# saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection- architecture

> Architecture diagram of the GitHub repository saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-
- Repository: https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-

## Overview

CampusShield AI is a SOC platform for detecting and triaging threats from passive, one-way IP telemetry. Analysts submit traffic for analysis or inspect a URL, then review detections, alerts, and reports in the web interface. The documented detection stages include feature extraction, normalization, anomaly detection, categorization, scoring, and mitigation guidance. The graph reflects the ingestion-route orchestration visible in the excerpt; some documented capabilities, including live threat-intelligence checks, have unsampled wiring, so their connections are omitted.

Main entry points: [`backend/ingestion/routes.py`](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/ingestion/routes.py) (Ingestion Routes), [`frontend/src/App.jsx`](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/frontend/src/App.jsx) (Web App), [`backend/database/crud.py`](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/database/crud.py) (Data Access), [`backend/alerts/manager.py`](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/alerts/manager.py) (Alert Manager)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ui["Analyst Interface"]
  node_app["Web App<br/>[App.jsx]"]
  node_dashboard["Dashboard<br/>[Dashboard.jsx]"]
  node_inspect["URL Inspector<br/>[UrlInspector.jsx]"]
  node_replay["Replay Demo<br/>[ReplayDemo.jsx]"]
  node_reports_ui["Reports View<br/>[Reports.jsx]"]
  node_api_client["API Client<br/>[api.js]"]
end

subgraph group_api["API and Ingestion"]
  node_main["API Server<br/>[main.py]"]
  node_router["API Router<br/>[router.py]"]
  node_ingest_routes["Ingestion Routes<br/>[routes.py]"]
  node_pcap["PCAP Parser<br/>[pcap_parser.py]"]
  node_live["Live Collector<br/>[live_collector.py]"]
end

subgraph group_analysis["Threat Analysis"]
  node_features["Feature Extraction<br/>[extractor.py]"]
  node_normalizer["Normalization<br/>[normalizer.py]"]
  node_detector["Anomaly Detection"]
  node_categorizer["Threat Categorization<br/>[categorizer.py]"]
  node_scorer["Threat Scoring<br/>[scorer.py]"]
  node_explainer["Detection Explanation<br/>[explainer.py]"]
  node_mitigation["Mitigation Playbooks<br/>[mitigation.py]"]
  node_intel["Threat Intelligence"]
end

subgraph group_operations["SOC Operations"]
  node_alerts["Alert Routes<br/>[routes.py]"]
  node_alert_manager["Alert Manager<br/>[manager.py]"]
  node_websocket["Alert WebSocket<br/>[websocket.py]"]
  node_report_routes["Report Routes<br/>[routes.py]"]
  node_report_gen["PDF Generator<br/>[generator.py]"]
end

subgraph group_state["Persistence"]
  node_crud["Data Access<br/>[crud.py]"]
  node_database[("Application Database<br/>[models.py]")]
end

node_analyst(("Analyst"))
node_abuseipdb["AbuseIPDB"]
node_virustotal["VirusTotal"]

node_analyst -->|"uses"| node_app
node_app -->|"routes to"| node_dashboard
node_app -->|"routes to"| node_inspect
node_app -->|"routes to"| node_replay
node_app -->|"routes to"| node_reports_ui
node_app -->|"uses"| node_api_client
node_main -->|"mounts"| node_router
node_main -->|"serves"| node_websocket
node_router -->|"dispatches"| node_ingest_routes
node_analyst -->|"submits traffic"| node_ingest_routes
node_ingest_routes -->|"parses PCAP"| node_pcap
node_ingest_routes -->|"records events"| node_live
node_ingest_routes -->|"extracts features"| node_features
node_ingest_routes -->|"normalizes features"| node_normalizer
node_ingest_routes -->|"detects anomalies"| node_detector
node_ingest_routes -->|"categorizes threats"| node_categorizer
node_ingest_routes -->|"scores threats"| node_scorer
node_ingest_routes -->|"explains detections"| node_explainer
node_ingest_routes -->|"stores results"| node_crud
node_ingest_routes -->|"creates alerts"| node_alert_manager
node_alert_manager -->|"stores alerts"| node_crud
node_alert_manager -->|"broadcasts alerts"| node_websocket
node_alerts -->|"reads and updates"| node_crud
node_report_routes -->|"reads session data"| node_crud
node_report_routes -->|"generates report"| node_report_gen
node_crud -->|"reads and writes"| node_database
node_inspect -.->|"requests checks"| node_api_client
node_intel -.->|"queries"| node_abuseipdb
node_intel -.->|"queries"| node_virustotal

click node_app "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/frontend/src/App.jsx"
click node_dashboard "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/frontend/src/pages/Dashboard.jsx"
click node_inspect "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/frontend/src/pages/UrlInspector.jsx"
click node_replay "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/frontend/src/pages/ReplayDemo.jsx"
click node_reports_ui "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/frontend/src/pages/Reports.jsx"
click node_api_client "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/frontend/src/services/api.js"
click node_main "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/main.py"
click node_router "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/api/router.py"
click node_ingest_routes "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/ingestion/routes.py"
click node_pcap "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/ingestion/pcap_parser.py"
click node_live "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/ingestion/live_collector.py"
click node_features "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/features/extractor.py"
click node_normalizer "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/features/normalizer.py"
click node_detector "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/detection/isolation_forest.py"
click node_categorizer "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/classification/categorizer.py"
click node_scorer "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/scoring/scorer.py"
click node_explainer "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/scoring/explainer.py"
click node_mitigation "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/scoring/mitigation.py"
click node_intel "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/threat_intel/threat_intel_service.py"
click node_alerts "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/alerts/routes.py"
click node_alert_manager "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/alerts/manager.py"
click node_websocket "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/alerts/websocket.py"
click node_report_routes "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/reports/routes.py"
click node_report_gen "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/reports/generator.py"
click node_crud "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/database/crud.py"
click node_database "https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/database/models.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app,node_dashboard,node_inspect,node_replay,node_reports_ui,node_api_client toneBlue
class node_main,node_router,node_ingest_routes,node_pcap,node_live toneAmber
class node_features,node_normalizer,node_detector,node_categorizer,node_scorer,node_explainer,node_mitigation,node_intel toneMint
class node_alerts,node_alert_manager,node_websocket,node_report_routes,node_report_gen toneRose
class node_crud,node_database,node_analyst,node_abuseipdb,node_virustotal toneIndigo
```

## Components

### Analyst Interface

- [Web App](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/frontend/src/App.jsx): `frontend/src/App.jsx`
- [Dashboard](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/frontend/src/pages/Dashboard.jsx): `frontend/src/pages/Dashboard.jsx`
- [URL Inspector](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/frontend/src/pages/UrlInspector.jsx): `frontend/src/pages/UrlInspector.jsx`
- [Replay Demo](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/frontend/src/pages/ReplayDemo.jsx): `frontend/src/pages/ReplayDemo.jsx`
- [Reports View](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/frontend/src/pages/Reports.jsx): `frontend/src/pages/Reports.jsx`
- [API Client](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/frontend/src/services/api.js): `frontend/src/services/api.js`

### API and Ingestion

- [API Server](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/main.py): `backend/main.py`
- [API Router](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/api/router.py): `backend/api/router.py`
- [Ingestion Routes](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/ingestion/routes.py): `backend/ingestion/routes.py`
- [PCAP Parser](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/ingestion/pcap_parser.py): `backend/ingestion/pcap_parser.py`
- [Live Collector](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/ingestion/live_collector.py): `backend/ingestion/live_collector.py`

### Threat Analysis

- [Feature Extraction](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/features/extractor.py): `backend/features/extractor.py`
- [Normalization](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/features/normalizer.py): `backend/features/normalizer.py`
- [Anomaly Detection](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/detection/isolation_forest.py): `backend/detection/isolation_forest.py`
- [Threat Categorization](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/classification/categorizer.py): `backend/classification/categorizer.py`
- [Threat Scoring](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/scoring/scorer.py): `backend/scoring/scorer.py`
- [Detection Explanation](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/scoring/explainer.py): `backend/scoring/explainer.py`
- [Mitigation Playbooks](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/scoring/mitigation.py): `backend/scoring/mitigation.py`
- [Threat Intelligence](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/threat_intel/threat_intel_service.py): `backend/threat_intel/threat_intel_service.py`

### SOC Operations

- [Alert Routes](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/alerts/routes.py): `backend/alerts/routes.py`
- [Alert Manager](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/alerts/manager.py): `backend/alerts/manager.py`
- [Alert WebSocket](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/alerts/websocket.py): `backend/alerts/websocket.py`
- [Report Routes](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/reports/routes.py): `backend/reports/routes.py`
- [PDF Generator](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/reports/generator.py): `backend/reports/generator.py`

### Persistence

- [Data Access](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/database/crud.py): `backend/database/crud.py`
- [Application Database](https://github.com/saivatsal/ai-based-detection-of-cyber-threats-in-unidirectional-ip-traffic-detection-/blob/main/backend/database/models.py): `backend/database/models.py`

### Other components

- **Analyst**
- **AbuseIPDB**
- **VirusTotal**

## Connections

- Analyst → Web App: uses
- Web App → Dashboard: routes to
- Web App → URL Inspector: routes to
- Web App → Replay Demo: routes to
- Web App → Reports View: routes to
- Web App → API Client: uses
- API Server → API Router: mounts
- API Server → Alert WebSocket: serves
- API Router → Ingestion Routes: dispatches
- Analyst → Ingestion Routes: submits traffic
- Ingestion Routes → PCAP Parser: parses PCAP
- Ingestion Routes → Live Collector: records events
- Ingestion Routes → Feature Extraction: extracts features
- Ingestion Routes → Normalization: normalizes features
- Ingestion Routes → Anomaly Detection: detects anomalies
- Ingestion Routes → Threat Categorization: categorizes threats
- Ingestion Routes → Threat Scoring: scores threats
- Ingestion Routes → Detection Explanation: explains detections
- Ingestion Routes → Data Access: stores results
- Ingestion Routes → Alert Manager: creates alerts
- Alert Manager → Data Access: stores alerts
- Alert Manager → Alert WebSocket: broadcasts alerts
- Alert Routes → Data Access: reads and updates
- Report Routes → Data Access: reads session data
- Report Routes → PDF Generator: generates report
- Data Access → Application Database: reads and writes
- URL Inspector → API Client: requests checks
- Threat Intelligence → AbuseIPDB: queries
- Threat Intelligence → VirusTotal: queries