# nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system architecture

> Architecture diagram of the GitHub repository nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system
- Repository: https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system

## Overview

SecNet is a real-time network intrusion detection and prevention system with a Leptos dashboard. Its main workflow captures or simulates packets, analyzes traffic with detection rules, persists traffic and alerts, and exposes results through REST and WebSocket streams. The backend also manages authentication, rules, blocklists, audit records, and notification channels; critical detections can trigger automatic blocking. The README documents additional storage and notification behavior beyond the sampled excerpts, so uncertain implementation links are omitted.

Main entry points: [`crates/capture-engine/src/detection/engine.rs`](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/capture-engine/src/detection/engine.rs) (Detection Engine), [`crates/backend/src/routes.rs`](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/backend/src/routes.rs) (REST and WS Routes), [`crates/frontend/src/app.rs`](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/frontend/src/app.rs) (Dashboard App), [`crates/capture-engine/src/main.rs`](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/capture-engine/src/main.rs) (Engine Runtime)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_capture["Capture and Detection"]
  node_simulator["Traffic Simulator<br/>[simulator.rs]"]
  node_capture_src["Live Capture<br/>[live.rs]"]
  node_engine_main["Engine Runtime<br/>[main.rs]"]
  node_detectors["Detection Rules"]
  node_detection_engine["Detection Engine<br/>[engine.rs]"]
end

subgraph group_backend["API and Alerting"]
  node_api_runtime["Backend Runtime<br/>[main.rs]"]
  node_routes["REST and WS Routes<br/>[routes.rs]"]
  node_auth["Authentication and RBAC"]
  node_handlers["API Handlers"]
  node_alerting["Alert Dispatcher"]
  node_channels["Notification Channels"]
  node_blocklist["Auto-Response<br/>[engine.rs]"]
end

subgraph group_data["Shared Data"]
  node_shared_models["Domain Models"]
  node_database[("PostgreSQL / TimescaleDB")]
end

subgraph group_frontend["Dashboard"]
  node_app["Dashboard App<br/>[app.rs]"]
  node_api_client["API Client<br/>[client.rs]"]
  node_ws_client["Live Stream Client<br/>[client.rs]"]
  node_pages["Security Views"]
end

node_network(("Network Interface"))
node_browser(("Analyst Browser"))

node_network -->|"supplies frames"| node_capture_src
node_simulator -->|"provides events"| node_engine_main
node_capture_src -->|"provides events"| node_engine_main
node_engine_main -->|"processes events"| node_detection_engine
node_detection_engine -->|"evaluates rules"| node_detectors
node_engine_main -->|"persists traffic"| node_database
node_detection_engine -->|"stores alerts"| node_database
node_detection_engine -->|"dispatches blocks"| node_blocklist
node_blocklist -->|"updates blocklist"| node_database
node_api_runtime -->|"listens for changes"| node_database
node_api_runtime -->|"dispatches alerts"| node_alerting
node_alerting -->|"sends notifications"| node_channels
node_api_runtime -->|"serves"| node_routes
node_routes -->|"dispatches requests"| node_handlers
node_routes -->|"protects routes"| node_auth
node_handlers -->|"reads and writes"| node_database
node_browser -->|"uses dashboard"| node_app
node_app -->|"requests data"| node_api_client
node_api_client -->|"calls REST API"| node_routes
node_app -->|"starts streams"| node_ws_client
node_ws_client -->|"subscribes to streams"| node_routes
node_app -->|"renders views"| node_pages
node_detection_engine -->|"uses models"| node_shared_models
node_handlers -->|"uses models"| node_shared_models

click node_simulator "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/capture-engine/src/capture/simulator.rs"
click node_capture_src "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/capture-engine/src/capture/live.rs"
click node_engine_main "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/capture-engine/src/main.rs"
click node_detectors "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/tree/main/crates/capture-engine/src/detection"
click node_detection_engine "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/capture-engine/src/detection/engine.rs"
click node_shared_models "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/tree/main/crates/common/src/models"
click node_api_runtime "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/backend/src/main.rs"
click node_routes "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/backend/src/routes.rs"
click node_auth "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/tree/main/crates/backend/src/auth"
click node_handlers "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/tree/main/crates/backend/src/handlers"
click node_alerting "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/tree/main/crates/backend/src/alerting"
click node_channels "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/tree/main/crates/backend/src/alerting"
click node_blocklist "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/capture-engine/src/detection/engine.rs"
click node_app "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/frontend/src/app.rs"
click node_api_client "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/frontend/src/api/client.rs"
click node_ws_client "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/frontend/src/ws/client.rs"
click node_pages "https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/tree/main/crates/frontend/src/pages"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_simulator,node_capture_src,node_engine_main,node_detectors,node_detection_engine,node_browser toneBlue
class node_api_runtime,node_routes,node_auth,node_handlers,node_alerting,node_channels,node_blocklist toneAmber
class node_shared_models,node_database toneMint
class node_app,node_api_client,node_ws_client,node_pages toneRose
class node_network toneIndigo
```

## Components

### Capture and Detection

- [Traffic Simulator](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/capture-engine/src/capture/simulator.rs): `crates/capture-engine/src/capture/simulator.rs`
- [Live Capture](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/capture-engine/src/capture/live.rs): `crates/capture-engine/src/capture/live.rs`
- [Engine Runtime](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/capture-engine/src/main.rs): `crates/capture-engine/src/main.rs`
- [Detection Rules](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/tree/main/crates/capture-engine/src/detection): `crates/capture-engine/src/detection`
- [Detection Engine](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/capture-engine/src/detection/engine.rs): `crates/capture-engine/src/detection/engine.rs`

### API and Alerting

- [Backend Runtime](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/backend/src/main.rs): `crates/backend/src/main.rs`
- [REST and WS Routes](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/backend/src/routes.rs): `crates/backend/src/routes.rs`
- [Authentication and RBAC](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/tree/main/crates/backend/src/auth): `crates/backend/src/auth`
- [API Handlers](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/tree/main/crates/backend/src/handlers): `crates/backend/src/handlers`
- [Alert Dispatcher](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/tree/main/crates/backend/src/alerting): `crates/backend/src/alerting`
- [Notification Channels](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/tree/main/crates/backend/src/alerting): `crates/backend/src/alerting`
- [Auto-Response](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/capture-engine/src/detection/engine.rs): `crates/capture-engine/src/detection/engine.rs`

### Shared Data

- [Domain Models](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/tree/main/crates/common/src/models): `crates/common/src/models`
- **PostgreSQL / TimescaleDB**

### Dashboard

- [Dashboard App](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/frontend/src/app.rs): `crates/frontend/src/app.rs`
- [API Client](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/frontend/src/api/client.rs): `crates/frontend/src/api/client.rs`
- [Live Stream Client](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/blob/main/crates/frontend/src/ws/client.rs): `crates/frontend/src/ws/client.rs`
- [Security Views](https://github.com/nguyenlinhit-cpu/real-time-network-security-analytics-alerting-system/tree/main/crates/frontend/src/pages): `crates/frontend/src/pages`

### Other components

- **Network Interface**
- **Analyst Browser**

## Connections

- Network Interface → Live Capture: supplies frames
- Traffic Simulator → Engine Runtime: provides events
- Live Capture → Engine Runtime: provides events
- Engine Runtime → Detection Engine: processes events
- Detection Engine → Detection Rules: evaluates rules
- Engine Runtime → PostgreSQL / TimescaleDB: persists traffic
- Detection Engine → PostgreSQL / TimescaleDB: stores alerts
- Detection Engine → Auto-Response: dispatches blocks
- Auto-Response → PostgreSQL / TimescaleDB: updates blocklist
- Backend Runtime → PostgreSQL / TimescaleDB: listens for changes
- Backend Runtime → Alert Dispatcher: dispatches alerts
- Alert Dispatcher → Notification Channels: sends notifications
- Backend Runtime → REST and WS Routes: serves
- REST and WS Routes → API Handlers: dispatches requests
- REST and WS Routes → Authentication and RBAC: protects routes
- API Handlers → PostgreSQL / TimescaleDB: reads and writes
- Analyst Browser → Dashboard App: uses dashboard
- Dashboard App → API Client: requests data
- API Client → REST and WS Routes: calls REST API
- Dashboard App → Live Stream Client: starts streams
- Live Stream Client → REST and WS Routes: subscribes to streams
- Dashboard App → Security Views: renders views
- Detection Engine → Domain Models: uses models
- API Handlers → Domain Models: uses models