# gotedyz/mirai architecture

> Architecture diagram of the GitHub repository gotedyz/mirai, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-15). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/gotedyz/mirai
- Repository: https://github.com/gotedyz/mirai

## Overview

This repository is a PNETLab lab for generating Mirai and benign IoT traffic, capturing it, and analyzing it with an N-BaIoT/AfterImage machine-learning pipeline. The documented workflow configures the lab network, runs scenarios from IoT-Cam-1 while SOC-Sniffer captures PCAPs, extracts features, compares supervised and anomaly-detection models, and produces a SOC report recommending quarantine. Router quarantine is applied manually. The README documents these stages; device scripts and network configurations were not sampled, so their internal behavior is not detailed here.

Main entry points: [`scripts/soc-sniffer`](https://github.com/gotedyz/mirai/tree/main/scripts/soc-sniffer) (SOC sniffer), [`configs/sw-core`](https://github.com/gotedyz/mirai/tree/main/configs/sw-core) (Core switch), [`scripts/iot-cam-1`](https://github.com/gotedyz/mirai/tree/main/scripts/iot-cam-1) (IoT camera), [`ai-pipeline/01_extract_nbaiot_115_features.py`](https://github.com/gotedyz/mirai/blob/main/ai-pipeline/01_extract_nbaiot_115_features.py) (Feature extractor)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_lab["Lab deployment"]
  node_pnet["PNETLab host"]
  node_victim["Web victim"]
  node_router["Home router"]
  node_switch["Core switch"]
end

subgraph group_traffic["Traffic and capture"]
  node_camera["IoT camera"]
  node_sniffer["SOC sniffer"]
  node_pcaps["Scenario PCAPs"]
end

subgraph group_analysis["AI analysis"]
  node_extractor["Feature extractor"]
  node_dataset["Feature dataset"]
  node_models["Model evaluation"]
end

subgraph group_response["SOC response"]
  node_report["SOC alert report"]
  node_quarantine["Soft quarantine"]
end

node_operator(("Lab operator"))
node_colab["Google Colab"]

node_operator -->|"prepares images"| node_pnet
node_operator -->|"installs and configures"| node_victim
node_operator -->|"runs scenarios"| node_camera
node_operator -->|"starts capture"| node_sniffer
node_operator -->|"applies configuration"| node_router
node_operator -->|"applies configuration"| node_switch
node_switch -->|"mirrors traffic"| node_sniffer
node_camera -->|"generates traffic"| node_pcaps
node_sniffer -->|"records scenarios"| node_pcaps
node_pcaps -->|"provides captures"| node_extractor
node_extractor -->|"writes features"| node_dataset
node_dataset -->|"loads CSV"| node_models
node_models -->|"writes findings"| node_report
node_report -->|"recommends action"| node_operator
node_operator -->|"applies mitigation"| node_quarantine
node_operator -.->|"uses notebook"| node_colab
node_sniffer -.->|"syncs for analysis"| node_colab

click node_pnet "https://github.com/gotedyz/mirai/tree/main/scripts/pnetlab-host"
click node_victim "https://github.com/gotedyz/mirai/tree/main/scripts/victima-web"
click node_router "https://github.com/gotedyz/mirai/tree/main/configs/router-hogar"
click node_switch "https://github.com/gotedyz/mirai/tree/main/configs/sw-core"
click node_camera "https://github.com/gotedyz/mirai/tree/main/scripts/iot-cam-1"
click node_sniffer "https://github.com/gotedyz/mirai/tree/main/scripts/soc-sniffer"
click node_pcaps "https://github.com/gotedyz/mirai/tree/main/scripts/soc-sniffer"
click node_extractor "https://github.com/gotedyz/mirai/blob/main/ai-pipeline/01_extract_nbaiot_115_features.py"
click node_dataset "https://github.com/gotedyz/mirai/blob/main/ai-pipeline/01_extract_nbaiot_115_features.py"
click node_models "https://github.com/gotedyz/mirai/blob/main/ai-pipeline/02_train_evaluate_models.py"
click node_report "https://github.com/gotedyz/mirai/blob/main/ai-pipeline/02_train_evaluate_models.py"
click node_quarantine "https://github.com/gotedyz/mirai/tree/main/configs/router-hogar"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_pnet,node_victim,node_router,node_switch toneBlue
class node_camera,node_sniffer,node_pcaps toneAmber
class node_extractor,node_dataset,node_models toneMint
class node_report,node_quarantine toneRose
class node_operator,node_colab toneIndigo
```

## Components

### Lab deployment

- [PNETLab host](https://github.com/gotedyz/mirai/tree/main/scripts/pnetlab-host): `scripts/pnetlab-host`
- [Web victim](https://github.com/gotedyz/mirai/tree/main/scripts/victima-web): `scripts/victima-web`
- [Home router](https://github.com/gotedyz/mirai/tree/main/configs/router-hogar): `configs/router-hogar`
- [Core switch](https://github.com/gotedyz/mirai/tree/main/configs/sw-core): `configs/sw-core`

### Traffic and capture

- [IoT camera](https://github.com/gotedyz/mirai/tree/main/scripts/iot-cam-1): `scripts/iot-cam-1`
- [SOC sniffer](https://github.com/gotedyz/mirai/tree/main/scripts/soc-sniffer): `scripts/soc-sniffer`
- [Scenario PCAPs](https://github.com/gotedyz/mirai/tree/main/scripts/soc-sniffer): `scripts/soc-sniffer`

### AI analysis

- [Feature extractor](https://github.com/gotedyz/mirai/blob/main/ai-pipeline/01_extract_nbaiot_115_features.py): `ai-pipeline/01_extract_nbaiot_115_features.py`
- [Feature dataset](https://github.com/gotedyz/mirai/blob/main/ai-pipeline/01_extract_nbaiot_115_features.py): `ai-pipeline/01_extract_nbaiot_115_features.py`
- [Model evaluation](https://github.com/gotedyz/mirai/blob/main/ai-pipeline/02_train_evaluate_models.py): `ai-pipeline/02_train_evaluate_models.py`

### SOC response

- [SOC alert report](https://github.com/gotedyz/mirai/blob/main/ai-pipeline/02_train_evaluate_models.py): `ai-pipeline/02_train_evaluate_models.py`
- [Soft quarantine](https://github.com/gotedyz/mirai/tree/main/configs/router-hogar): `configs/router-hogar`

### Other components

- **Lab operator**
- **Google Colab**

## Connections

- Lab operator → PNETLab host: prepares images (evidence: `README.md`)
- Lab operator → Web victim: installs and configures (evidence: `README.md`)
- Lab operator → IoT camera: runs scenarios (evidence: `README.md`)
- Lab operator → SOC sniffer: starts capture (evidence: `README.md`)
- Lab operator → Home router: applies configuration (evidence: `README.md`)
- Lab operator → Core switch: applies configuration (evidence: `README.md`)
- Core switch → SOC sniffer: mirrors traffic (evidence: `README.md`)
- IoT camera → Scenario PCAPs: generates traffic (evidence: `README.md`)
- SOC sniffer → Scenario PCAPs: records scenarios (evidence: `README.md`)
- Scenario PCAPs → Feature extractor: provides captures (evidence: `ai-pipeline/01_extract_nbaiot_115_features.py`)
- Feature extractor → Feature dataset: writes features (evidence: `ai-pipeline/01_extract_nbaiot_115_features.py`)
- Feature dataset → Model evaluation: loads CSV (evidence: `ai-pipeline/02_train_evaluate_models.py`)
- Model evaluation → SOC alert report: writes findings (evidence: `ai-pipeline/02_train_evaluate_models.py`)
- SOC alert report → Lab operator: recommends action (evidence: `ai-pipeline/02_train_evaluate_models.py`)
- Lab operator → Soft quarantine: applies mitigation (evidence: `README.md`)
- Lab operator → Google Colab: uses notebook (evidence: `README.md`)
- SOC sniffer → Google Colab: syncs for analysis (evidence: `README.md`)