Main entry points: [`detection_pipeline.py`](https://github.com/bavan1223/major-project/blob/main/detection_pipeline.py) (Detection pipeline), [`event_logger.py`](https://github.com/bavan1223/major-project/blob/main/event_logger.py) (Event logger), [`core/prevention_engine.py`](https://github.com/bavan1223/major-project/blob/main/core/prevention_engine.py) (Prevention and recovery), [`dashboard.py`](https://github.com/bavan1223/major-project/blob/main/dashboard.py) (Flask API)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_sensing["Telemetry and Detection"]
  node_simulator["Safe simulator<br/>[safe_simulator.py]"]
  node_file_monitor["File monitor<br/>[file_monitor.py]"]
  node_process_monitor["Process monitor<br/>[process_monitor.py]"]
  node_network_monitor["Network monitor<br/>[network_monitor.py]"]
  node_event_logger["Event logger<br/>[event_logger.py]"]
  node_event_store[("Event log<br/>[event_logger.py]")]
  node_pipeline["Detection pipeline"]
  node_features["Feature extraction"]
  node_rules["Rule detection"]
end

subgraph group_assessment["Risk and Incidents"]
  node_canary["Canary checks<br/>[canary_manager.py]"]
  node_ml["ML inference<br/>[integration.py]"]
  node_risk["Risk engine<br/>[risk_engine.py]"]
  node_correlation["Event correlation"]
  node_incidents[("Incident lifecycle")]
end

subgraph group_actions["Response and Recovery"]
  node_response["Response decisions"]
  node_protection["Protection simulation"]
  node_prevention["Prevention and recovery"]
  node_audit["Audit attribution"]
end

subgraph group_interface["SOC Interface"]
  node_api["Flask API<br/>[dashboard.py]"]
  node_soc_context["Dashboard state and API client<br/>[SocContext.tsx]"]
  node_soc_app["SOC dashboard<br/>[App.tsx]"]
end

node_operator(("Lab operator"))

node_operator -->|"runs safely"| node_simulator
node_simulator -->|"changes test files"| node_file_monitor
node_file_monitor -->|"logs telemetry"| node_event_logger
node_process_monitor -->|"logs telemetry"| node_event_logger
node_network_monitor -->|"logs telemetry"| node_event_logger
node_event_logger -->|"persists events"| node_event_store
node_pipeline -->|"reads event window"| node_event_store
node_pipeline -->|"extracts features"| node_features
node_pipeline -->|"checks behavior"| node_rules
node_pipeline -->|"checks decoys"| node_canary
node_pipeline -->|"requests advisory signal"| node_ml
node_pipeline -->|"submits assessment inputs"| node_risk
node_pipeline -->|"collects process context"| node_correlation
node_pipeline -->|"creates and updates"| node_incidents
node_risk -->|"returns risk decision"| node_pipeline
node_pipeline -->|"requests response decision"| node_response
node_response -->|"passes decision"| node_protection
node_protection -->|"logs protection event"| node_event_logger
node_pipeline -->|"initiates incident actions"| node_prevention
node_prevention -->|"updates lifecycle"| node_incidents
node_prevention -->|"records action evidence"| node_audit
node_operator -->|"requests status or action"| node_api
node_api -->|"serves API data"| node_soc_context
node_soc_context -->|"fetches and posts"| node_api
node_soc_app -->|"reads shared state"| node_soc_context

click node_simulator "https://github.com/bavan1223/major-project/blob/main/simulator/safe_simulator.py"
click node_file_monitor "https://github.com/bavan1223/major-project/blob/main/monitor/file_monitor.py"
click node_process_monitor "https://github.com/bavan1223/major-project/blob/main/monitor/process_monitor.py"
click node_network_monitor "https://github.com/bavan1223/major-project/blob/main/monitor/network_monitor.py"
click node_event_logger "https://github.com/bavan1223/major-project/blob/main/event_logger.py"
click node_event_store "https://github.com/bavan1223/major-project/blob/main/event_logger.py"
click node_pipeline "https://github.com/bavan1223/major-project/blob/main/detection_pipeline.py"
click node_features "https://github.com/bavan1223/major-project/blob/main/core/feature_extractor.py"
click node_rules "https://github.com/bavan1223/major-project/blob/main/detection_engine.py"
click node_canary "https://github.com/bavan1223/major-project/blob/main/core/canary_manager.py"
click node_ml "https://github.com/bavan1223/major-project/blob/main/ml/inference/integration.py"
click node_risk "https://github.com/bavan1223/major-project/blob/main/core/risk_engine.py"
click node_correlation "https://github.com/bavan1223/major-project/blob/main/core/correlation_engine.py"
click node_incidents "https://github.com/bavan1223/major-project/blob/main/core/incident_manager.py"
click node_response "https://github.com/bavan1223/major-project/blob/main/core/response_controller.py"
click node_protection "https://github.com/bavan1223/major-project/blob/main/core/protection_controller.py"
click node_prevention "https://github.com/bavan1223/major-project/blob/main/core/prevention_engine.py"
click node_audit "https://github.com/bavan1223/major-project/blob/main/core/audit_attributor.py"
click node_api "https://github.com/bavan1223/major-project/blob/main/dashboard.py"
click node_soc_context "https://github.com/bavan1223/major-project/blob/main/frontend/src/context/SocContext.tsx"
click node_soc_app "https://github.com/bavan1223/major-project/blob/main/frontend/src/App.tsx"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_simulator,node_file_monitor,node_process_monitor,node_network_monitor,node_event_logger,node_event_store,node_pipeline,node_features,node_rules toneBlue
class node_canary,node_ml,node_risk,node_correlation,node_incidents toneAmber
class node_response,node_protection,node_prevention,node_audit toneMint
class node_api,node_soc_context,node_soc_app toneRose
class node_operator toneIndigo
```

## Components

### Telemetry and Detection

- [Safe simulator](https://github.com/bavan1223/major-project/blob/main/simulator/safe_simulator.py): `simulator/safe_simulator.py`
- [File monitor](https://github.com/bavan1223/major-project/blob/main/monitor/file_monitor.py): `monitor/file_monitor.py`
- [Process monitor](https://github.com/bavan1223/major-project/blob/main/monitor/process_monitor.py): `monitor/process_monitor.py`
- [Network monitor](https://github.com/bavan1223/major-project/blob/main/monitor/network_monitor.py): `monitor/network_monitor.py`
- [Event logger](https://github.com/bavan1223/major-project/blob/main/event_logger.py): `event_logger.py`
- [Event log](https://github.com/bavan1223/major-project/blob/main/event_logger.py): `event_logger.py`
- [Detection pipeline](https://github.com/bavan1223/major-project/blob/main/detection_pipeline.py): `detection_pipeline.py`
- [Feature extraction](https://github.com/bavan1223/major-project/blob/main/core/feature_extractor.py): `core/feature_extractor.py`
- [Rule detection](https://github.com/bavan1223/major-project/blob/main/detection_engine.py): `detection_engine.py`

### Risk and Incidents

- [Canary checks](https://github.com/bavan1223/major-project/blob/main/core/canary_manager.py): `core/canary_manager.py`
- [ML inference](https://github.com/bavan1223/major-project/blob/main/ml/inference/integration.py): `ml/inference/integration.py`
- [Risk engine](https://github.com/bavan1223/major-project/blob/main/core/risk_engine.py): `core/risk_engine.py`
- [Event correlation](https://github.com/bavan1223/major-project/blob/main/core/correlation_engine.py): `core/correlation_engine.py`
- [Incident lifecycle](https://github.com/bavan1223/major-project/blob/main/core/incident_manager.py): `core/incident_manager.py`

### Response and Recovery

- [Response decisions](https://github.com/bavan1223/major-project/blob/main/core/response_controller.py): `core/response_controller.py`
- [Protection simulation](https://github.com/bavan1223/major-project/blob/main/core/protection_controller.py): `core/protection_controller.py`
- [Prevention and recovery](https://github.com/bavan1223/major-project/blob/main/core/prevention_engine.py): `core/prevention_engine.py`
- [Audit attribution](https://github.com/bavan1223/major-project/blob/main/core/audit_attributor.py): `core/audit_attributor.py`

### SOC Interface

- [Flask API](https://github.com/bavan1223/major-project/blob/main/dashboard.py): `dashboard.py`
- [Dashboard state and API client](https://github.com/bavan1223/major-project/blob/main/frontend/src/context/SocContext.tsx): `frontend/src/context/SocContext.tsx`
- [SOC dashboard](https://github.com/bavan1223/major-project/blob/main/frontend/src/App.tsx): `frontend/src/App.tsx`

### Other components

- **Lab operator**

## Connections

- Lab operator → Safe simulator: runs safely
- Safe simulator → File monitor: changes test files
- File monitor → Event logger: logs telemetry
- Process monitor → Event logger: logs telemetry
- Network monitor → Event logger: logs telemetry
- Event logger → Event log: persists events
- Detection pipeline → Event log: reads event window
- Detection pipeline → Feature extraction: extracts features
- Detection pipeline → Rule detection: checks behavior
- Detection pipeline → Canary checks: checks decoys
- Detection pipeline → ML inference: requests advisory signal
- Detection pipeline → Risk engine: submits assessment inputs
- Detection pipeline → Event correlation: collects process context
- Detection pipeline → Incident lifecycle: creates and updates
- Risk engine → Detection pipeline: returns risk decision
- Detection pipeline → Response decisions: requests response decision
- Response decisions → Protection simulation: passes decision
- Protection simulation → Event logger: logs protection event
- Detection pipeline → Prevention and recovery: initiates incident actions
- Prevention and recovery → Incident lifecycle: updates lifecycle
- Prevention and recovery → Audit attribution: records action evidence
- Lab operator → Flask API: requests status or action
- Flask API → Dashboard state and API client: serves API data
- Dashboard state and API client → Flask API: fetches and posts
- SOC dashboard → Dashboard state and API client: reads shared state