How tadghyelmehdi/ids-ips-system works
This is an IDS/IPS system: captured network traffic is aggregated into flow features, submitted to the Flask prediction endpoint, and evaluated for attacks before firewall action and audit logging. The backend also serves dashboard data and Telegram alerts; model training is a separate capability. The README documents whitelist bypass and the dashboard’s live views. Some backend internals and the Flutter client are unsampled, so their connections are omitted or marked unverified.
Main entry points: app.py Security Engine · capteur.py Flow Sensor · main.dart Flutter Dashboard · rf_model.py Model Trainer
Components 13
Traffic Capture
- Flow Sensor
capteur.py
Detection and Response
- Security Engine
app.py - Whitelist Fast Path
app.py - ML and Heuristics
app.py - Firewall Control
app.py - Telegram Alerts
app.py - SQLite Audit Log
app.py
Dashboard and API
- Flask API
app.py - Web Dashboard
app.py - Flutter Dashboard
flutter_dashboard/lib/main.dart
Model Training
- Model Trainer
rf_model.py
Other components
- Network Traffic
- Dashboard Operator
Connections 14
- Network Traffic → Flow Sensor: captures
README.md - Flow Sensor → Flask API: submits features
capteur.py - Flask API → Security Engine: calls prediction
app.py - Security Engine → Whitelist Fast Path: checks bypass
README.md - Security Engine → ML and Heuristics: classifies flows
app.py - Security Engine → Firewall Control: blocks IPs
app.py - Security Engine → Telegram Alerts: sends alerts
app.py - Security Engine → SQLite Audit Log: writes events
README.md - Flask API → Web Dashboard: serves page
app.py - Web Dashboard → Flask API: polls data
app.py - Dashboard Operator → Web Dashboard: views alerts
README.md - Dashboard Operator → Flask API: requests unblock
app.py - Flutter Dashboard → Flask API: uses backend
- Model Trainer → ML and Heuristics: produces model
README.md