# swaralifendar/idps architecture

> Architecture diagram of the GitHub repository swaralifendar/idps, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-06). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/swaralifendar/idps
- Repository: https://github.com/swaralifendar/idps

## Overview

IDPS combines host-based and network-based intrusion detection with alert normalization, cross-sensor correlation, and intrusion-prevention decisions. The principal workflow is sensor collection and rule evaluation, followed by normalized alert ingestion and correlation; IPS evaluates correlation events separately. The README identifies the product only, so feature detail comes from the source index and excerpts. Several runtime links are documented by imports or excerpts; links involving file-based handoffs are omitted where the supplied evidence does not show the caller or transfer.

Main entry points: [`hids/hids.py`](https://github.com/swaralifendar/idps/blob/main/hids/hids.py) (HIDS Worker), [`alert_manager/correlation_worker.py`](https://github.com/swaralifendar/idps/blob/main/alert_manager/correlation_worker.py) (Correlation Worker), [`alert_manager/correlation_engine.py`](https://github.com/swaralifendar/idps/blob/main/alert_manager/correlation_engine.py) (Correlation Engine), [`paths.py`](https://github.com/swaralifendar/idps/blob/main/paths.py) (Runtime Paths)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_host["Host Detection"]
  node_host_collector["Event Collector<br/>[collector.py]"]
  node_host_normalizer["Event Normalizer<br/>[normalizer.py]"]
  node_host_rules["HIDS Rule Engine<br/>[rule_engine.py]"]
  node_host_parser["HIDS Rule Parser<br/>[rules_parser.py]"]
  node_host_orchestrator["HIDS Worker<br/>[hids.py]"]
end

subgraph group_network["Network Detection"]
  node_network_capture["Packet Capture<br/>[capture.py]"]
  node_traffic_event["Traffic Event<br/>[trafficevent.py]"]
  node_network_rules["NIDS Rule Engine<br/>[rules_engine.py]"]
  node_network_parser["NIDS Rule Parser<br/>[rules_parser.py]"]
end

subgraph group_alerts["Alert Correlation"]
  node_hids_adapter["HIDS Adapter<br/>[hids_adapter.py]"]
  node_nids_adapter["NIDS Adapter<br/>[nids_adapter.py]"]
  node_alert_schema["Alert Schema<br/>[alert_schema.py]"]
  node_correlation_worker["Correlation Worker"]
  node_correlation_engine["Correlation Engine"]
  node_correlation_state[("Correlation State")]
end

subgraph group_prevention["Intrusion Prevention"]
  node_ips_worker["IPS Worker<br/>[ips_worker.py]"]
  node_ips_engine["IPS Engine<br/>[ips_engine.py]"]
end

subgraph group_runtime["Runtime Support"]
  node_service["Windows Service<br/>[service.py]"]
  node_paths["Runtime Paths<br/>[paths.py]"]
  node_rotation["Log Rotation<br/>[rotation.py]"]
  node_stop_signal["Stop Coordination<br/>[stop_signal.py]"]
end

node_operator(("Operator"))

node_operator -->|"starts service"| node_service
node_service -->|"starts worker"| node_host_orchestrator
node_host_orchestrator -->|"collects events"| node_host_collector
node_host_orchestrator -->|"normalizes events"| node_host_normalizer
node_host_orchestrator -->|"evaluates rules"| node_host_rules
node_host_rules -->|"evaluates normalized events"| node_host_normalizer
node_host_rules -->|"loads rules"| node_host_parser
node_network_capture -->|"creates events"| node_traffic_event
node_network_capture -->|"evaluates traffic"| node_network_rules
node_network_rules -->|"matches events"| node_traffic_event
node_network_rules -->|"loads rules"| node_network_parser
node_correlation_worker -->|"reads alerts"| node_hids_adapter
node_correlation_worker -->|"reads alerts"| node_nids_adapter
node_correlation_worker -->|"processes alerts"| node_correlation_engine
node_hids_adapter -->|"normalizes to"| node_alert_schema
node_nids_adapter -->|"normalizes to"| node_alert_schema
node_correlation_engine -->|"buckets events"| node_alert_schema
node_correlation_engine -->|"saves state"| node_correlation_state
node_ips_worker -->|"evaluates events"| node_ips_engine
node_correlation_engine -.->|"supplies correlation events"| node_ips_engine
node_service -->|"signals shutdown"| node_stop_signal
node_host_orchestrator -->|"uses paths"| node_paths
node_network_capture -->|"uses paths"| node_paths
node_ips_worker -->|"uses paths"| node_paths
node_correlation_worker -->|"uses paths"| node_paths
node_nids_adapter -->|"tails logs"| node_rotation
node_hids_adapter -->|"tails logs"| node_rotation

click node_service "https://github.com/swaralifendar/idps/blob/main/service.py"
click node_host_collector "https://github.com/swaralifendar/idps/blob/main/hids/collector.py"
click node_host_normalizer "https://github.com/swaralifendar/idps/blob/main/hids/normalizer.py"
click node_host_rules "https://github.com/swaralifendar/idps/blob/main/hids/rule_engine.py"
click node_host_parser "https://github.com/swaralifendar/idps/blob/main/hids/rules_parser.py"
click node_host_orchestrator "https://github.com/swaralifendar/idps/blob/main/hids/hids.py"
click node_network_capture "https://github.com/swaralifendar/idps/blob/main/NIDS/capture.py"
click node_traffic_event "https://github.com/swaralifendar/idps/blob/main/NIDS/trafficevent.py"
click node_network_rules "https://github.com/swaralifendar/idps/blob/main/NIDS/rules_engine.py"
click node_network_parser "https://github.com/swaralifendar/idps/blob/main/NIDS/rules_parser.py"
click node_hids_adapter "https://github.com/swaralifendar/idps/blob/main/alert_manager/adapters/hids_adapter.py"
click node_nids_adapter "https://github.com/swaralifendar/idps/blob/main/alert_manager/adapters/nids_adapter.py"
click node_alert_schema "https://github.com/swaralifendar/idps/blob/main/alert_manager/schema/alert_schema.py"
click node_correlation_worker "https://github.com/swaralifendar/idps/blob/main/alert_manager/correlation_worker.py"
click node_correlation_engine "https://github.com/swaralifendar/idps/blob/main/alert_manager/correlation_engine.py"
click node_correlation_state "https://github.com/swaralifendar/idps/blob/main/alert_manager/correlation_engine.py"
click node_ips_worker "https://github.com/swaralifendar/idps/blob/main/IPS/ips_worker.py"
click node_ips_engine "https://github.com/swaralifendar/idps/blob/main/IPS/ips_engine.py"
click node_paths "https://github.com/swaralifendar/idps/blob/main/paths.py"
click node_rotation "https://github.com/swaralifendar/idps/blob/main/rotation.py"
click node_stop_signal "https://github.com/swaralifendar/idps/blob/main/stop_signal.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_host_collector,node_host_normalizer,node_host_rules,node_host_parser,node_host_orchestrator toneBlue
class node_network_capture,node_traffic_event,node_network_rules,node_network_parser toneAmber
class node_hids_adapter,node_nids_adapter,node_alert_schema,node_correlation_worker,node_correlation_engine,node_correlation_state toneMint
class node_ips_worker,node_ips_engine toneRose
class node_service,node_paths,node_rotation,node_stop_signal,node_operator toneIndigo
```

## Components

### Host Detection

- [Event Collector](https://github.com/swaralifendar/idps/blob/main/hids/collector.py): `hids/collector.py`
- [Event Normalizer](https://github.com/swaralifendar/idps/blob/main/hids/normalizer.py): `hids/normalizer.py`
- [HIDS Rule Engine](https://github.com/swaralifendar/idps/blob/main/hids/rule_engine.py): `hids/rule_engine.py`
- [HIDS Rule Parser](https://github.com/swaralifendar/idps/blob/main/hids/rules_parser.py): `hids/rules_parser.py`
- [HIDS Worker](https://github.com/swaralifendar/idps/blob/main/hids/hids.py): `hids/hids.py`

### Network Detection

- [Packet Capture](https://github.com/swaralifendar/idps/blob/main/NIDS/capture.py): `NIDS/capture.py`
- [Traffic Event](https://github.com/swaralifendar/idps/blob/main/NIDS/trafficevent.py): `NIDS/trafficevent.py`
- [NIDS Rule Engine](https://github.com/swaralifendar/idps/blob/main/NIDS/rules_engine.py): `NIDS/rules_engine.py`
- [NIDS Rule Parser](https://github.com/swaralifendar/idps/blob/main/NIDS/rules_parser.py): `NIDS/rules_parser.py`

### Alert Correlation

- [HIDS Adapter](https://github.com/swaralifendar/idps/blob/main/alert_manager/adapters/hids_adapter.py): `alert_manager/adapters/hids_adapter.py`
- [NIDS Adapter](https://github.com/swaralifendar/idps/blob/main/alert_manager/adapters/nids_adapter.py): `alert_manager/adapters/nids_adapter.py`
- [Alert Schema](https://github.com/swaralifendar/idps/blob/main/alert_manager/schema/alert_schema.py): `alert_manager/schema/alert_schema.py`
- [Correlation Worker](https://github.com/swaralifendar/idps/blob/main/alert_manager/correlation_worker.py): `alert_manager/correlation_worker.py`
- [Correlation Engine](https://github.com/swaralifendar/idps/blob/main/alert_manager/correlation_engine.py): `alert_manager/correlation_engine.py`
- [Correlation State](https://github.com/swaralifendar/idps/blob/main/alert_manager/correlation_engine.py): `alert_manager/correlation_engine.py`

### Intrusion Prevention

- [IPS Worker](https://github.com/swaralifendar/idps/blob/main/IPS/ips_worker.py): `IPS/ips_worker.py`
- [IPS Engine](https://github.com/swaralifendar/idps/blob/main/IPS/ips_engine.py): `IPS/ips_engine.py`

### Runtime Support

- [Windows Service](https://github.com/swaralifendar/idps/blob/main/service.py): `service.py`
- [Runtime Paths](https://github.com/swaralifendar/idps/blob/main/paths.py): `paths.py`
- [Log Rotation](https://github.com/swaralifendar/idps/blob/main/rotation.py): `rotation.py`
- [Stop Coordination](https://github.com/swaralifendar/idps/blob/main/stop_signal.py): `stop_signal.py`

### Other components

- **Operator**

## Connections

- Operator → Windows Service: starts service (evidence: `service.py`)
- Windows Service → HIDS Worker: starts worker (evidence: `service.py`)
- HIDS Worker → Event Collector: collects events (evidence: `hids/hids.py`)
- HIDS Worker → Event Normalizer: normalizes events (evidence: `hids/hids.py`)
- HIDS Worker → HIDS Rule Engine: evaluates rules (evidence: `hids/hids.py`)
- HIDS Rule Engine → Event Normalizer: evaluates normalized events (evidence: `hids/rule_engine.py`)
- HIDS Rule Engine → HIDS Rule Parser: loads rules (evidence: `hids/rule_engine.py`)
- Packet Capture → Traffic Event: creates events (evidence: `NIDS/capture.py`)
- Packet Capture → NIDS Rule Engine: evaluates traffic (evidence: `NIDS/capture.py`)
- NIDS Rule Engine → Traffic Event: matches events (evidence: `NIDS/rules_engine.py`)
- NIDS Rule Engine → NIDS Rule Parser: loads rules (evidence: `NIDS/rules_engine.py`)
- Correlation Worker → HIDS Adapter: reads alerts (evidence: `alert_manager/correlation_worker.py`)
- Correlation Worker → NIDS Adapter: reads alerts (evidence: `alert_manager/correlation_worker.py`)
- Correlation Worker → Correlation Engine: processes alerts (evidence: `alert_manager/correlation_worker.py`)
- HIDS Adapter → Alert Schema: normalizes to (evidence: `alert_manager/adapters/hids_adapter.py`)
- NIDS Adapter → Alert Schema: normalizes to (evidence: `alert_manager/adapters/nids_adapter.py`)
- Correlation Engine → Alert Schema: buckets events (evidence: `alert_manager/correlation_engine.py`)
- Correlation Engine → Correlation State: saves state (evidence: `alert_manager/correlation_engine.py`)
- IPS Worker → IPS Engine: evaluates events (evidence: `IPS/ips_worker.py`)
- Correlation Engine → IPS Engine: supplies correlation events (evidence: `IPS/ips_engine.py`)
- Windows Service → Stop Coordination: signals shutdown (evidence: `service.py`)
- HIDS Worker → Runtime Paths: uses paths (evidence: `hids/hids.py`)
- Packet Capture → Runtime Paths: uses paths (evidence: `NIDS/capture.py`)
- IPS Worker → Runtime Paths: uses paths (evidence: `IPS/ips_worker.py`)
- Correlation Worker → Runtime Paths: uses paths (evidence: `alert_manager/correlation_worker.py`)
- NIDS Adapter → Log Rotation: tails logs (evidence: `alert_manager/adapters/nids_adapter.py`)
- HIDS Adapter → Log Rotation: tails logs (evidence: `alert_manager/adapters/hids_adapter.py`)