How ksahithir/ai-nids works
AI-NIDS accepts network-flow records or CSV uploads, validates and classifies them, assigns threat severity, persists predictions, and creates alerts for attacks. The SOC dashboard presents posture, live simulation, batch analysis, attack analytics, alert triage, model metrics, and system information. The README documents the training and evaluation pipeline; its detailed implementation wiring is not established by the sampled excerpts, so those links are omitted.
Main entry points: App.jsx Dashboard Shell · routes.py REST Endpoints · nids_service.py NIDS Orchestrator · db.py Database Operations
Components 23
Traffic Ingestion
- API Application
backend/app/main.py - REST Endpoints
backend/app/api/routes.py - Flow Simulation
backend/app/services/simulation_service.py - Test Flow Samples
data/processed/sample_traffic_test.csv
Detection Pipeline
- NIDS Orchestrator
backend/app/services/nids_service.py - Inference & Severity
ml/predict.py - Feature Preparation
ml/preprocessing.py - Model Training
ml/train.py - Model Evaluation
ml/evaluate.py - Trained Artifacts
models/final_model.joblib
Event Records
- Database Operations
backend/app/database/db.py - SQLite Event Store
SOC Dashboard
- Dashboard Shell
frontend/src/App.jsx - API Client
frontend/src/services/api.js - Security Dashboard
frontend/src/pages/Dashboard.jsx - Live Monitoring
frontend/src/pages/LiveMonitoring.jsx - Batch Analysis
frontend/src/pages/TrafficAnalysis.jsx - Attack Analytics
frontend/src/pages/AttackAnalytics.jsx - Alert Triage
frontend/src/pages/AlertCenter.jsx - Model Audit
frontend/src/pages/ModelPerformance.jsx - System Information
frontend/src/pages/SystemInfo.jsx
Other components
- SOC Analyst
- Flow Telemetry
Connections 23
- SOC Analyst → Dashboard Shell: uses
- Flow Telemetry → REST Endpoints: submits flows
- Dashboard Shell → API Client: requests data
- API Client → REST Endpoints: calls API
- REST Endpoints → NIDS Orchestrator: dispatches inference
- REST Endpoints → Database Operations: queries records
- REST Endpoints → Flow Simulation: requests sample
- Flow Simulation → Test Flow Samples: reads samples
- REST Endpoints → NIDS Orchestrator: sends sampled flow
- NIDS Orchestrator → Inference & Severity: predicts flows
- NIDS Orchestrator → Database Operations: records results
- Database Operations → SQLite Event Store: reads and writes
- API Application → Database Operations: initializes store
- API Application → NIDS Orchestrator: warms model
- Dashboard Shell → Security Dashboard: renders
- Dashboard Shell → Live Monitoring: renders
- Dashboard Shell → Batch Analysis: renders
- Dashboard Shell → Attack Analytics: renders
- Dashboard Shell → Alert Triage: renders
- Dashboard Shell → Model Audit: renders
- Dashboard Shell → System Information: renders
- Model Training → Feature Preparation: fits pipeline
- Model Evaluation → Trained Artifacts: evaluates artifacts