# varungandhi29/honey-profile-project architecture

> Architecture diagram of the GitHub repository varungandhi29/honey-profile-project, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/varungandhi29/honey-profile-project
- Repository: https://github.com/varungandhi29/honey-profile-project

## Overview

HoneyShield is a deception-based threat defense platform: visitors encounter a simulated honeypot, their session and decoy interactions become telemetry, backend detection and risk services classify and quarantine threats, and SOC operators monitor and manage outcomes in real time. The map includes the documented AI, forensic, geo-visualization, perimeter-defense, and alerting capabilities. Source excerpts are partial, so links among unsampled feature routes and dashboard pages are limited to documented behavior and visible entry points.

Main entry points: [`backend/routes/session.js`](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/routes/session.js) (Session and Trap API), [`backend/server.js`](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/server.js) (HTTP Service), [`frontend/src/App.jsx`](https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/App.jsx) (Application Router), [`backend/services/attackDetectionService.js`](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/services/attackDetectionService.js) (Attack Detection)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_client["Visitor and SOC UI"]
  node_app["Application Router<br/>[App.jsx]"]
  node_deception["Deception Portal"]
  node_soc["SOC Dashboards<br/>[AdminDashboard.jsx]"]
  node_liveengine["Live Telemetry View<br/>[LiveDataEngine.js]"]
  node_socketclient["Realtime Client<br/>[useSocket.js]"]
  node_fingerprint["Device Fingerprinting<br/>[fingerprint.js]"]
  node_audio["Threat Audio Alerts<br/>[alertEngine.js]"]
end

subgraph group_backend["Threat Platform Backend"]
  node_sessionroutes["Session and Trap API<br/>[session.js]"]
  node_honeypotroutes["Honeypot API<br/>[honeypot.js]"]
  node_authroutes["Authentication API<br/>[auth.js]"]
  node_blockroutes["Blocklist API<br/>[blocklist.js]"]
  node_analytics["Analytics and Export<br/>[analytics.js]"]
  node_vault["Forensic Data Vault"]
  node_server["HTTP Service<br/>[server.js]"]
  node_broadcast["Realtime Broadcast"]
  node_socketserver["Socket Gateway<br/>[socket.js]"]
end

subgraph group_intelligence["Detection and AI"]
  node_risk["Risk Engine<br/>[riskEngine.js]"]
  node_detection["Attack Detection"]
  node_reputation["IP Reputation"]
  node_aiapi["AI Prediction API<br/>[main.py]"]
end

subgraph group_state["Telemetry and State"]
  node_cache[("Cache<br/>[cacheService.js]")]
  node_mongodb[("MongoDB Records<br/>[Session.js]")]
  node_alerts[("Alert Records<br/>[Alert.js]")]
end

node_visitor(("Adversary / User"))
node_externalfeeds(("IP Reputation Feed"))

node_visitor -->|"opens portal"| node_app
node_app -->|"generates fingerprint"| node_fingerprint
node_app -->|"authenticates"| node_authroutes
node_app -->|"checks block status"| node_blockroutes
node_app -->|"routes attacker"| node_deception
node_deception -->|"submits interactions"| node_sessionroutes
node_sessionroutes -->|"checks threats"| node_detection
node_sessionroutes -->|"checks IP"| node_reputation
node_sessionroutes -->|"calculates risk"| node_risk
node_sessionroutes -->|"records sessions"| node_mongodb
node_sessionroutes -->|"reads and writes"| node_cache
node_sessionroutes -->|"encrypts evidence"| node_vault
node_detection -->|"tracks behavior"| node_cache
node_detection -->|"checks IP"| node_reputation
node_detection -->|"blocks IP"| node_mongodb
node_detection -->|"dispatches block events"| node_broadcast
node_reputation -.->|"queries reputation"| node_externalfeeds
node_risk -->|"caches predictions"| node_cache
node_risk -->|"requests prediction"| node_aiapi
node_aiapi -->|"returns classification"| node_risk
node_server -->|"mounts API"| node_sessionroutes
node_server -->|"mounts API"| node_honeypotroutes
node_server -->|"mounts API"| node_authroutes
node_server -->|"mounts API"| node_blockroutes
node_server -->|"mounts API"| node_analytics
node_server -->|"connects database"| node_mongodb
node_server -->|"initializes cache"| node_cache
node_server -->|"starts gateway"| node_socketserver
node_server -->|"initializes broadcasts"| node_broadcast
node_broadcast -->|"emits events"| node_socketserver
node_socketclient -->|"receives events"| node_socketserver
node_socketclient -->|"updates telemetry"| node_liveengine
node_app -->|"maintains view state"| node_liveengine
node_soc -->|"requests insights"| node_analytics
node_soc -->|"manages sessions"| node_sessionroutes
node_soc -->|"manages blocks"| node_blockroutes
node_analytics -->|"reads evidence"| node_mongodb
node_analytics -->|"reads alerts"| node_alerts
node_sessionroutes -->|"records alerts"| node_alerts
node_app -->|"plays threat alerts"| node_audio

click node_app "https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/App.jsx"
click node_deception "https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/pages/DeceptionDashboard.jsx"
click node_soc "https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/pages/AdminDashboard.jsx"
click node_liveengine "https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/engine/LiveDataEngine.js"
click node_socketclient "https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/hooks/useSocket.js"
click node_fingerprint "https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/utils/fingerprint.js"
click node_audio "https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/audio/alertEngine.js"
click node_sessionroutes "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/routes/session.js"
click node_honeypotroutes "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/routes/honeypot.js"
click node_authroutes "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/routes/auth.js"
click node_blockroutes "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/routes/blocklist.js"
click node_analytics "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/routes/analytics.js"
click node_vault "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/services/dataVaultService.js"
click node_server "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/server.js"
click node_risk "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/services/riskEngine.js"
click node_detection "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/services/attackDetectionService.js"
click node_reputation "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/services/ipReputationService.js"
click node_aiapi "https://github.com/varungandhi29/honey-profile-project/blob/main/ai-service/main.py"
click node_broadcast "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/services/broadcastService.js"
click node_socketserver "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/socket.js"
click node_cache "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/services/cacheService.js"
click node_mongodb "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/models/Session.js"
click node_alerts "https://github.com/varungandhi29/honey-profile-project/blob/main/backend/models/Alert.js"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app,node_deception,node_soc,node_liveengine,node_socketclient,node_fingerprint,node_audio,node_visitor toneBlue
class node_sessionroutes,node_honeypotroutes,node_authroutes,node_blockroutes,node_analytics,node_vault,node_server,node_broadcast,node_socketserver toneAmber
class node_risk,node_detection,node_reputation,node_aiapi toneMint
class node_cache,node_mongodb,node_alerts toneRose
class node_externalfeeds toneIndigo
```

## Components

### Visitor and SOC UI

- [Application Router](https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/App.jsx): `frontend/src/App.jsx`
- [Deception Portal](https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/pages/DeceptionDashboard.jsx): `frontend/src/pages/DeceptionDashboard.jsx`
- [SOC Dashboards](https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/pages/AdminDashboard.jsx): `frontend/src/pages/AdminDashboard.jsx`
- [Live Telemetry View](https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/engine/LiveDataEngine.js): `frontend/src/engine/LiveDataEngine.js`
- [Realtime Client](https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/hooks/useSocket.js): `frontend/src/hooks/useSocket.js`
- [Device Fingerprinting](https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/utils/fingerprint.js): `frontend/src/utils/fingerprint.js`
- [Threat Audio Alerts](https://github.com/varungandhi29/honey-profile-project/blob/main/frontend/src/audio/alertEngine.js): `frontend/src/audio/alertEngine.js`

### Threat Platform Backend

- [Session and Trap API](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/routes/session.js): `backend/routes/session.js`
- [Honeypot API](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/routes/honeypot.js): `backend/routes/honeypot.js`
- [Authentication API](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/routes/auth.js): `backend/routes/auth.js`
- [Blocklist API](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/routes/blocklist.js): `backend/routes/blocklist.js`
- [Analytics and Export](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/routes/analytics.js): `backend/routes/analytics.js`
- [Forensic Data Vault](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/services/dataVaultService.js): `backend/services/dataVaultService.js`
- [HTTP Service](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/server.js): `backend/server.js`
- [Realtime Broadcast](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/services/broadcastService.js): `backend/services/broadcastService.js`
- [Socket Gateway](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/socket.js): `backend/socket.js`

### Detection and AI

- [Risk Engine](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/services/riskEngine.js): `backend/services/riskEngine.js`
- [Attack Detection](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/services/attackDetectionService.js): `backend/services/attackDetectionService.js`
- [IP Reputation](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/services/ipReputationService.js): `backend/services/ipReputationService.js`
- [AI Prediction API](https://github.com/varungandhi29/honey-profile-project/blob/main/ai-service/main.py): `ai-service/main.py`

### Telemetry and State

- [Cache](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/services/cacheService.js): `backend/services/cacheService.js`
- [MongoDB Records](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/models/Session.js): `backend/models/Session.js`
- [Alert Records](https://github.com/varungandhi29/honey-profile-project/blob/main/backend/models/Alert.js): `backend/models/Alert.js`

### Other components

- **Adversary / User**
- **IP Reputation Feed**

## Connections

- Adversary / User → Application Router: opens portal
- Application Router → Device Fingerprinting: generates fingerprint
- Application Router → Authentication API: authenticates
- Application Router → Blocklist API: checks block status
- Application Router → Deception Portal: routes attacker
- Deception Portal → Session and Trap API: submits interactions
- Session and Trap API → Attack Detection: checks threats
- Session and Trap API → IP Reputation: checks IP
- Session and Trap API → Risk Engine: calculates risk
- Session and Trap API → MongoDB Records: records sessions
- Session and Trap API → Cache: reads and writes
- Session and Trap API → Forensic Data Vault: encrypts evidence
- Attack Detection → Cache: tracks behavior
- Attack Detection → IP Reputation: checks IP
- Attack Detection → MongoDB Records: blocks IP
- Attack Detection → Realtime Broadcast: dispatches block events
- IP Reputation → IP Reputation Feed: queries reputation
- Risk Engine → Cache: caches predictions
- Risk Engine → AI Prediction API: requests prediction
- AI Prediction API → Risk Engine: returns classification
- HTTP Service → Session and Trap API: mounts API
- HTTP Service → Honeypot API: mounts API
- HTTP Service → Authentication API: mounts API
- HTTP Service → Blocklist API: mounts API
- HTTP Service → Analytics and Export: mounts API
- HTTP Service → MongoDB Records: connects database
- HTTP Service → Cache: initializes cache
- HTTP Service → Socket Gateway: starts gateway
- HTTP Service → Realtime Broadcast: initializes broadcasts
- Realtime Broadcast → Socket Gateway: emits events
- Realtime Client → Socket Gateway: receives events
- Realtime Client → Live Telemetry View: updates telemetry
- Application Router → Live Telemetry View: maintains view state
- SOC Dashboards → Analytics and Export: requests insights
- SOC Dashboards → Session and Trap API: manages sessions
- SOC Dashboards → Blocklist API: manages blocks
- Analytics and Export → MongoDB Records: reads evidence
- Analytics and Export → Alert Records: reads alerts
- Session and Trap API → Alert Records: records alerts
- Application Router → Threat Audio Alerts: plays threat alerts