# ksahithir/ai-nids architecture

> Architecture diagram of the GitHub repository ksahithir/ai-nids, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ksahithir/ai-nids
- Repository: https://github.com/ksahithir/ai-nids

## Overview

AI-NIDS accepts network-flow records or CSV uploads, validates and classifies them, assigns threat severity, persists predictions, and creates alerts for attacks. The SOC dashboard presents posture, live simulation, batch analysis, attack analytics, alert triage, model metrics, and system information. The README documents the training and evaluation pipeline; its detailed implementation wiring is not established by the sampled excerpts, so those links are omitted.

Main entry points: [`frontend/src/App.jsx`](https://github.com/ksahithir/ai-nids/blob/main/frontend/src/App.jsx) (Dashboard Shell), [`backend/app/api/routes.py`](https://github.com/ksahithir/ai-nids/blob/main/backend/app/api/routes.py) (REST Endpoints), [`backend/app/services/nids_service.py`](https://github.com/ksahithir/ai-nids/blob/main/backend/app/services/nids_service.py) (NIDS Orchestrator), [`backend/app/database/db.py`](https://github.com/ksahithir/ai-nids/blob/main/backend/app/database/db.py) (Database Operations)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ingestion["Traffic Ingestion"]
  node_app["API Application<br/>[main.py]"]
  node_routes["REST Endpoints<br/>[routes.py]"]
  node_simulation["Flow Simulation"]
  node_sample_data["Test Flow Samples"]
end

subgraph group_detection["Detection Pipeline"]
  node_nids_service["NIDS Orchestrator<br/>[nids_service.py]"]
  node_predictor["Inference &amp; Severity<br/>[predict.py]"]
  node_preprocessing["Feature Preparation<br/>[preprocessing.py]"]
  node_training["Model Training<br/>[train.py]"]
  node_evaluation["Model Evaluation<br/>[evaluate.py]"]
  node_model_files["Trained Artifacts<br/>[final_model.joblib]"]
end

subgraph group_persistence["Event Records"]
  node_db_access["Database Operations<br/>[db.py]"]
  node_sqlite[("SQLite Event Store")]
end

subgraph group_soc["SOC Dashboard"]
  node_ui["Dashboard Shell<br/>[App.jsx]"]
  node_api_client["API Client<br/>[api.js]"]
  node_dashboard["Security Dashboard<br/>[Dashboard.jsx]"]
  node_live["Live Monitoring<br/>[LiveMonitoring.jsx]"]
  node_traffic_analysis["Batch Analysis"]
  node_attack_analytics["Attack Analytics"]
  node_alert_center["Alert Triage<br/>[AlertCenter.jsx]"]
  node_model_performance["Model Audit"]
  node_system_info["System Information<br/>[SystemInfo.jsx]"]
end

node_analyst(("SOC Analyst"))
node_traffic["Flow Telemetry"]

node_analyst -->|"uses"| node_ui
node_traffic -->|"submits flows"| node_routes
node_ui -->|"requests data"| node_api_client
node_api_client -->|"calls API"| node_routes
node_routes -->|"dispatches inference"| node_nids_service
node_routes -->|"queries records"| node_db_access
node_routes -->|"requests sample"| node_simulation
node_simulation -->|"reads samples"| node_sample_data
node_routes -->|"sends sampled flow"| node_nids_service
node_nids_service -->|"predicts flows"| node_predictor
node_nids_service -->|"records results"| node_db_access
node_db_access -->|"reads and writes"| node_sqlite
node_app -->|"initializes store"| node_db_access
node_app -->|"warms model"| node_nids_service
node_ui -->|"renders"| node_dashboard
node_ui -->|"renders"| node_live
node_ui -->|"renders"| node_traffic_analysis
node_ui -->|"renders"| node_attack_analytics
node_ui -->|"renders"| node_alert_center
node_ui -->|"renders"| node_model_performance
node_ui -->|"renders"| node_system_info
node_training -->|"fits pipeline"| node_preprocessing
node_evaluation -->|"evaluates artifacts"| node_model_files

click node_app "https://github.com/ksahithir/ai-nids/blob/main/backend/app/main.py"
click node_routes "https://github.com/ksahithir/ai-nids/blob/main/backend/app/api/routes.py"
click node_ui "https://github.com/ksahithir/ai-nids/blob/main/frontend/src/App.jsx"
click node_api_client "https://github.com/ksahithir/ai-nids/blob/main/frontend/src/services/api.js"
click node_dashboard "https://github.com/ksahithir/ai-nids/blob/main/frontend/src/pages/Dashboard.jsx"
click node_live "https://github.com/ksahithir/ai-nids/blob/main/frontend/src/pages/LiveMonitoring.jsx"
click node_traffic_analysis "https://github.com/ksahithir/ai-nids/blob/main/frontend/src/pages/TrafficAnalysis.jsx"
click node_attack_analytics "https://github.com/ksahithir/ai-nids/blob/main/frontend/src/pages/AttackAnalytics.jsx"
click node_alert_center "https://github.com/ksahithir/ai-nids/blob/main/frontend/src/pages/AlertCenter.jsx"
click node_model_performance "https://github.com/ksahithir/ai-nids/blob/main/frontend/src/pages/ModelPerformance.jsx"
click node_system_info "https://github.com/ksahithir/ai-nids/blob/main/frontend/src/pages/SystemInfo.jsx"
click node_nids_service "https://github.com/ksahithir/ai-nids/blob/main/backend/app/services/nids_service.py"
click node_predictor "https://github.com/ksahithir/ai-nids/blob/main/ml/predict.py"
click node_preprocessing "https://github.com/ksahithir/ai-nids/blob/main/ml/preprocessing.py"
click node_simulation "https://github.com/ksahithir/ai-nids/blob/main/backend/app/services/simulation_service.py"
click node_sample_data "https://github.com/ksahithir/ai-nids/blob/main/data/processed/sample_traffic_test.csv"
click node_db_access "https://github.com/ksahithir/ai-nids/blob/main/backend/app/database/db.py"
click node_training "https://github.com/ksahithir/ai-nids/blob/main/ml/train.py"
click node_evaluation "https://github.com/ksahithir/ai-nids/blob/main/ml/evaluate.py"
click node_model_files "https://github.com/ksahithir/ai-nids/blob/main/models/final_model.joblib"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app,node_routes,node_simulation,node_sample_data toneBlue
class node_nids_service,node_predictor,node_preprocessing,node_training,node_evaluation,node_model_files toneAmber
class node_db_access,node_sqlite toneMint
class node_ui,node_api_client,node_dashboard,node_live,node_traffic_analysis,node_attack_analytics,node_alert_center,node_model_performance,node_system_info toneRose
class node_analyst,node_traffic toneIndigo
```

## Components

### Traffic Ingestion

- [API Application](https://github.com/ksahithir/ai-nids/blob/main/backend/app/main.py): `backend/app/main.py`
- [REST Endpoints](https://github.com/ksahithir/ai-nids/blob/main/backend/app/api/routes.py): `backend/app/api/routes.py`
- [Flow Simulation](https://github.com/ksahithir/ai-nids/blob/main/backend/app/services/simulation_service.py): `backend/app/services/simulation_service.py`
- [Test Flow Samples](https://github.com/ksahithir/ai-nids/blob/main/data/processed/sample_traffic_test.csv): `data/processed/sample_traffic_test.csv`

### Detection Pipeline

- [NIDS Orchestrator](https://github.com/ksahithir/ai-nids/blob/main/backend/app/services/nids_service.py): `backend/app/services/nids_service.py`
- [Inference & Severity](https://github.com/ksahithir/ai-nids/blob/main/ml/predict.py): `ml/predict.py`
- [Feature Preparation](https://github.com/ksahithir/ai-nids/blob/main/ml/preprocessing.py): `ml/preprocessing.py`
- [Model Training](https://github.com/ksahithir/ai-nids/blob/main/ml/train.py): `ml/train.py`
- [Model Evaluation](https://github.com/ksahithir/ai-nids/blob/main/ml/evaluate.py): `ml/evaluate.py`
- [Trained Artifacts](https://github.com/ksahithir/ai-nids/blob/main/models/final_model.joblib): `models/final_model.joblib`

### Event Records

- [Database Operations](https://github.com/ksahithir/ai-nids/blob/main/backend/app/database/db.py): `backend/app/database/db.py`
- **SQLite Event Store**

### SOC Dashboard

- [Dashboard Shell](https://github.com/ksahithir/ai-nids/blob/main/frontend/src/App.jsx): `frontend/src/App.jsx`
- [API Client](https://github.com/ksahithir/ai-nids/blob/main/frontend/src/services/api.js): `frontend/src/services/api.js`
- [Security Dashboard](https://github.com/ksahithir/ai-nids/blob/main/frontend/src/pages/Dashboard.jsx): `frontend/src/pages/Dashboard.jsx`
- [Live Monitoring](https://github.com/ksahithir/ai-nids/blob/main/frontend/src/pages/LiveMonitoring.jsx): `frontend/src/pages/LiveMonitoring.jsx`
- [Batch Analysis](https://github.com/ksahithir/ai-nids/blob/main/frontend/src/pages/TrafficAnalysis.jsx): `frontend/src/pages/TrafficAnalysis.jsx`
- [Attack Analytics](https://github.com/ksahithir/ai-nids/blob/main/frontend/src/pages/AttackAnalytics.jsx): `frontend/src/pages/AttackAnalytics.jsx`
- [Alert Triage](https://github.com/ksahithir/ai-nids/blob/main/frontend/src/pages/AlertCenter.jsx): `frontend/src/pages/AlertCenter.jsx`
- [Model Audit](https://github.com/ksahithir/ai-nids/blob/main/frontend/src/pages/ModelPerformance.jsx): `frontend/src/pages/ModelPerformance.jsx`
- [System Information](https://github.com/ksahithir/ai-nids/blob/main/frontend/src/pages/SystemInfo.jsx): `frontend/src/pages/SystemInfo.jsx`

### Other components

- **SOC Analyst**
- **Flow Telemetry**

## Connections

- SOC Analyst → Dashboard Shell: uses
- Flow Telemetry → REST Endpoints: submits flows
- Dashboard Shell → API Client: requests data
- API Client → REST Endpoints: calls API
- REST Endpoints → NIDS Orchestrator: dispatches inference
- REST Endpoints → Database Operations: queries records
- REST Endpoints → Flow Simulation: requests sample
- Flow Simulation → Test Flow Samples: reads samples
- REST Endpoints → NIDS Orchestrator: sends sampled flow
- NIDS Orchestrator → Inference & Severity: predicts flows
- NIDS Orchestrator → Database Operations: records results
- Database Operations → SQLite Event Store: reads and writes
- API Application → Database Operations: initializes store
- API Application → NIDS Orchestrator: warms model
- Dashboard Shell → Security Dashboard: renders
- Dashboard Shell → Live Monitoring: renders
- Dashboard Shell → Batch Analysis: renders
- Dashboard Shell → Attack Analytics: renders
- Dashboard Shell → Alert Triage: renders
- Dashboard Shell → Model Audit: renders
- Dashboard Shell → System Information: renders
- Model Training → Feature Preparation: fits pipeline
- Model Evaluation → Trained Artifacts: evaluates artifacts