How gagan-long/sih2026-ai-network-attack-forecaster- works
AI Network Attack Forecaster is an offline analyst dashboard for turning PCAP captures or flow CSVs into multi-step attack-risk forecasts. Its main workflow extracts or normalizes telemetry, creates source-IP time-window sequences, and rolls a multi-task model forward to estimate risk and MITRE ATT&CK stages; the dashboard presents those results and feature drivers. The repository also documents dataset preparation, synthetic captures, and a static baseline. The graph follows the README and sampled calls; unsampled subsystem links are omitted where wiring is not established.
Main entry points: app.py Streamlit dashboard · run_pipeline.py Pipeline launcher · inference.py Autoregressive forecast · logistic_regression.py Logistic regression baseline
Components 18
Telemetry ingestion
- PCAP extraction
Tool/features/pcap_extractor.py - Flow CSV ingestion
Tool/features/extract_flows.py - Canonical schema
Tool/features/canonical_schema.py - Synthetic capture generation
Tool/scripts/generate_synthetic_pcap.py - CIC dataset preparation
Tool/scripts/prepare_dataset.py
Temporal sequences
- Windowed sequences
Tool/features/build_sequences.py
Forecasting
- CNN-BiLSTM model
Tool/models/world_model.py - Autoregressive forecast
Tool/models/inference.py - Risk and tactic results
Tool/models/inference.py - Saved checkpoint
Tool/models/saved/best_world_model.keras - MITRE threat context
Tool/intelligence/kb_mapper.py
Analyst dashboard
- Streamlit dashboard
Tool/app/app.py - Forecast visualizations
Tool/app/components.py
Model development
- Pipeline launcher
Tool/run_pipeline.py - Logistic regression baseline
Tool/baseline/logistic_regression.py - World-model training
Tool/models/train.py
Other components
- Analyst
- PCAP or flow CSV
Connections 23
- Analyst → Streamlit dashboard: uploads telemetry
- PCAP or flow CSV → Streamlit dashboard: provides input
- Streamlit dashboard → PCAP extraction: parses PCAP
- Streamlit dashboard → Flow CSV ingestion: loads CSV
- Streamlit dashboard → Canonical schema: normalizes PCAP
- Flow CSV ingestion → Canonical schema: normalizes flows
- Streamlit dashboard → Windowed sequences: builds windows
- Pipeline launcher → Synthetic capture generation: generates capture
- Pipeline launcher → PCAP extraction: extracts features
- Pipeline launcher → Windowed sequences: builds sequences
- Pipeline launcher → CNN-BiLSTM model: builds model
- Pipeline launcher → World-model training: trains model
- World-model training → Saved checkpoint: saves weights
- Pipeline launcher → Logistic regression baseline: runs evaluation
- Logistic regression baseline → PCAP extraction: extracts features
- Logistic regression baseline → Canonical schema: standardizes flows
- Streamlit dashboard → Saved checkpoint: loads weights
- Streamlit dashboard → Autoregressive forecast: requests forecast
- Autoregressive forecast → CNN-BiLSTM model: predicts states
- Autoregressive forecast → Risk and tactic results: produces forecast
- Streamlit dashboard → Risk and tactic results: renders results
- Streamlit dashboard → Forecast visualizations: renders charts
- CIC dataset preparation → PCAP or flow CSV: prepares CSV