How saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection- works
CampusShield AI is a SOC platform for detecting and triaging threats from passive, one-way IP telemetry. Analysts submit traffic for analysis or inspect a URL, then review detections, alerts, and reports in the web interface. The documented detection stages include feature extraction, normalization, anomaly detection, categorization, scoring, and mitigation guidance. The graph reflects the ingestion-route orchestration visible in the excerpt; some documented capabilities, including live threat-intelligence checks, have unsampled wiring, so their connections are omitted.
Main entry points: routes.py Ingestion Routes · App.jsx Web App · crud.py Data Access · manager.py Alert Manager
Components 29
Analyst Interface
- Web App
frontend/src/App.jsx - Dashboard
frontend/src/pages/Dashboard.jsx - URL Inspector
frontend/src/pages/UrlInspector.jsx - Replay Demo
frontend/src/pages/ReplayDemo.jsx - Reports View
frontend/src/pages/Reports.jsx - API Client
frontend/src/services/api.js
API and Ingestion
- API Server
backend/main.py - API Router
backend/api/router.py - Ingestion Routes
backend/ingestion/routes.py - PCAP Parser
backend/ingestion/pcap_parser.py - Live Collector
backend/ingestion/live_collector.py
Threat Analysis
- Feature Extraction
backend/features/extractor.py - Normalization
backend/features/normalizer.py - Anomaly Detection
backend/detection/isolation_forest.py - Threat Categorization
backend/classification/categorizer.py - Threat Scoring
backend/scoring/scorer.py - Detection Explanation
backend/scoring/explainer.py - Mitigation Playbooks
backend/scoring/mitigation.py - Threat Intelligence
backend/threat_intel/threat_intel_service.py
SOC Operations
- Alert Routes
backend/alerts/routes.py - Alert Manager
backend/alerts/manager.py - Alert WebSocket
backend/alerts/websocket.py - Report Routes
backend/reports/routes.py - PDF Generator
backend/reports/generator.py
Persistence
- Data Access
backend/database/crud.py - Application Database
backend/database/models.py
Other components
- Analyst
- AbuseIPDB
- VirusTotal
Connections 29
- Analyst → Web App: uses
- Web App → Dashboard: routes to
- Web App → URL Inspector: routes to
- Web App → Replay Demo: routes to
- Web App → Reports View: routes to
- Web App → API Client: uses
- API Server → API Router: mounts
- API Server → Alert WebSocket: serves
- API Router → Ingestion Routes: dispatches
- Analyst → Ingestion Routes: submits traffic
- Ingestion Routes → PCAP Parser: parses PCAP
- Ingestion Routes → Live Collector: records events
- Ingestion Routes → Feature Extraction: extracts features
- Ingestion Routes → Normalization: normalizes features
- Ingestion Routes → Anomaly Detection: detects anomalies
- Ingestion Routes → Threat Categorization: categorizes threats
- Ingestion Routes → Threat Scoring: scores threats
- Ingestion Routes → Detection Explanation: explains detections
- Ingestion Routes → Data Access: stores results
- Ingestion Routes → Alert Manager: creates alerts
- Alert Manager → Data Access: stores alerts
- Alert Manager → Alert WebSocket: broadcasts alerts
- Alert Routes → Data Access: reads and updates
- Report Routes → Data Access: reads session data
- Report Routes → PDF Generator: generates report
- Data Access → Application Database: reads and writes
- URL Inspector → API Client: requests checks
- Threat Intelligence → AbuseIPDB: queries
- Threat Intelligence → VirusTotal: queries