How sarseej-shrestha/packetsentry works
PacketSentry is an offline educational experiment comparing supervised attack classification with unsupervised anomaly detection on fictional traffic. A user runs the CLI, which invokes the lab workflow; the workflow generates data, evaluates models, and writes results and a report. The workflow excerpt is incomplete, so the documented calibration, clustering, feature-importance, and visualization capabilities are represented without assuming unshown implementation details.
Main entry points: workflow.py Lab workflow · main.py CLI runner · data.py Traffic generator · synthetic_traffic.csv Synthetic traffic
Components 15
Experiment entry
- CLI runner
main.py - Lab workflow
packetsentry/workflow.py
Synthetic data
- Traffic generator
packetsentry/data.py - Synthetic traffic
outputs/synthetic_traffic.csv
Model analysis
- Train/test split
packetsentry/workflow.py - Attack classification
packetsentry/workflow.py - Tuning and calibration
packetsentry/workflow.py - Anomaly detection
packetsentry/workflow.py - Traffic clustering
packetsentry/workflow.py - PCA projection
packetsentry/workflow.py - Feature importance
packetsentry/workflow.py
Results
- Evaluation metrics
packetsentry/workflow.py - Experiment outputs
outputs - Results report
outputs/report.md
Other components
- User
Connections 17
- User → CLI runner: runs
- CLI runner → Lab workflow: invokes
- Lab workflow → Traffic generator: generates
- Traffic generator → Lab workflow: returns data
- Lab workflow → Synthetic traffic: writes
- Lab workflow → Train/test split: splits data
- Lab workflow → Attack classification: fits and evaluates
- Lab workflow → Tuning and calibration: tunes and calibrates
- Lab workflow → Anomaly detection: fits and evaluates
- Lab workflow → Traffic clustering: clusters training data
- Lab workflow → PCA projection: projects test data
- Lab workflow → Feature importance: measures importance
- Lab workflow → Evaluation metrics: computes
- Lab workflow → Experiment outputs: writes results
- Lab workflow → Results report: writes report
- Attack classification → Evaluation metrics: evaluates predictions
- Anomaly detection → Evaluation metrics: evaluates flags