How rajal-ui/froststream-nids works
FrostStream NIDS ingests packets or existing flow records, aggregates them into NSL-KDD-compatible features, and routes flows through distinct LOCAL or CLOUD paths. Local scoring uses trained artifacts and stores alerts in SQLite; cloud flows pass through Firehose and Snowflake ingestion before Snowpark inference, drift monitoring, and alerting. Qualifying cloud alerts may trigger optional AWS NACL mitigation. The dashboard reports cloud or local operational data. Cloud stages and major capabilities follow the README; some implementation wiring is documented rather than visible in the sampled source.
Main entry points: execution_mode.py Mode and sinks · 01_tables.sql Flow features · inference.py Inference and scoring · flow_processor.py Flow aggregation
Components 22
Flow ingestion
- Flow aggregation
ingestion/flow_processor.py - Mode and sinks
src/common/execution_mode.py - Firehose
Local detection
- Ensemble training
src/models/train.py - NSL-KDD data
data/dataset_loader.py - Model artifacts
src/models/constants.py - Local alert store
storage/alert_logger.py - Local inference
src/models/inference.py
Cloud detection
- S3 flow landing
- Snowpipe loading
snowflake_setup/02_snowpipe.sql - Raw flow landing
snowflake_setup/01_tables.sql - Feature flattening
snowflake_setup/03_snowpark_integration.sql - Flow features
snowflake_setup/01_tables.sql - Inference and scoring
src/models/inference.py - Drift monitoring
src/models/drift_monitor.py - NIDS alerts
snowflake_setup/01_tables.sql
Operations and response
- SOC dashboard
streamlit_app/sis_dashboard.py - SOAR dispatch
snowflake_setup/03_snowpark_integration.sql - NACL mitigation
src/soar/mitigator.py - Rule cleanup
src/soar/cleanup.py
Other components
- Packets or flows
- AWS Network ACL
Connections 23
- Packets or flows → Flow aggregation: provides packets
- Flow aggregation → Mode and sinks: routes flows
- Mode and sinks → Firehose: sends cloud flows
- Mode and sinks → Local inference: scores local flows
- Mode and sinks → Local alert store: writes local alerts
- Firehose → S3 flow landing: delivers flows
- S3 flow landing → Snowpipe loading: loads files
- Snowpipe loading → Raw flow landing: writes rows
- Raw flow landing → Feature flattening: reads rows
- Feature flattening → Flow features: writes features
- NSL-KDD data → Ensemble training: supplies training data
- Ensemble training → Model artifacts: saves models
- Flow features → Inference and scoring: scores pending flows
- Model artifacts → Inference and scoring: loads models
- Inference and scoring → NIDS alerts: writes alerts
- Inference and scoring → Flow features: marks processed
- Flow features → Drift monitoring: monitors features
- NIDS alerts → SOC dashboard: queries status
- Local alert store → SOC dashboard: local fallback
- NIDS alerts → SOAR dispatch: selects qualifying alerts
- SOAR dispatch → NACL mitigation: invokes mitigation
- NACL mitigation → AWS Network ACL: creates deny rule
- AWS Network ACL → Rule cleanup: expires rules