How coderharshdew/prognospect works
PrognoSpect is presented as a predictive cyber-defence world model. The documented data workflow turns CSE-CIC-IDS2018 PCAPs into flow, packet, and cross-flow features, then labels and orders the extracted data; the state builder represents traffic as time-windowed global, host, graph, and delta states. The README describes forecasting multiple likely attack trajectories with uncertainty. The sampled runtime confirms extraction, state construction, and a graph encoder, but not their end-to-end connection or a forecasting implementation; the web assets include simulation-oriented views.
Main entry points: pipelines.py Extraction pipeline · state_builder.py State builder · preprocessing.py Preprocessing · pcap_archive_downloader.py Archive download
Components 23
Capture processing
- Archive download
src/database/pcap_archive_downloader.py - PCAP access
src/database/pcap_reader.py - Extraction pipeline
src/backend/pipelines.py - CICFlowMeter adapter
src/extraction/providers/cicflowmeter.py - Frame parsing
src/extraction/pcap_frame_parser.py - Packet features
src/extraction/packet_feature_extractor.py - Cross-flow features
src/extraction/cross_flow_behavioral_feature_extractor.py - Label and order
src/extraction/label_and_order.py - Feature CSVs
src/extraction/write_flow_features_csv.py
State and model
- State builder
src/state_builder/state_builder.py - Global state
src/state_builder/global_state.py - Host state
src/state_builder/host_state.py - Graph state
src/state_builder/graph_state.py - State deltas
src/state_builder/delta_state.py - Graph encoder
src/ml/graph_encoder.py
Analyst interface
- Web views
templates/dashboard.html - UI simulation
static/js/app.js
Configuration and validation
- Preprocessing
src/preprocessing/preprocessing.py - Data validation
src/preprocessing/validator.py - Extraction config
config/extraction - Preprocessing config
config/preprocessing
Other components
- CSE-CIC-IDS2018
- Defender / analyst
Connections 19
- CSE-CIC-IDS2018 → Archive download: source archives
- Archive download → PCAP access: downloads PCAPs
- PCAP access → Extraction pipeline: provides captures
- Extraction pipeline → CICFlowMeter adapter: runs flow extraction
- Extraction pipeline → Frame parsing: parses packets
- Extraction pipeline → Packet features: extracts packet features
- Extraction pipeline → Cross-flow features: extracts behavior
- Extraction pipeline → Feature CSVs: writes feature rows
- Extraction pipeline → Label and order: labels merged data
- CICFlowMeter adapter → Feature CSVs: yields flow rows
- Extraction pipeline → Extraction config: loads settings
- Preprocessing → Data validation: validates data
- Preprocessing → Preprocessing config: loads rules
- State builder → Global state: builds
- State builder → Host state: builds
- State builder → Graph state: builds
- State builder → State deltas: calculates
- Defender / analyst → Web views: views dashboards
- Web views → UI simulation: loads script