# coderharshdew/prognospect architecture

> Architecture diagram of the GitHub repository coderharshdew/prognospect, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/coderharshdew/prognospect
- Repository: https://github.com/coderharshdew/prognospect

## Overview

PrognoSpect is presented as a predictive cyber-defence world model. The documented data workflow turns CSE-CIC-IDS2018 PCAPs into flow, packet, and cross-flow features, then labels and orders the extracted data; the state builder represents traffic as time-windowed global, host, graph, and delta states. The README describes forecasting multiple likely attack trajectories with uncertainty. The sampled runtime confirms extraction, state construction, and a graph encoder, but not their end-to-end connection or a forecasting implementation; the web assets include simulation-oriented views.

Main entry points: [`src/backend/pipelines.py`](https://github.com/coderharshdew/prognospect/blob/main/src/backend/pipelines.py) (Extraction pipeline), [`src/state_builder/state_builder.py`](https://github.com/coderharshdew/prognospect/blob/main/src/state_builder/state_builder.py) (State builder), [`src/preprocessing/preprocessing.py`](https://github.com/coderharshdew/prognospect/blob/main/src/preprocessing/preprocessing.py) (Preprocessing), [`src/database/pcap_archive_downloader.py`](https://github.com/coderharshdew/prognospect/blob/main/src/database/pcap_archive_downloader.py) (Archive download)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_capture["Capture processing"]
  node_archive["Archive download"]
  node_pcap["PCAP access<br/>[pcap_reader.py]"]
  node_pipeline["Extraction pipeline<br/>[pipelines.py]"]
  node_cicflow["CICFlowMeter adapter<br/>[cicflowmeter.py]"]
  node_frame["Frame parsing"]
  node_packetfeat["Packet features"]
  node_crossflow["Cross-flow features"]
  node_labels["Label and order<br/>[label_and_order.py]"]
  node_featurefiles["Feature CSVs"]
end

subgraph group_representation["State and model"]
  node_states["State builder<br/>[state_builder.py]"]
  node_globalstate["Global state<br/>[global_state.py]"]
  node_hoststate["Host state<br/>[host_state.py]"]
  node_graphstate["Graph state<br/>[graph_state.py]"]
  node_deltastate["State deltas<br/>[delta_state.py]"]
  node_encoder["Graph encoder<br/>[graph_encoder.py]"]
end

subgraph group_interface["Analyst interface"]
  node_web["Web views<br/>[dashboard.html]"]
  node_simulation["UI simulation<br/>[app.js]"]
end

subgraph group_support["Configuration and validation"]
  node_preprocess["Preprocessing<br/>[preprocessing.py]"]
  node_validator["Data validation<br/>[validator.py]"]
  node_config["Extraction config"]
  node_preconfig["Preprocessing config"]
end

node_dataset["CSE-CIC-IDS2018"]
node_analyst(("Defender / analyst"))

node_dataset -->|"source archives"| node_archive
node_archive -->|"downloads PCAPs"| node_pcap
node_pcap -->|"provides captures"| node_pipeline
node_pipeline -->|"runs flow extraction"| node_cicflow
node_pipeline -->|"parses packets"| node_frame
node_pipeline -->|"extracts packet features"| node_packetfeat
node_pipeline -->|"extracts behavior"| node_crossflow
node_pipeline -->|"writes feature rows"| node_featurefiles
node_pipeline -->|"labels merged data"| node_labels
node_cicflow -->|"yields flow rows"| node_featurefiles
node_pipeline -->|"loads settings"| node_config
node_preprocess -->|"validates data"| node_validator
node_preprocess -->|"loads rules"| node_preconfig
node_states -->|"builds"| node_globalstate
node_states -->|"builds"| node_hoststate
node_states -->|"builds"| node_graphstate
node_states -->|"calculates"| node_deltastate
node_analyst -->|"views dashboards"| node_web
node_web -->|"loads script"| node_simulation

click node_archive "https://github.com/coderharshdew/prognospect/blob/main/src/database/pcap_archive_downloader.py"
click node_pcap "https://github.com/coderharshdew/prognospect/blob/main/src/database/pcap_reader.py"
click node_pipeline "https://github.com/coderharshdew/prognospect/blob/main/src/backend/pipelines.py"
click node_cicflow "https://github.com/coderharshdew/prognospect/blob/main/src/extraction/providers/cicflowmeter.py"
click node_frame "https://github.com/coderharshdew/prognospect/blob/main/src/extraction/pcap_frame_parser.py"
click node_packetfeat "https://github.com/coderharshdew/prognospect/blob/main/src/extraction/packet_feature_extractor.py"
click node_crossflow "https://github.com/coderharshdew/prognospect/blob/main/src/extraction/cross_flow_behavioral_feature_extractor.py"
click node_labels "https://github.com/coderharshdew/prognospect/blob/main/src/extraction/label_and_order.py"
click node_featurefiles "https://github.com/coderharshdew/prognospect/blob/main/src/extraction/write_flow_features_csv.py"
click node_preprocess "https://github.com/coderharshdew/prognospect/blob/main/src/preprocessing/preprocessing.py"
click node_validator "https://github.com/coderharshdew/prognospect/blob/main/src/preprocessing/validator.py"
click node_states "https://github.com/coderharshdew/prognospect/blob/main/src/state_builder/state_builder.py"
click node_globalstate "https://github.com/coderharshdew/prognospect/blob/main/src/state_builder/global_state.py"
click node_hoststate "https://github.com/coderharshdew/prognospect/blob/main/src/state_builder/host_state.py"
click node_graphstate "https://github.com/coderharshdew/prognospect/blob/main/src/state_builder/graph_state.py"
click node_deltastate "https://github.com/coderharshdew/prognospect/blob/main/src/state_builder/delta_state.py"
click node_encoder "https://github.com/coderharshdew/prognospect/blob/main/src/ml/graph_encoder.py"
click node_web "https://github.com/coderharshdew/prognospect/blob/main/templates/dashboard.html"
click node_simulation "https://github.com/coderharshdew/prognospect/blob/main/static/js/app.js"
click node_config "https://github.com/coderharshdew/prognospect/tree/main/config/extraction"
click node_preconfig "https://github.com/coderharshdew/prognospect/tree/main/config/preprocessing"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_archive,node_pcap,node_pipeline,node_cicflow,node_frame,node_packetfeat,node_crossflow,node_labels,node_featurefiles toneBlue
class node_states,node_globalstate,node_hoststate,node_graphstate,node_deltastate,node_encoder toneAmber
class node_web,node_simulation toneMint
class node_preprocess,node_validator,node_config,node_preconfig toneRose
class node_dataset,node_analyst toneIndigo
```

## Components

### Capture processing

- [Archive download](https://github.com/coderharshdew/prognospect/blob/main/src/database/pcap_archive_downloader.py): `src/database/pcap_archive_downloader.py`
- [PCAP access](https://github.com/coderharshdew/prognospect/blob/main/src/database/pcap_reader.py): `src/database/pcap_reader.py`
- [Extraction pipeline](https://github.com/coderharshdew/prognospect/blob/main/src/backend/pipelines.py): `src/backend/pipelines.py`
- [CICFlowMeter adapter](https://github.com/coderharshdew/prognospect/blob/main/src/extraction/providers/cicflowmeter.py): `src/extraction/providers/cicflowmeter.py`
- [Frame parsing](https://github.com/coderharshdew/prognospect/blob/main/src/extraction/pcap_frame_parser.py): `src/extraction/pcap_frame_parser.py`
- [Packet features](https://github.com/coderharshdew/prognospect/blob/main/src/extraction/packet_feature_extractor.py): `src/extraction/packet_feature_extractor.py`
- [Cross-flow features](https://github.com/coderharshdew/prognospect/blob/main/src/extraction/cross_flow_behavioral_feature_extractor.py): `src/extraction/cross_flow_behavioral_feature_extractor.py`
- [Label and order](https://github.com/coderharshdew/prognospect/blob/main/src/extraction/label_and_order.py): `src/extraction/label_and_order.py`
- [Feature CSVs](https://github.com/coderharshdew/prognospect/blob/main/src/extraction/write_flow_features_csv.py): `src/extraction/write_flow_features_csv.py`

### State and model

- [State builder](https://github.com/coderharshdew/prognospect/blob/main/src/state_builder/state_builder.py): `src/state_builder/state_builder.py`
- [Global state](https://github.com/coderharshdew/prognospect/blob/main/src/state_builder/global_state.py): `src/state_builder/global_state.py`
- [Host state](https://github.com/coderharshdew/prognospect/blob/main/src/state_builder/host_state.py): `src/state_builder/host_state.py`
- [Graph state](https://github.com/coderharshdew/prognospect/blob/main/src/state_builder/graph_state.py): `src/state_builder/graph_state.py`
- [State deltas](https://github.com/coderharshdew/prognospect/blob/main/src/state_builder/delta_state.py): `src/state_builder/delta_state.py`
- [Graph encoder](https://github.com/coderharshdew/prognospect/blob/main/src/ml/graph_encoder.py): `src/ml/graph_encoder.py`

### Analyst interface

- [Web views](https://github.com/coderharshdew/prognospect/blob/main/templates/dashboard.html): `templates/dashboard.html`
- [UI simulation](https://github.com/coderharshdew/prognospect/blob/main/static/js/app.js): `static/js/app.js`

### Configuration and validation

- [Preprocessing](https://github.com/coderharshdew/prognospect/blob/main/src/preprocessing/preprocessing.py): `src/preprocessing/preprocessing.py`
- [Data validation](https://github.com/coderharshdew/prognospect/blob/main/src/preprocessing/validator.py): `src/preprocessing/validator.py`
- [Extraction config](https://github.com/coderharshdew/prognospect/tree/main/config/extraction): `config/extraction`
- [Preprocessing config](https://github.com/coderharshdew/prognospect/tree/main/config/preprocessing): `config/preprocessing`

### Other components

- **CSE-CIC-IDS2018**
- **Defender / analyst**

## Connections

- CSE-CIC-IDS2018 → Archive download: source archives
- Archive download → PCAP access: downloads PCAPs
- PCAP access → Extraction pipeline: provides captures
- Extraction pipeline → CICFlowMeter adapter: runs flow extraction
- Extraction pipeline → Frame parsing: parses packets
- Extraction pipeline → Packet features: extracts packet features
- Extraction pipeline → Cross-flow features: extracts behavior
- Extraction pipeline → Feature CSVs: writes feature rows
- Extraction pipeline → Label and order: labels merged data
- CICFlowMeter adapter → Feature CSVs: yields flow rows
- Extraction pipeline → Extraction config: loads settings
- Preprocessing → Data validation: validates data
- Preprocessing → Preprocessing config: loads rules
- State builder → Global state: builds
- State builder → Host state: builds
- State builder → Graph state: builds
- State builder → State deltas: calculates
- Defender / analyst → Web views: views dashboards
- Web views → UI simulation: loads script