# nutthakorn7/salad-soc architecture

> Architecture diagram of the GitHub repository nutthakorn7/salad-soc, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-14). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nutthakorn7/salad-soc
- Repository: https://github.com/nutthakorn7/salad-soc

## Overview

SALAD is a published SOC-alert benchmark dataset, not an alert-processing service. Its main user workflow is to load the prepared train/test splits and evaluate models on four tasks: malicious-alert classification, triage, priority scoring, and attack categorization. The README also documents enriched alert labels and a validation split. The sampled evaluation code shows feature preparation and model fitting; dataset creation and enrichment implementation are not present in this repository, so those are represented only as published data capabilities.

Main entry points: [`evaluate.py`](https://github.com/nutthakorn7/salad-soc/blob/main/evaluate.py) (Evaluation CLI), [`salad_train.csv`](https://github.com/nutthakorn7/salad-soc/blob/main/salad_train.csv) (Training Split), [`README.md`](https://github.com/nutthakorn7/salad-soc/blob/main/README.md) (Enriched Alert Schema), [`salad_test.csv`](https://github.com/nutthakorn7/salad-soc/blob/main/salad_test.csv) (Test Split)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_data["Benchmark Data"]
  node_train["Training Split<br/>[salad_train.csv]"]
  node_validation["Validation Split<br/>[salad_val.csv]"]
  node_test["Test Split<br/>[salad_test.csv]"]
  node_schema["Enriched Alert Schema<br/>[README.md]"]
  node_stats["Dataset Statistics<br/>[stats.json]"]
end

subgraph group_evaluation["Model Evaluation"]
  node_evaluator["Evaluation CLI<br/>[evaluate.py]"]
  node_features["Feature Preparation<br/>[evaluate.py]"]
  node_classification["Alert Classification<br/>[evaluate.py]"]
  node_triage["Alert Triage<br/>[evaluate.py]"]
  node_prioritization["Priority Scoring<br/>[evaluate.py]"]
  node_categorization["Attack Categorization<br/>[evaluate.py]"]
end

node_cic(("CIC-IDS2017"))
node_unsw(("UNSW-NB15"))

node_cic -.->|"contributes alerts"| node_train
node_unsw -.->|"contributes alerts"| node_train
node_train -->|"includes fields"| node_schema
node_validation -->|"includes fields"| node_schema
node_test -->|"includes fields"| node_schema
node_evaluator -->|"reads data"| node_train
node_evaluator -->|"reads data"| node_test
node_evaluator -->|"prepares features"| node_features
node_evaluator -.->|"runs task"| node_classification
node_evaluator -.->|"runs task"| node_triage
node_evaluator -.->|"runs task"| node_prioritization
node_evaluator -.->|"runs task"| node_categorization

click node_train "https://github.com/nutthakorn7/salad-soc/blob/main/salad_train.csv"
click node_validation "https://github.com/nutthakorn7/salad-soc/blob/main/salad_val.csv"
click node_test "https://github.com/nutthakorn7/salad-soc/blob/main/salad_test.csv"
click node_schema "https://github.com/nutthakorn7/salad-soc/blob/main/README.md"
click node_stats "https://github.com/nutthakorn7/salad-soc/blob/main/stats.json"
click node_evaluator "https://github.com/nutthakorn7/salad-soc/blob/main/evaluate.py"
click node_features "https://github.com/nutthakorn7/salad-soc/blob/main/evaluate.py"
click node_classification "https://github.com/nutthakorn7/salad-soc/blob/main/evaluate.py"
click node_triage "https://github.com/nutthakorn7/salad-soc/blob/main/evaluate.py"
click node_prioritization "https://github.com/nutthakorn7/salad-soc/blob/main/evaluate.py"
click node_categorization "https://github.com/nutthakorn7/salad-soc/blob/main/evaluate.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_train,node_validation,node_test,node_schema,node_stats toneBlue
class node_evaluator,node_features,node_classification,node_triage,node_prioritization,node_categorization toneAmber
class node_cic,node_unsw toneIndigo
```

## Components

### Benchmark Data

- [Training Split](https://github.com/nutthakorn7/salad-soc/blob/main/salad_train.csv): `salad_train.csv`
- [Validation Split](https://github.com/nutthakorn7/salad-soc/blob/main/salad_val.csv): `salad_val.csv`
- [Test Split](https://github.com/nutthakorn7/salad-soc/blob/main/salad_test.csv): `salad_test.csv`
- [Enriched Alert Schema](https://github.com/nutthakorn7/salad-soc/blob/main/README.md): `README.md`
- [Dataset Statistics](https://github.com/nutthakorn7/salad-soc/blob/main/stats.json): `stats.json`

### Model Evaluation

- [Evaluation CLI](https://github.com/nutthakorn7/salad-soc/blob/main/evaluate.py): `evaluate.py`
- [Feature Preparation](https://github.com/nutthakorn7/salad-soc/blob/main/evaluate.py): `evaluate.py`
- [Alert Classification](https://github.com/nutthakorn7/salad-soc/blob/main/evaluate.py): `evaluate.py`
- [Alert Triage](https://github.com/nutthakorn7/salad-soc/blob/main/evaluate.py): `evaluate.py`
- [Priority Scoring](https://github.com/nutthakorn7/salad-soc/blob/main/evaluate.py): `evaluate.py`
- [Attack Categorization](https://github.com/nutthakorn7/salad-soc/blob/main/evaluate.py): `evaluate.py`

### Other components

- **CIC-IDS2017**
- **UNSW-NB15**

## Connections

- CIC-IDS2017 → Training Split: contributes alerts (evidence: `README.md`)
- UNSW-NB15 → Training Split: contributes alerts (evidence: `README.md`)
- Training Split → Enriched Alert Schema: includes fields (evidence: `README.md`)
- Validation Split → Enriched Alert Schema: includes fields (evidence: `README.md`)
- Test Split → Enriched Alert Schema: includes fields (evidence: `README.md`)
- Evaluation CLI → Training Split: reads data (evidence: `evaluate.py`)
- Evaluation CLI → Test Split: reads data (evidence: `evaluate.py`)
- Evaluation CLI → Feature Preparation: prepares features (evidence: `evaluate.py`)
- Evaluation CLI → Alert Classification: runs task (evidence: `evaluate.py`)
- Evaluation CLI → Alert Triage: runs task (evidence: `evaluate.py`)
- Evaluation CLI → Priority Scoring: runs task (evidence: `evaluate.py`)
- Evaluation CLI → Attack Categorization: runs task (evidence: `evaluate.py`)