How ka-1205/sih-2026 works
SIH26145 is a one-way network-threat detection system. In live operation, traffic crosses the emulated diode, the monitor aggregates forward-only windows and submits them for detector and model scoring; fused alerts and benign scores reach the operator dashboard. A separate offline path prepares/replays labeled traffic and extracts features for model training and evaluation. The tree and excerpts support the main runtime links; wiring among some offline replay stages is not fully shown, so those links are omitted.
Main entry points: app.py Inference API · live_pipeline.py Live windowing · extract_features.py Feature extraction · relay.py One-way relay
Components 15
Traffic capture
- Threat generators
attacks/generate.py - One-way relay
diode/relay.py - Live windowing
serving/live_pipeline.py
Detection and scoring
- Threat detectors
detectors - Known-attack model
models/train_xgb.py - Novel-threat model
models/lstm_ae.py - Score fusion
fusion/score.py - Inference API
serving/app.py - Alert schema
serving/alert_schema.py
Operator console
- Live dashboard
dashboard/app.js
Offline data and models
- Feature extraction
extraction/extract_features.py - Batch extraction
extraction/batch_extract.py - Labeled replay
replay
Other components
- Traffic sources
- Operator
Connections 17
- Traffic sources → One-way relay: sends traffic
- Threat generators → One-way relay: sends probes
- One-way relay → Live windowing: forwards packets
- Live windowing → Threat detectors: feeds events
- Live windowing → Inference API: posts windows
- Inference API → Threat detectors: scores evidence
- Inference API → Known-attack model: classifies
- Inference API → Novel-threat model: checks sequences
- Inference API → Score fusion: fuses scores
- Inference API → Alert schema: builds alerts
- Inference API → Live dashboard: streams scores
- Live dashboard → Inference API: polls alerts
- Operator → Live dashboard: views alerts
- Labeled replay → Batch extraction: provides captures
- Batch extraction → Feature extraction: extracts features
- Feature extraction → Known-attack model: training features
- Feature extraction → Novel-threat model: sequence features