# srivastavaayush084/nids architecture

> Architecture diagram of the GitHub repository srivastavaayush084/nids, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/srivastavaayush084/nids
- Repository: https://github.com/srivastavaayush084/nids

## Overview

ZeroDayAI is a network intrusion-detection and SOC platform: operators monitor live traffic or replay PCAPs, inspect flow detections and explanations, and triage alerts through a protected dashboard. The documented detection stages include packet/flow processing, multi-model scoring, risk assessment, XAI, and alerting, with persistence and SOC analytics supporting investigation. The excerpts confirm monitoring orchestration, model loading, alert construction, and frontend routing; several service-to-endpoint and model-to-service connections are inferred only at subsystem level from the documented product capabilities, so those links are omitted where ownership is not established.

Main entry points: [`backend/app/api/v1/api.py`](https://github.com/srivastavaayush084/nids/blob/main/backend/app/api/v1/api.py) (API router), [`backend/app/monitoring/manager.py`](https://github.com/srivastavaayush084/nids/blob/main/backend/app/monitoring/manager.py) (Monitoring manager), [`backend/app/services/detection_service.py`](https://github.com/srivastavaayush084/nids/blob/main/backend/app/services/detection_service.py) (Detection service), [`backend/app/monitoring/pipeline.py`](https://github.com/srivastavaayush084/nids/blob/main/backend/app/monitoring/pipeline.py) (Flow pipeline)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_frontend["SOC dashboard"]
  node_app["Dashboard routes<br/>[App.jsx]"]
  node_pages["SOC pages"]
  node_hooks["Data hooks"]
  node_client["API client<br/>[client.js]"]
end

subgraph group_api["API and identity"]
  node_api_router["API router<br/>[api.py]"]
  node_auth["Authentication<br/>[auth_service.py]"]
  node_monitor_endpoint["Monitoring endpoints<br/>[monitoring.py]"]
  node_detection_endpoint["Detection endpoints<br/>[detection.py]"]
  node_alert_endpoint["Alert endpoints<br/>[alerts.py]"]
end

subgraph group_monitoring["Traffic monitoring"]
  node_live_capture["Live capture<br/>[live_capture.py]"]
  node_pcap["PCAP replay<br/>[pcap_reader.py]"]
  node_manager["Monitoring manager<br/>[manager.py]"]
  node_pipeline["Flow pipeline<br/>[pipeline.py]"]
  node_buffer["Flow buffer<br/>[buffer.py]"]
end

subgraph group_detection["Detection and alerts"]
  node_detection_service["Detection service"]
  node_ensemble["Model ensemble"]
  node_models["Model manager<br/>[model_manager.py]"]
  node_xai["Explainability"]
  node_alert_engine["Alert construction<br/>[engine.py]"]
  node_alert_service["Alert service<br/>[alert_service.py]"]
end

subgraph group_persistence["State and analytics"]
  node_database[("MongoDB repositories<br/>[repository.py]")]
  node_statistics["SOC statistics"]
end

node_operator(("SOC operator"))
node_api_actor(("HTTP API"))
node_mongo[("MongoDB")]

node_operator -->|"uses"| node_app
node_app -->|"routes"| node_pages
node_app -->|"loads SOC data"| node_hooks
node_hooks -->|"requests"| node_client
node_client -->|"HTTP requests"| node_api_actor
node_api_actor -->|"dispatches"| node_api_router
node_api_router -->|"routes"| node_monitor_endpoint
node_api_router -->|"routes"| node_detection_endpoint
node_api_router -->|"routes"| node_alert_endpoint
node_api_router -->|"routes auth"| node_auth
node_monitor_endpoint -->|"controls monitoring"| node_manager
node_manager -->|"starts capture"| node_live_capture
node_manager -->|"replays PCAP"| node_pcap
node_manager -->|"starts pipeline"| node_pipeline
node_live_capture -->|"delivers packets"| node_pipeline
node_pipeline -->|"queues flows"| node_buffer
node_pipeline -->|"submits flows"| node_detection_service
node_manager -->|"analyzes replay flows"| node_detection_service
node_detection_endpoint -->|"requests detection"| node_detection_service
node_detection_service -->|"scores flows"| node_ensemble
node_ensemble -->|"uses loaded models"| node_models
node_detection_service -->|"requests explanations"| node_xai
node_alert_service -->|"builds alerts"| node_alert_engine
node_alert_engine -->|"persists alerts"| node_database
node_alert_endpoint -->|"manages alerts"| node_alert_service
node_database -->|"reads and writes"| node_mongo
node_statistics -->|"queries records"| node_database

click node_app "https://github.com/srivastavaayush084/nids/blob/main/frontend/src/App.jsx"
click node_pages "https://github.com/srivastavaayush084/nids/tree/main/frontend/src/pages"
click node_hooks "https://github.com/srivastavaayush084/nids/tree/main/frontend/src/hooks"
click node_client "https://github.com/srivastavaayush084/nids/blob/main/frontend/src/api/client.js"
click node_api_router "https://github.com/srivastavaayush084/nids/blob/main/backend/app/api/v1/api.py"
click node_auth "https://github.com/srivastavaayush084/nids/blob/main/backend/app/services/auth_service.py"
click node_monitor_endpoint "https://github.com/srivastavaayush084/nids/blob/main/backend/app/api/v1/endpoints/monitoring.py"
click node_detection_endpoint "https://github.com/srivastavaayush084/nids/blob/main/backend/app/api/v1/endpoints/detection.py"
click node_alert_endpoint "https://github.com/srivastavaayush084/nids/blob/main/backend/app/api/v1/endpoints/alerts.py"
click node_live_capture "https://github.com/srivastavaayush084/nids/blob/main/backend/app/monitoring/capture/live_capture.py"
click node_pcap "https://github.com/srivastavaayush084/nids/blob/main/backend/app/monitoring/capture/pcap_reader.py"
click node_manager "https://github.com/srivastavaayush084/nids/blob/main/backend/app/monitoring/manager.py"
click node_pipeline "https://github.com/srivastavaayush084/nids/blob/main/backend/app/monitoring/pipeline.py"
click node_buffer "https://github.com/srivastavaayush084/nids/blob/main/backend/app/monitoring/buffer.py"
click node_detection_service "https://github.com/srivastavaayush084/nids/blob/main/backend/app/services/detection_service.py"
click node_ensemble "https://github.com/srivastavaayush084/nids/blob/main/backend/app/ml/ensemble/ensemble_detector.py"
click node_models "https://github.com/srivastavaayush084/nids/blob/main/backend/app/ml/model_manager.py"
click node_xai "https://github.com/srivastavaayush084/nids/blob/main/backend/app/services/explainer_service.py"
click node_alert_engine "https://github.com/srivastavaayush084/nids/blob/main/backend/app/alerts/engine.py"
click node_alert_service "https://github.com/srivastavaayush084/nids/blob/main/backend/app/services/alert_service.py"
click node_database "https://github.com/srivastavaayush084/nids/blob/main/backend/app/database/repository.py"
click node_statistics "https://github.com/srivastavaayush084/nids/blob/main/backend/app/services/statistics_service.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app,node_pages,node_hooks,node_client toneBlue
class node_api_router,node_auth,node_monitor_endpoint,node_detection_endpoint,node_alert_endpoint,node_mongo toneAmber
class node_live_capture,node_pcap,node_manager,node_pipeline,node_buffer,node_api_actor toneMint
class node_detection_service,node_ensemble,node_models,node_xai,node_alert_engine,node_alert_service toneRose
class node_database,node_statistics,node_operator toneIndigo
```

## Components

### SOC dashboard

- [Dashboard routes](https://github.com/srivastavaayush084/nids/blob/main/frontend/src/App.jsx): `frontend/src/App.jsx`
- [SOC pages](https://github.com/srivastavaayush084/nids/tree/main/frontend/src/pages): `frontend/src/pages`
- [Data hooks](https://github.com/srivastavaayush084/nids/tree/main/frontend/src/hooks): `frontend/src/hooks`
- [API client](https://github.com/srivastavaayush084/nids/blob/main/frontend/src/api/client.js): `frontend/src/api/client.js`

### API and identity

- [API router](https://github.com/srivastavaayush084/nids/blob/main/backend/app/api/v1/api.py): `backend/app/api/v1/api.py`
- [Authentication](https://github.com/srivastavaayush084/nids/blob/main/backend/app/services/auth_service.py): `backend/app/services/auth_service.py`
- [Monitoring endpoints](https://github.com/srivastavaayush084/nids/blob/main/backend/app/api/v1/endpoints/monitoring.py): `backend/app/api/v1/endpoints/monitoring.py`
- [Detection endpoints](https://github.com/srivastavaayush084/nids/blob/main/backend/app/api/v1/endpoints/detection.py): `backend/app/api/v1/endpoints/detection.py`
- [Alert endpoints](https://github.com/srivastavaayush084/nids/blob/main/backend/app/api/v1/endpoints/alerts.py): `backend/app/api/v1/endpoints/alerts.py`

### Traffic monitoring

- [Live capture](https://github.com/srivastavaayush084/nids/blob/main/backend/app/monitoring/capture/live_capture.py): `backend/app/monitoring/capture/live_capture.py`
- [PCAP replay](https://github.com/srivastavaayush084/nids/blob/main/backend/app/monitoring/capture/pcap_reader.py): `backend/app/monitoring/capture/pcap_reader.py`
- [Monitoring manager](https://github.com/srivastavaayush084/nids/blob/main/backend/app/monitoring/manager.py): `backend/app/monitoring/manager.py`
- [Flow pipeline](https://github.com/srivastavaayush084/nids/blob/main/backend/app/monitoring/pipeline.py): `backend/app/monitoring/pipeline.py`
- [Flow buffer](https://github.com/srivastavaayush084/nids/blob/main/backend/app/monitoring/buffer.py): `backend/app/monitoring/buffer.py`

### Detection and alerts

- [Detection service](https://github.com/srivastavaayush084/nids/blob/main/backend/app/services/detection_service.py): `backend/app/services/detection_service.py`
- [Model ensemble](https://github.com/srivastavaayush084/nids/blob/main/backend/app/ml/ensemble/ensemble_detector.py): `backend/app/ml/ensemble/ensemble_detector.py`
- [Model manager](https://github.com/srivastavaayush084/nids/blob/main/backend/app/ml/model_manager.py): `backend/app/ml/model_manager.py`
- [Explainability](https://github.com/srivastavaayush084/nids/blob/main/backend/app/services/explainer_service.py): `backend/app/services/explainer_service.py`
- [Alert construction](https://github.com/srivastavaayush084/nids/blob/main/backend/app/alerts/engine.py): `backend/app/alerts/engine.py`
- [Alert service](https://github.com/srivastavaayush084/nids/blob/main/backend/app/services/alert_service.py): `backend/app/services/alert_service.py`

### State and analytics

- [MongoDB repositories](https://github.com/srivastavaayush084/nids/blob/main/backend/app/database/repository.py): `backend/app/database/repository.py`
- [SOC statistics](https://github.com/srivastavaayush084/nids/blob/main/backend/app/services/statistics_service.py): `backend/app/services/statistics_service.py`

### Other components

- **SOC operator**
- **HTTP API**
- **MongoDB**

## Connections

- SOC operator → Dashboard routes: uses
- Dashboard routes → SOC pages: routes
- Dashboard routes → Data hooks: loads SOC data
- Data hooks → API client: requests
- API client → HTTP API: HTTP requests
- HTTP API → API router: dispatches
- API router → Monitoring endpoints: routes
- API router → Detection endpoints: routes
- API router → Alert endpoints: routes
- API router → Authentication: routes auth
- Monitoring endpoints → Monitoring manager: controls monitoring
- Monitoring manager → Live capture: starts capture
- Monitoring manager → PCAP replay: replays PCAP
- Monitoring manager → Flow pipeline: starts pipeline
- Live capture → Flow pipeline: delivers packets
- Flow pipeline → Flow buffer: queues flows
- Flow pipeline → Detection service: submits flows
- Monitoring manager → Detection service: analyzes replay flows
- Detection endpoints → Detection service: requests detection
- Detection service → Model ensemble: scores flows
- Model ensemble → Model manager: uses loaded models
- Detection service → Explainability: requests explanations
- Alert service → Alert construction: builds alerts
- Alert construction → MongoDB repositories: persists alerts
- Alert endpoints → Alert service: manages alerts
- MongoDB repositories → MongoDB: reads and writes
- SOC statistics → MongoDB repositories: queries records