# belkacem-it/sdn-malware-detection-deeplearning architecture

> Architecture diagram of the GitHub repository belkacem-it/sdn-malware-detection-deeplearning, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/belkacem-it/sdn-malware-detection-deeplearning
- Repository: https://github.com/belkacem-it/sdn-malware-detection-deeplearning

## Overview

This repository presents an SDN malware-detection project with two documented classification approaches: semantic ALBERT and temporal GRU. The tracked model files contain imports and confidentiality notices, not executable pipelines. The README describes flow capture, representations, preprocessing, and real-time detection; those stages are shown as documented capabilities, not verified runtime wiring.

Main entry points: [`models/albert_classifier.py`](https://github.com/belkacem-it/sdn-malware-detection-deeplearning/blob/main/models/albert_classifier.py) (ALBERT classifier), [`models/gru_classifier.py`](https://github.com/belkacem-it/sdn-malware-detection-deeplearning/blob/main/models/gru_classifier.py) (GRU classifier)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_flow_inputs["Flow inputs"]
  node_wireshark_capture["Wireshark capture"]
  node_flow_aggregation["Flow aggregation"]
  node_semantic_representation["Flow-to-text"]
  node_tokenization["Tokenization"]
  node_temporal_features["Temporal features"]
  node_normalization["Feature normalization"]
end

subgraph group_classifiers["Classifiers"]
  node_albert_classifier["ALBERT classifier"]
  node_gru_classifier["GRU classifier<br/>[gru_classifier.py]"]
end

node_network_traffic(("Network traffic"))
node_malware_detection(("Malware detection"))

node_network_traffic -->|"captured by"| node_wireshark_capture
node_wireshark_capture -->|"aggregated as flows"| node_flow_aggregation
node_flow_aggregation -->|"described as text"| node_semantic_representation
node_semantic_representation -->|"tokenized for"| node_tokenization
node_tokenization -->|"classified by"| node_albert_classifier
node_flow_aggregation -->|"represented as sequences"| node_temporal_features
node_temporal_features -->|"normalized"| node_normalization
node_normalization -->|"classified by"| node_gru_classifier
node_albert_classifier -->|"detects"| node_malware_detection
node_gru_classifier -->|"detects"| node_malware_detection

click node_albert_classifier "https://github.com/belkacem-it/sdn-malware-detection-deeplearning/blob/main/models/albert_classifier.py"
click node_gru_classifier "https://github.com/belkacem-it/sdn-malware-detection-deeplearning/blob/main/models/gru_classifier.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_wireshark_capture,node_flow_aggregation,node_semantic_representation,node_tokenization,node_temporal_features,node_normalization toneBlue
class node_albert_classifier,node_gru_classifier toneAmber
class node_network_traffic,node_malware_detection toneIndigo
```

## Components

### Flow inputs

- **Wireshark capture**
- **Flow aggregation**
- **Flow-to-text**
- **Tokenization**
- **Temporal features**
- **Feature normalization**

### Classifiers

- [ALBERT classifier](https://github.com/belkacem-it/sdn-malware-detection-deeplearning/blob/main/models/albert_classifier.py): `models/albert_classifier.py`
- [GRU classifier](https://github.com/belkacem-it/sdn-malware-detection-deeplearning/blob/main/models/gru_classifier.py): `models/gru_classifier.py`

### Other components

- **Network traffic**
- **Malware detection**

## Connections

- Network traffic → Wireshark capture: captured by
- Wireshark capture → Flow aggregation: aggregated as flows
- Flow aggregation → Flow-to-text: described as text
- Flow-to-text → Tokenization: tokenized for
- Tokenization → ALBERT classifier: classified by
- Flow aggregation → Temporal features: represented as sequences
- Temporal features → Feature normalization: normalized
- Feature normalization → GRU classifier: classified by
- ALBERT classifier → Malware detection: detects
- GRU classifier → Malware detection: detects