How swaralifendar/idps works
IDPS combines host-based and network-based intrusion detection with alert normalization, cross-sensor correlation, and intrusion-prevention decisions. The principal workflow is sensor collection and rule evaluation, followed by normalized alert ingestion and correlation; IPS evaluates correlation events separately. The README identifies the product only, so feature detail comes from the source index and excerpts. Several runtime links are documented by imports or excerpts; links involving file-based handoffs are omitted where the supplied evidence does not show the caller or transfer.
Main entry points: hids.py HIDS Worker · correlation_worker.py Correlation Worker · correlation_engine.py Correlation Engine · paths.py Runtime Paths
Components 22
Host Detection
- Event Collector
hids/collector.py - Event Normalizer
hids/normalizer.py - HIDS Rule Engine
hids/rule_engine.py - HIDS Rule Parser
hids/rules_parser.py - HIDS Worker
hids/hids.py
Network Detection
- Packet Capture
NIDS/capture.py - Traffic Event
NIDS/trafficevent.py - NIDS Rule Engine
NIDS/rules_engine.py - NIDS Rule Parser
NIDS/rules_parser.py
Alert Correlation
- HIDS Adapter
alert_manager/adapters/hids_adapter.py - NIDS Adapter
alert_manager/adapters/nids_adapter.py - Alert Schema
alert_manager/schema/alert_schema.py - Correlation Worker
alert_manager/correlation_worker.py - Correlation Engine
alert_manager/correlation_engine.py - Correlation State
alert_manager/correlation_engine.py
Intrusion Prevention
- IPS Worker
IPS/ips_worker.py - IPS Engine
IPS/ips_engine.py
Runtime Support
- Windows Service
service.py - Runtime Paths
paths.py - Log Rotation
rotation.py - Stop Coordination
stop_signal.py
Other components
- Operator
Connections 27
- Operator → Windows Service: starts service
service.py - Windows Service → HIDS Worker: starts worker
service.py - HIDS Worker → Event Collector: collects events
hids/hids.py - HIDS Worker → Event Normalizer: normalizes events
hids/hids.py - HIDS Worker → HIDS Rule Engine: evaluates rules
hids/hids.py - HIDS Rule Engine → Event Normalizer: evaluates normalized events
hids/rule_engine.py - HIDS Rule Engine → HIDS Rule Parser: loads rules
hids/rule_engine.py - Packet Capture → Traffic Event: creates events
NIDS/capture.py - Packet Capture → NIDS Rule Engine: evaluates traffic
NIDS/capture.py - NIDS Rule Engine → Traffic Event: matches events
NIDS/rules_engine.py - NIDS Rule Engine → NIDS Rule Parser: loads rules
NIDS/rules_engine.py - Correlation Worker → HIDS Adapter: reads alerts
alert_manager/correlation_worker.py - Correlation Worker → NIDS Adapter: reads alerts
alert_manager/correlation_worker.py - Correlation Worker → Correlation Engine: processes alerts
alert_manager/correlation_worker.py - HIDS Adapter → Alert Schema: normalizes to
alert_manager/adapters/hids_adapter.py - NIDS Adapter → Alert Schema: normalizes to
alert_manager/adapters/nids_adapter.py - Correlation Engine → Alert Schema: buckets events
alert_manager/correlation_engine.py - Correlation Engine → Correlation State: saves state
alert_manager/correlation_engine.py - IPS Worker → IPS Engine: evaluates events
IPS/ips_worker.py - Correlation Engine → IPS Engine: supplies correlation events
IPS/ips_engine.py - Windows Service → Stop Coordination: signals shutdown
service.py - HIDS Worker → Runtime Paths: uses paths
hids/hids.py - Packet Capture → Runtime Paths: uses paths
NIDS/capture.py - IPS Worker → Runtime Paths: uses paths
IPS/ips_worker.py - Correlation Worker → Runtime Paths: uses paths
alert_manager/correlation_worker.py - NIDS Adapter → Log Rotation: tails logs
alert_manager/adapters/nids_adapter.py - HIDS Adapter → Log Rotation: tails logs
alert_manager/adapters/hids_adapter.py