How srivastavaayush084/nids works
ZeroDayAI is a network intrusion-detection and SOC platform: operators monitor live traffic or replay PCAPs, inspect flow detections and explanations, and triage alerts through a protected dashboard. The documented detection stages include packet/flow processing, multi-model scoring, risk assessment, XAI, and alerting, with persistence and SOC analytics supporting investigation. The excerpts confirm monitoring orchestration, model loading, alert construction, and frontend routing; several service-to-endpoint and model-to-service connections are inferred only at subsystem level from the documented product capabilities, so those links are omitted where ownership is not established.
Main entry points: api.py API router · manager.py Monitoring manager · detection_service.py Detection service · pipeline.py Flow pipeline
Components 25
SOC dashboard
- Dashboard routes
frontend/src/App.jsx - SOC pages
frontend/src/pages - Data hooks
frontend/src/hooks - API client
frontend/src/api/client.js
API and identity
- API router
backend/app/api/v1/api.py - Authentication
backend/app/services/auth_service.py - Monitoring endpoints
backend/app/api/v1/endpoints/monitoring.py - Detection endpoints
backend/app/api/v1/endpoints/detection.py - Alert endpoints
backend/app/api/v1/endpoints/alerts.py
Traffic monitoring
- Live capture
backend/app/monitoring/capture/live_capture.py - PCAP replay
backend/app/monitoring/capture/pcap_reader.py - Monitoring manager
backend/app/monitoring/manager.py - Flow pipeline
backend/app/monitoring/pipeline.py - Flow buffer
backend/app/monitoring/buffer.py
Detection and alerts
- Detection service
backend/app/services/detection_service.py - Model ensemble
backend/app/ml/ensemble/ensemble_detector.py - Model manager
backend/app/ml/model_manager.py - Explainability
backend/app/services/explainer_service.py - Alert construction
backend/app/alerts/engine.py - Alert service
backend/app/services/alert_service.py
State and analytics
- MongoDB repositories
backend/app/database/repository.py - SOC statistics
backend/app/services/statistics_service.py
Other components
- SOC operator
- HTTP API
- MongoDB
Connections 27
- SOC operator → Dashboard routes: uses
- Dashboard routes → SOC pages: routes
- Dashboard routes → Data hooks: loads SOC data
- Data hooks → API client: requests
- API client → HTTP API: HTTP requests
- HTTP API → API router: dispatches
- API router → Monitoring endpoints: routes
- API router → Detection endpoints: routes
- API router → Alert endpoints: routes
- API router → Authentication: routes auth
- Monitoring endpoints → Monitoring manager: controls monitoring
- Monitoring manager → Live capture: starts capture
- Monitoring manager → PCAP replay: replays PCAP
- Monitoring manager → Flow pipeline: starts pipeline
- Live capture → Flow pipeline: delivers packets
- Flow pipeline → Flow buffer: queues flows
- Flow pipeline → Detection service: submits flows
- Monitoring manager → Detection service: analyzes replay flows
- Detection endpoints → Detection service: requests detection
- Detection service → Model ensemble: scores flows
- Model ensemble → Model manager: uses loaded models
- Detection service → Explainability: requests explanations
- Alert service → Alert construction: builds alerts
- Alert construction → MongoDB repositories: persists alerts
- Alert endpoints → Alert service: manages alerts
- MongoDB repositories → MongoDB: reads and writes
- SOC statistics → MongoDB repositories: queries records