# safa-prog-hub/agentshield1 architecture

> Architecture diagram of the GitHub repository safa-prog-hub/agentshield1, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/safa-prog-hub/agentshield1
- Repository: https://github.com/safa-prog-hub/agentshield1

## Overview

AgentShield is a Zeek-based network threat detection application. Its live workflow tails Zeek connection logs, normalizes and stores events, then runs model-based and port-scan detection; a parallel SSH-log path identifies brute-force activity. A separate training workflow cleans and balances CIC-IDS2017 CSV data, trains and evaluates a Random Forest, and saves the model used by live inference. The README is empty, and the map relies on the supplied source excerpts; some listed modules were not sampled, so their wiring is omitted.

Main entry points: [`src/live_detector.py`](https://github.com/safa-prog-hub/agentshield1/blob/main/src/live_detector.py) (Live orchestrator), [`src/collector_zeek.py`](https://github.com/safa-prog-hub/agentshield1/blob/main/src/collector_zeek.py) (Zeek collector), [`src/detector.py`](https://github.com/safa-prog-hub/agentshield1/blob/main/src/detector.py) (Model loader), [`src/train_model.py`](https://github.com/safa-prog-hub/agentshield1/blob/main/src/train_model.py) (Training pipeline)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_collection["Event collection"]
  node_collector["Zeek collector<br/>[collector_zeek.py]"]
  node_normalizer["Event normalizer<br/>[normalizer.py]"]
  node_eventstream["Normalized event stream"]
end

subgraph group_detection["Live detection"]
  node_live["Live orchestrator<br/>[live_detector.py]"]
  node_model_loader["Model loader<br/>[detector.py]"]
  node_adapter["Feature adapter"]
  node_rfmodel["Random Forest"]
  node_port_scan["Port scan detector"]
  node_results["Detection results"]
end

subgraph group_ssh["SSH detection"]
  node_ssh_parser["SSH log parser<br/>[ssh_log_parser.py]"]
  node_ssh_detector["Brute-force detector"]
end

subgraph group_training["Model training"]
  node_training["Training pipeline<br/>[train_model.py]"]
  node_modelartifact["Trained model artifact"]
end

node_zeek["Zeek logs"]
node_sshlog["Zeek SSH log"]
node_csvdata["Training CSV data"]

node_zeek -->|"provides conn logs"| node_collector
node_collector -->|"normalizes"| node_normalizer
node_collector -->|"writes events"| node_eventstream
node_eventstream -->|"tails events"| node_live
node_live -->|"loads model"| node_model_loader
node_model_loader -->|"loads artifact"| node_rfmodel
node_live -->|"builds features via"| node_adapter
node_live -->|"checks scan behavior"| node_port_scan
node_live -->|"writes results"| node_results
node_sshlog -->|"tails SSH events"| node_live
node_live -->|"parses SSH lines"| node_ssh_parser
node_live -->|"checks brute force"| node_ssh_detector
node_live -->|"writes SSH alerts"| node_results
node_csvdata -->|"loads CSVs"| node_training
node_training -->|"saves trained model"| node_modelartifact

click node_collector "https://github.com/safa-prog-hub/agentshield1/blob/main/src/collector_zeek.py"
click node_normalizer "https://github.com/safa-prog-hub/agentshield1/blob/main/src/normalizer.py"
click node_live "https://github.com/safa-prog-hub/agentshield1/blob/main/src/live_detector.py"
click node_model_loader "https://github.com/safa-prog-hub/agentshield1/blob/main/src/detector.py"
click node_adapter "https://github.com/safa-prog-hub/agentshield1/blob/main/src/live_feature_adapter.py"
click node_rfmodel "https://github.com/safa-prog-hub/agentshield1/tree/main/models"
click node_port_scan "https://github.com/safa-prog-hub/agentshield1/blob/main/src/behavior_detector.py"
click node_ssh_parser "https://github.com/safa-prog-hub/agentshield1/blob/main/src/ssh_log_parser.py"
click node_ssh_detector "https://github.com/safa-prog-hub/agentshield1/blob/main/src/ssh_bruteforce_detector.py"
click node_training "https://github.com/safa-prog-hub/agentshield1/blob/main/src/train_model.py"
click node_modelartifact "https://github.com/safa-prog-hub/agentshield1/tree/main/models"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_collector,node_normalizer,node_eventstream toneBlue
class node_live,node_model_loader,node_adapter,node_rfmodel,node_port_scan,node_results toneAmber
class node_ssh_parser,node_ssh_detector toneMint
class node_training,node_modelartifact toneRose
class node_zeek,node_sshlog,node_csvdata toneIndigo
```

## Components

### Event collection

- [Zeek collector](https://github.com/safa-prog-hub/agentshield1/blob/main/src/collector_zeek.py): `src/collector_zeek.py`
- [Event normalizer](https://github.com/safa-prog-hub/agentshield1/blob/main/src/normalizer.py): `src/normalizer.py`
- **Normalized event stream**

### Live detection

- [Live orchestrator](https://github.com/safa-prog-hub/agentshield1/blob/main/src/live_detector.py): `src/live_detector.py`
- [Model loader](https://github.com/safa-prog-hub/agentshield1/blob/main/src/detector.py): `src/detector.py`
- [Feature adapter](https://github.com/safa-prog-hub/agentshield1/blob/main/src/live_feature_adapter.py): `src/live_feature_adapter.py`
- [Random Forest](https://github.com/safa-prog-hub/agentshield1/tree/main/models): `models`
- [Port scan detector](https://github.com/safa-prog-hub/agentshield1/blob/main/src/behavior_detector.py): `src/behavior_detector.py`
- **Detection results**

### SSH detection

- [SSH log parser](https://github.com/safa-prog-hub/agentshield1/blob/main/src/ssh_log_parser.py): `src/ssh_log_parser.py`
- [Brute-force detector](https://github.com/safa-prog-hub/agentshield1/blob/main/src/ssh_bruteforce_detector.py): `src/ssh_bruteforce_detector.py`

### Model training

- [Training pipeline](https://github.com/safa-prog-hub/agentshield1/blob/main/src/train_model.py): `src/train_model.py`
- [Trained model artifact](https://github.com/safa-prog-hub/agentshield1/tree/main/models): `models`

### Other components

- **Zeek logs**
- **Zeek SSH log**
- **Training CSV data**

## Connections

- Zeek logs → Zeek collector: provides conn logs
- Zeek collector → Event normalizer: normalizes
- Zeek collector → Normalized event stream: writes events
- Normalized event stream → Live orchestrator: tails events
- Live orchestrator → Model loader: loads model
- Model loader → Random Forest: loads artifact
- Live orchestrator → Feature adapter: builds features via
- Live orchestrator → Port scan detector: checks scan behavior
- Live orchestrator → Detection results: writes results
- Zeek SSH log → Live orchestrator: tails SSH events
- Live orchestrator → SSH log parser: parses SSH lines
- Live orchestrator → Brute-force detector: checks brute force
- Live orchestrator → Detection results: writes SSH alerts
- Training CSV data → Training pipeline: loads CSVs
- Training pipeline → Trained model artifact: saves trained model