How jadkissa/mpu-project02 works
M-NIDS combines signature detection with two behavioral stages: per-flow anomaly scoring and windowed source-IP scan/persistence analysis. Both alert streams are normalized by the watcher, ingested by FastAPI, and stored for dashboard queries; PostgreSQL also supports push alerting to Telegram through n8n. Users view refreshed alert tables, summary statistics, and protocol charts. The README documents the proxy and notification topology; sampled source confirms detector, ingestion, query, and dashboard wiring, but not the internals of those integrations.
Main entry points: main.py FastAPI routes · App.js Dashboard app · alerts.py Alert ingestion and reads · nginx.conf Nginx proxy
Components 20
Detection layers
- Snort signatures
snort/snort.lua - Flow ML detector
ml_model/detector.py - Snort alert log
snort - ML alert log
ml_model/detector.py
Alert platform
- Alert watcher
alerts_watcher.py - FastAPI routes
dashboard/backend/main.py - Alert ingestion and reads
dashboard/backend/routes/alerts.py - Statistics queries
dashboard/backend/routes/stats.py - Alert validation
dashboard/backend/schemas/alerts.py - Database access
dashboard/backend/database.py - PostgreSQL alerts
init.sql
Dashboard
- Dashboard app
dashboard/frontend/src/App.js - API client
dashboard/frontend/src/api/index.js - Alert tables
dashboard/frontend/src/components - Stats and chart
dashboard/frontend/src/components
External integrations
- Nginx proxy
nginx/nginx.conf - n8n workflow
Other components
- Network traffic
- Dashboard user
- Telegram
Connections 23
- Network traffic → Snort signatures: inspects packets
- Network traffic → Flow ML detector: extracts flows
- Snort signatures → Snort alert log: writes alerts
- Flow ML detector → ML alert log: writes alerts
- Snort alert log → Alert watcher: tails alerts
- ML alert log → Alert watcher: tails alerts
- Alert watcher → FastAPI routes: POSTs alerts
- FastAPI routes → Alert ingestion and reads: dispatches
- Alert ingestion and reads → Alert validation: validates payload
- Alert ingestion and reads → Database access: queries and writes
- Statistics queries → Database access: queries
- Database access → PostgreSQL alerts: reads and writes
- PostgreSQL alerts → n8n workflow: LISTEN/NOTIFY
- n8n workflow → Telegram: sends alerts
- Dashboard user → Nginx proxy: opens dashboard
- Nginx proxy → Dashboard app: proxies UI
- Nginx proxy → FastAPI routes: proxies API
- Dashboard app → API client: requests data
- API client → FastAPI routes: calls endpoints
- FastAPI routes → Alert ingestion and reads: serves alert data
- FastAPI routes → Statistics queries: serves statistics
- Dashboard app → Alert tables: renders alerts
- Dashboard app → Stats and chart: renders metrics