# ka-1205/sih-2026 architecture

> Architecture diagram of the GitHub repository ka-1205/sih-2026, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ka-1205/sih-2026
- Repository: https://github.com/ka-1205/sih-2026

## Overview

SIH26145 is a one-way network-threat detection system. In live operation, traffic crosses the emulated diode, the monitor aggregates forward-only windows and submits them for detector and model scoring; fused alerts and benign scores reach the operator dashboard. A separate offline path prepares/replays labeled traffic and extracts features for model training and evaluation. The tree and excerpts support the main runtime links; wiring among some offline replay stages is not fully shown, so those links are omitted.

Main entry points: [`serving/app.py`](https://github.com/ka-1205/sih-2026/blob/main/serving/app.py) (Inference API), [`serving/live_pipeline.py`](https://github.com/ka-1205/sih-2026/blob/main/serving/live_pipeline.py) (Live windowing), [`extraction/extract_features.py`](https://github.com/ka-1205/sih-2026/blob/main/extraction/extract_features.py) (Feature extraction), [`diode/relay.py`](https://github.com/ka-1205/sih-2026/blob/main/diode/relay.py) (One-way relay)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_capture["Traffic capture"]
  node_generators["Threat generators<br/>[generate.py]"]
  node_diode["One-way relay<br/>[relay.py]"]
  node_live["Live windowing<br/>[live_pipeline.py]"]
end

subgraph group_analysis["Detection and scoring"]
  node_detectors["Threat detectors"]
  node_classifier["Known-attack model<br/>[train_xgb.py]"]
  node_autoencoder["Novel-threat model<br/>[lstm_ae.py]"]
  node_fusion["Score fusion<br/>[score.py]"]
  node_api["Inference API<br/>[app.py]"]
  node_alerts["Alert schema<br/>[alert_schema.py]"]
end

subgraph group_console["Operator console"]
  node_dashboard["Live dashboard<br/>[app.js]"]
end

subgraph group_offline["Offline data and models"]
  node_extract["Feature extraction"]
  node_batch["Batch extraction<br/>[batch_extract.py]"]
  node_replay["Labeled replay"]
end

node_traffic(("Traffic sources"))
node_operator(("Operator"))

node_traffic -->|"sends traffic"| node_diode
node_generators -.->|"sends probes"| node_diode
node_diode -->|"forwards packets"| node_live
node_live -->|"feeds events"| node_detectors
node_live -->|"posts windows"| node_api
node_api -->|"scores evidence"| node_detectors
node_api -->|"classifies"| node_classifier
node_api -->|"checks sequences"| node_autoencoder
node_api -->|"fuses scores"| node_fusion
node_api -->|"builds alerts"| node_alerts
node_api -->|"streams scores"| node_dashboard
node_dashboard -->|"polls alerts"| node_api
node_operator -->|"views alerts"| node_dashboard
node_replay -->|"provides captures"| node_batch
node_batch -->|"extracts features"| node_extract
node_extract -->|"training features"| node_classifier
node_extract -->|"sequence features"| node_autoencoder

click node_generators "https://github.com/ka-1205/sih-2026/blob/main/attacks/generate.py"
click node_diode "https://github.com/ka-1205/sih-2026/blob/main/diode/relay.py"
click node_live "https://github.com/ka-1205/sih-2026/blob/main/serving/live_pipeline.py"
click node_extract "https://github.com/ka-1205/sih-2026/blob/main/extraction/extract_features.py"
click node_batch "https://github.com/ka-1205/sih-2026/blob/main/extraction/batch_extract.py"
click node_replay "https://github.com/ka-1205/sih-2026/tree/main/replay"
click node_detectors "https://github.com/ka-1205/sih-2026/tree/main/detectors"
click node_classifier "https://github.com/ka-1205/sih-2026/blob/main/models/train_xgb.py"
click node_autoencoder "https://github.com/ka-1205/sih-2026/blob/main/models/lstm_ae.py"
click node_fusion "https://github.com/ka-1205/sih-2026/blob/main/fusion/score.py"
click node_api "https://github.com/ka-1205/sih-2026/blob/main/serving/app.py"
click node_alerts "https://github.com/ka-1205/sih-2026/blob/main/serving/alert_schema.py"
click node_dashboard "https://github.com/ka-1205/sih-2026/blob/main/dashboard/app.js"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_generators,node_diode,node_live toneBlue
class node_detectors,node_classifier,node_autoencoder,node_fusion,node_api,node_alerts toneAmber
class node_dashboard toneMint
class node_extract,node_batch,node_replay toneRose
class node_traffic,node_operator toneIndigo
```

## Components

### Traffic capture

- [Threat generators](https://github.com/ka-1205/sih-2026/blob/main/attacks/generate.py): `attacks/generate.py`
- [One-way relay](https://github.com/ka-1205/sih-2026/blob/main/diode/relay.py): `diode/relay.py`
- [Live windowing](https://github.com/ka-1205/sih-2026/blob/main/serving/live_pipeline.py): `serving/live_pipeline.py`

### Detection and scoring

- [Threat detectors](https://github.com/ka-1205/sih-2026/tree/main/detectors): `detectors`
- [Known-attack model](https://github.com/ka-1205/sih-2026/blob/main/models/train_xgb.py): `models/train_xgb.py`
- [Novel-threat model](https://github.com/ka-1205/sih-2026/blob/main/models/lstm_ae.py): `models/lstm_ae.py`
- [Score fusion](https://github.com/ka-1205/sih-2026/blob/main/fusion/score.py): `fusion/score.py`
- [Inference API](https://github.com/ka-1205/sih-2026/blob/main/serving/app.py): `serving/app.py`
- [Alert schema](https://github.com/ka-1205/sih-2026/blob/main/serving/alert_schema.py): `serving/alert_schema.py`

### Operator console

- [Live dashboard](https://github.com/ka-1205/sih-2026/blob/main/dashboard/app.js): `dashboard/app.js`

### Offline data and models

- [Feature extraction](https://github.com/ka-1205/sih-2026/blob/main/extraction/extract_features.py): `extraction/extract_features.py`
- [Batch extraction](https://github.com/ka-1205/sih-2026/blob/main/extraction/batch_extract.py): `extraction/batch_extract.py`
- [Labeled replay](https://github.com/ka-1205/sih-2026/tree/main/replay): `replay`

### Other components

- **Traffic sources**
- **Operator**

## Connections

- Traffic sources → One-way relay: sends traffic
- Threat generators → One-way relay: sends probes
- One-way relay → Live windowing: forwards packets
- Live windowing → Threat detectors: feeds events
- Live windowing → Inference API: posts windows
- Inference API → Threat detectors: scores evidence
- Inference API → Known-attack model: classifies
- Inference API → Novel-threat model: checks sequences
- Inference API → Score fusion: fuses scores
- Inference API → Alert schema: builds alerts
- Inference API → Live dashboard: streams scores
- Live dashboard → Inference API: polls alerts
- Operator → Live dashboard: views alerts
- Labeled replay → Batch extraction: provides captures
- Batch extraction → Feature extraction: extracts features
- Feature extraction → Known-attack model: training features
- Feature extraction → Novel-threat model: sequence features