# lina123-alt/ai-cyber-soc architecture

> Architecture diagram of the GitHub repository lina123-alt/ai-cyber-soc, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/lina123-alt/ai-cyber-soc
- Repository: https://github.com/lina123-alt/ai-cyber-soc

## Overview

AI-Cyber-SOC is a Flask SOC dashboard: an operator views traffic-derived risk summaries, can ask contextual security questions, request a simulated IP ban, or inject synthetic attacks. The main analysis stages are log-pattern parsing, per-IP feature aggregation, ML risk scoring, and dashboard/report presentation. Model training and synthetic-data generation are separate supporting capabilities. Source excerpts show the app calling the analyzer, simulator, and Gemini; they do not establish all storage wiring. In particular, referenced log and training-data paths differ from files in the tree.

Main entry points: [`app.py`](https://github.com/lina123-alt/ai-cyber-soc/blob/main/app.py) (Flask routes), [`analyzer.py`](https://github.com/lina123-alt/ai-cyber-soc/blob/main/analyzer.py) (Log analysis), [`report.html`](https://github.com/lina123-alt/ai-cyber-soc/blob/main/report.html) (SOC dashboard), [`loading.html`](https://github.com/lina123-alt/ai-cyber-soc/blob/main/loading.html) (Loading screen)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_web["SOC web app"]
  node_flask["Flask routes<br/>[app.py]"]
  node_dashboard["SOC dashboard<br/>[report.html]"]
  node_loading["Loading screen<br/>[loading.html]"]
  node_ban["Ban IP endpoint<br/>[app.py]"]
  node_question["Cyber Q&amp;A<br/>[app.py]"]
  node_ban_result["Ban confirmation<br/>[app.py]"]
end

subgraph group_analysis["Threat analysis"]
  node_log_analysis["Log analysis<br/>[analyzer.py]"]
  node_pattern_detection["Pattern detection<br/>[analyzer.py]"]
  node_risk_scoring["Per-IP risk scoring<br/>[analyzer.py]"]
end

subgraph group_ml["ML support"]
  node_model_training["Random Forest training<br/>[ml_model.py]"]
  node_dataset_generation["Synthetic dataset generation"]
end

subgraph group_simulation["Attack simulation"]
  node_attack_simulator["Attack simulator"]
end

node_operator(("SOC operator"))
node_gemini["Gemini API"]

node_operator -->|"opens dashboard"| node_flask
node_flask -->|"analyzes logs"| node_log_analysis
node_log_analysis -->|"parses patterns"| node_pattern_detection
node_log_analysis -->|"scores IPs"| node_risk_scoring
node_flask -->|"renders report"| node_dashboard
node_operator -->|"asks question"| node_question
node_question -->|"gets statistics"| node_log_analysis
node_question -.->|"requests analysis"| node_gemini
node_gemini -.->|"returns answer"| node_question
node_operator -->|"requests ban"| node_ban
node_ban -->|"returns confirmation"| node_ban_result
node_operator -->|"opens loading"| node_flask
node_flask -->|"renders screen"| node_loading
node_flask -->|"runs simulation"| node_attack_simulator

click node_flask "https://github.com/lina123-alt/ai-cyber-soc/blob/main/app.py"
click node_dashboard "https://github.com/lina123-alt/ai-cyber-soc/blob/main/report.html"
click node_loading "https://github.com/lina123-alt/ai-cyber-soc/blob/main/loading.html"
click node_ban "https://github.com/lina123-alt/ai-cyber-soc/blob/main/app.py"
click node_question "https://github.com/lina123-alt/ai-cyber-soc/blob/main/app.py"
click node_log_analysis "https://github.com/lina123-alt/ai-cyber-soc/blob/main/analyzer.py"
click node_pattern_detection "https://github.com/lina123-alt/ai-cyber-soc/blob/main/analyzer.py"
click node_risk_scoring "https://github.com/lina123-alt/ai-cyber-soc/blob/main/analyzer.py"
click node_model_training "https://github.com/lina123-alt/ai-cyber-soc/blob/main/ml_model.py"
click node_dataset_generation "https://github.com/lina123-alt/ai-cyber-soc/blob/main/generate_dataset.py"
click node_attack_simulator "https://github.com/lina123-alt/ai-cyber-soc/blob/main/simulate_attacks.py"
click node_ban_result "https://github.com/lina123-alt/ai-cyber-soc/blob/main/app.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_flask,node_dashboard,node_loading,node_ban,node_question,node_ban_result toneBlue
class node_log_analysis,node_pattern_detection,node_risk_scoring toneAmber
class node_model_training,node_dataset_generation,node_gemini toneMint
class node_attack_simulator toneRose
class node_operator toneIndigo
```

## Components

### SOC web app

- [Flask routes](https://github.com/lina123-alt/ai-cyber-soc/blob/main/app.py): `app.py`
- [SOC dashboard](https://github.com/lina123-alt/ai-cyber-soc/blob/main/report.html): `report.html`
- [Loading screen](https://github.com/lina123-alt/ai-cyber-soc/blob/main/loading.html): `loading.html`
- [Ban IP endpoint](https://github.com/lina123-alt/ai-cyber-soc/blob/main/app.py): `app.py`
- [Cyber Q&A](https://github.com/lina123-alt/ai-cyber-soc/blob/main/app.py): `app.py`
- [Ban confirmation](https://github.com/lina123-alt/ai-cyber-soc/blob/main/app.py): `app.py`

### Threat analysis

- [Log analysis](https://github.com/lina123-alt/ai-cyber-soc/blob/main/analyzer.py): `analyzer.py`
- [Pattern detection](https://github.com/lina123-alt/ai-cyber-soc/blob/main/analyzer.py): `analyzer.py`
- [Per-IP risk scoring](https://github.com/lina123-alt/ai-cyber-soc/blob/main/analyzer.py): `analyzer.py`

### ML support

- [Random Forest training](https://github.com/lina123-alt/ai-cyber-soc/blob/main/ml_model.py): `ml_model.py`
- [Synthetic dataset generation](https://github.com/lina123-alt/ai-cyber-soc/blob/main/generate_dataset.py): `generate_dataset.py`

### Attack simulation

- [Attack simulator](https://github.com/lina123-alt/ai-cyber-soc/blob/main/simulate_attacks.py): `simulate_attacks.py`

### Other components

- **SOC operator**
- **Gemini API**

## Connections

- SOC operator → Flask routes: opens dashboard
- Flask routes → Log analysis: analyzes logs
- Log analysis → Pattern detection: parses patterns
- Log analysis → Per-IP risk scoring: scores IPs
- Flask routes → SOC dashboard: renders report
- SOC operator → Cyber Q&A: asks question
- Cyber Q&A → Log analysis: gets statistics
- Cyber Q&A → Gemini API: requests analysis
- Gemini API → Cyber Q&A: returns answer
- SOC operator → Ban IP endpoint: requests ban
- Ban IP endpoint → Ban confirmation: returns confirmation
- SOC operator → Flask routes: opens loading
- Flask routes → Loading screen: renders screen
- Flask routes → Attack simulator: runs simulation