How nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system works
SecNet is a real-time network intrusion detection and prevention system with a Leptos dashboard. Its main workflow captures or simulates packets, analyzes traffic with detection rules, persists traffic and alerts, and exposes results through REST and WebSocket streams. The backend also manages authentication, rules, blocklists, audit records, and notification channels; critical detections can trigger automatic blocking. The README documents additional storage and notification behavior beyond the sampled excerpts, so uncertain implementation links are omitted.
Main entry points: engine.rs Detection Engine · routes.rs REST and WS Routes · app.rs Dashboard App · main.rs Engine Runtime
Components 20
Capture and Detection
- Traffic Simulator
crates/capture-engine/src/capture/simulator.rs - Live Capture
crates/capture-engine/src/capture/live.rs - Engine Runtime
crates/capture-engine/src/main.rs - Detection Rules
crates/capture-engine/src/detection - Detection Engine
crates/capture-engine/src/detection/engine.rs
API and Alerting
- Backend Runtime
crates/backend/src/main.rs - REST and WS Routes
crates/backend/src/routes.rs - Authentication and RBAC
crates/backend/src/auth - API Handlers
crates/backend/src/handlers - Alert Dispatcher
crates/backend/src/alerting - Notification Channels
crates/backend/src/alerting - Auto-Response
crates/capture-engine/src/detection/engine.rs
Shared Data
- Domain Models
crates/common/src/models - PostgreSQL / TimescaleDB
Dashboard
- Dashboard App
crates/frontend/src/app.rs - API Client
crates/frontend/src/api/client.rs - Live Stream Client
crates/frontend/src/ws/client.rs - Security Views
crates/frontend/src/pages
Other components
- Network Interface
- Analyst Browser
Connections 24
- Network Interface → Live Capture: supplies frames
- Traffic Simulator → Engine Runtime: provides events
- Live Capture → Engine Runtime: provides events
- Engine Runtime → Detection Engine: processes events
- Detection Engine → Detection Rules: evaluates rules
- Engine Runtime → PostgreSQL / TimescaleDB: persists traffic
- Detection Engine → PostgreSQL / TimescaleDB: stores alerts
- Detection Engine → Auto-Response: dispatches blocks
- Auto-Response → PostgreSQL / TimescaleDB: updates blocklist
- Backend Runtime → PostgreSQL / TimescaleDB: listens for changes
- Backend Runtime → Alert Dispatcher: dispatches alerts
- Alert Dispatcher → Notification Channels: sends notifications
- Backend Runtime → REST and WS Routes: serves
- REST and WS Routes → API Handlers: dispatches requests
- REST and WS Routes → Authentication and RBAC: protects routes
- API Handlers → PostgreSQL / TimescaleDB: reads and writes
- Analyst Browser → Dashboard App: uses dashboard
- Dashboard App → API Client: requests data
- API Client → REST and WS Routes: calls REST API
- Dashboard App → Live Stream Client: starts streams
- Live Stream Client → REST and WS Routes: subscribes to streams
- Dashboard App → Security Views: renders views
- Detection Engine → Domain Models: uses models
- API Handlers → Domain Models: uses models