# sundeep-codes/major_project architecture

> Architecture diagram of the GitHub repository sundeep-codes/major_project, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/sundeep-codes/major_project
- Repository: https://github.com/sundeep-codes/major_project

## Overview

ForensicGuard is a Windows endpoint forensics and security-monitoring application. Its main workflow starts endpoint monitors, records activity for later investigation, then supports risk assessment and ML-based suspicious-behavior detection; users can inspect collected events through the GUI. README capabilities are included even where their implementation was not sampled. The sampled `main.py` starts monitor threads but does not start the event worker, so no queue-to-storage path is asserted; GUI data access and some monitor wiring are documented rather than verified in source excerpts.

Main entry points: [`main.py`](https://github.com/sundeep-codes/major_project/blob/keerthan/main.py) (Monitor Launcher), [`utils/logger.py`](https://github.com/sundeep-codes/major_project/blob/keerthan/utils/logger.py) (Event Logger), [`database/database.py`](https://github.com/sundeep-codes/major_project/blob/keerthan/database/database.py) (Forensic SQLite), [`gui/app.py`](https://github.com/sundeep-codes/major_project/blob/keerthan/gui/app.py) (GUI Application)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_collection["Endpoint Collection"]
  node_main["Monitor Launcher<br/>[main.py]"]
  node_process["Process Monitor<br/>[process_monitor.py]"]
  node_window["Active Window Monitor<br/>[active_window.py]"]
  node_files["File Monitor<br/>[file_monitor.py]"]
  node_transfer["File Transfer Monitor"]
  node_usb["USB Monitor<br/>[usb_monitor.py]"]
  node_security["Security Monitor"]
  node_eventlog["Event Logger<br/>[logger.py]"]
end

subgraph group_analysis["Forensic Analysis"]
  node_features["Feature Aggregator"]
  node_ml["ML Detector<br/>[ml_detector.py]"]
  node_model["Random Forest Model"]
  node_processdet["Process Detector"]
  node_risk["Risk Engine<br/>[risk_engine.py]"]
end

subgraph group_storage["Evidence Storage"]
  node_db[("Forensic SQLite<br/>[database.py]")]
end

subgraph group_experience["User Interface"]
  node_guiapp["GUI Application<br/>[app.py]"]
  node_controller["Monitor Controller<br/>[controller.py]"]
  node_windowui["Main Window<br/>[main_window.py]"]
  node_dashboard["Activity Dashboard<br/>[dashboard.py]"]
  node_csv["CSV Export"]
end

node_user(("Endpoint User"))
node_windows(("Windows Endpoint"))

node_user -->|"opens dashboard"| node_guiapp
node_windows -->|"process activity"| node_process
node_windows -->|"window changes"| node_window
node_windows -->|"file activity"| node_files
node_windows -->|"copy activity"| node_transfer
node_windows -->|"device events"| node_usb
node_windows -->|"security events"| node_security
node_user -->|"starts monitoring"| node_main
node_main -->|"starts thread"| node_process
node_main -->|"starts thread"| node_window
node_main -->|"starts thread"| node_files
node_main -->|"starts thread"| node_transfer
node_main -->|"starts thread"| node_usb
node_main -->|"starts thread"| node_security
node_main -->|"initializes"| node_db
node_process -->|"records events"| node_eventlog
node_window -->|"records events"| node_eventlog
node_files -->|"records events"| node_eventlog
node_transfer -->|"records events"| node_eventlog
node_usb -->|"records events"| node_eventlog
node_security -->|"records events"| node_eventlog
node_eventlog -->|"writes events"| node_db
node_features -->|"reads events"| node_db
node_ml -->|"gets features"| node_features
node_ml -->|"classifies with"| node_model
node_risk -->|"reads recent events"| node_db
node_risk -->|"reports assessment"| node_user
node_guiapp -->|"creates window"| node_windowui
node_windowui -->|"controls monitoring"| node_controller
node_controller -->|"launches process"| node_main
node_dashboard -->|"displays events"| node_db
node_dashboard -->|"exports events"| node_csv
node_guiapp -->|"presents activity"| node_dashboard

click node_main "https://github.com/sundeep-codes/major_project/blob/keerthan/main.py"
click node_process "https://github.com/sundeep-codes/major_project/blob/keerthan/monitors/process_monitor.py"
click node_window "https://github.com/sundeep-codes/major_project/blob/keerthan/monitors/active_window.py"
click node_files "https://github.com/sundeep-codes/major_project/blob/keerthan/monitors/file_monitor.py"
click node_transfer "https://github.com/sundeep-codes/major_project/blob/keerthan/monitors/file_transfer_monitor.py"
click node_usb "https://github.com/sundeep-codes/major_project/blob/keerthan/monitors/usb_monitor.py"
click node_security "https://github.com/sundeep-codes/major_project/blob/keerthan/monitors/security_monitor.py"
click node_eventlog "https://github.com/sundeep-codes/major_project/blob/keerthan/utils/logger.py"
click node_db "https://github.com/sundeep-codes/major_project/blob/keerthan/database/database.py"
click node_features "https://github.com/sundeep-codes/major_project/blob/keerthan/features/feature_aggregator.py"
click node_ml "https://github.com/sundeep-codes/major_project/blob/keerthan/detection/ml_detector.py"
click node_model "https://github.com/sundeep-codes/major_project/blob/keerthan/models/forensicguard_rf.pkl"
click node_processdet "https://github.com/sundeep-codes/major_project/blob/keerthan/detection/process_detector.py"
click node_risk "https://github.com/sundeep-codes/major_project/blob/keerthan/detection/risk_engine.py"
click node_guiapp "https://github.com/sundeep-codes/major_project/blob/keerthan/gui/app.py"
click node_controller "https://github.com/sundeep-codes/major_project/blob/keerthan/gui/controller.py"
click node_windowui "https://github.com/sundeep-codes/major_project/blob/keerthan/gui/main_window.py"
click node_dashboard "https://github.com/sundeep-codes/major_project/blob/keerthan/gui/dashboard.py"
click node_csv "https://github.com/sundeep-codes/major_project/tree/keerthan/gui"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_main,node_process,node_window,node_files,node_transfer,node_usb,node_security,node_eventlog,node_user toneBlue
class node_features,node_ml,node_model,node_processdet,node_risk toneAmber
class node_db toneMint
class node_guiapp,node_controller,node_windowui,node_dashboard,node_csv toneRose
class node_windows toneIndigo
```

## Components

### Endpoint Collection

- [Monitor Launcher](https://github.com/sundeep-codes/major_project/blob/keerthan/main.py): `main.py`
- [Process Monitor](https://github.com/sundeep-codes/major_project/blob/keerthan/monitors/process_monitor.py): `monitors/process_monitor.py`
- [Active Window Monitor](https://github.com/sundeep-codes/major_project/blob/keerthan/monitors/active_window.py): `monitors/active_window.py`
- [File Monitor](https://github.com/sundeep-codes/major_project/blob/keerthan/monitors/file_monitor.py): `monitors/file_monitor.py`
- [File Transfer Monitor](https://github.com/sundeep-codes/major_project/blob/keerthan/monitors/file_transfer_monitor.py): `monitors/file_transfer_monitor.py`
- [USB Monitor](https://github.com/sundeep-codes/major_project/blob/keerthan/monitors/usb_monitor.py): `monitors/usb_monitor.py`
- [Security Monitor](https://github.com/sundeep-codes/major_project/blob/keerthan/monitors/security_monitor.py): `monitors/security_monitor.py`
- [Event Logger](https://github.com/sundeep-codes/major_project/blob/keerthan/utils/logger.py): `utils/logger.py`

### Forensic Analysis

- [Feature Aggregator](https://github.com/sundeep-codes/major_project/blob/keerthan/features/feature_aggregator.py): `features/feature_aggregator.py`
- [ML Detector](https://github.com/sundeep-codes/major_project/blob/keerthan/detection/ml_detector.py): `detection/ml_detector.py`
- [Random Forest Model](https://github.com/sundeep-codes/major_project/blob/keerthan/models/forensicguard_rf.pkl): `models/forensicguard_rf.pkl`
- [Process Detector](https://github.com/sundeep-codes/major_project/blob/keerthan/detection/process_detector.py): `detection/process_detector.py`
- [Risk Engine](https://github.com/sundeep-codes/major_project/blob/keerthan/detection/risk_engine.py): `detection/risk_engine.py`

### Evidence Storage

- [Forensic SQLite](https://github.com/sundeep-codes/major_project/blob/keerthan/database/database.py): `database/database.py`

### User Interface

- [GUI Application](https://github.com/sundeep-codes/major_project/blob/keerthan/gui/app.py): `gui/app.py`
- [Monitor Controller](https://github.com/sundeep-codes/major_project/blob/keerthan/gui/controller.py): `gui/controller.py`
- [Main Window](https://github.com/sundeep-codes/major_project/blob/keerthan/gui/main_window.py): `gui/main_window.py`
- [Activity Dashboard](https://github.com/sundeep-codes/major_project/blob/keerthan/gui/dashboard.py): `gui/dashboard.py`
- [CSV Export](https://github.com/sundeep-codes/major_project/tree/keerthan/gui): `gui`

### Other components

- **Endpoint User**
- **Windows Endpoint**

## Connections

- Endpoint User → GUI Application: opens dashboard
- Windows Endpoint → Process Monitor: process activity
- Windows Endpoint → Active Window Monitor: window changes
- Windows Endpoint → File Monitor: file activity
- Windows Endpoint → File Transfer Monitor: copy activity
- Windows Endpoint → USB Monitor: device events
- Windows Endpoint → Security Monitor: security events
- Endpoint User → Monitor Launcher: starts monitoring
- Monitor Launcher → Process Monitor: starts thread
- Monitor Launcher → Active Window Monitor: starts thread
- Monitor Launcher → File Monitor: starts thread
- Monitor Launcher → File Transfer Monitor: starts thread
- Monitor Launcher → USB Monitor: starts thread
- Monitor Launcher → Security Monitor: starts thread
- Monitor Launcher → Forensic SQLite: initializes
- Process Monitor → Event Logger: records events
- Active Window Monitor → Event Logger: records events
- File Monitor → Event Logger: records events
- File Transfer Monitor → Event Logger: records events
- USB Monitor → Event Logger: records events
- Security Monitor → Event Logger: records events
- Event Logger → Forensic SQLite: writes events
- Feature Aggregator → Forensic SQLite: reads events
- ML Detector → Feature Aggregator: gets features
- ML Detector → Random Forest Model: classifies with
- Risk Engine → Forensic SQLite: reads recent events
- Risk Engine → Endpoint User: reports assessment
- GUI Application → Main Window: creates window
- Main Window → Monitor Controller: controls monitoring
- Monitor Controller → Monitor Launcher: launches process
- Activity Dashboard → Forensic SQLite: displays events
- Activity Dashboard → CSV Export: exports events
- GUI Application → Activity Dashboard: presents activity