How visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection works
This is a real-time network IDS: packets are captured and converted into flow features, scored by a live Random Forest + Autoencoder fusion pipeline, and alerts are published for API and dashboard consumption. Flask/Socket.IO serves live alerts plus history, settings, system status, and threat intelligence; React provides dashboard, history, threat-intel, and settings views. Offline preprocessing, model training/evaluation, and CNN sequence comparison are separate from live detection. The documented architecture and selected source references establish the main wiring; some unsampled implementation details are intentionally not connected.
Main entry points: routes.py REST API · App.jsx React app routing · main.py IDS runtime · ids_pipeline.py Live flow pipeline
Components 22
Capture and scoring
- IDS runtime
backend/main.py - Live flow pipeline
backend/src/ids_pipeline.py - Alert scoring
backend/src/scoring.py - Threat evidence
backend/src/threat_evidence.py
Models and data
- Dataset preprocessing
backend/src/data_preprocessing.py - Model development
backend/src/ai_model_development.py - CNN sequences
backend/src/sequence_builder.py - Model evaluation
backend/src/model_evaluation.py - Model artifacts
backend/src/model_artifacts.py
API and enrichment
- Redis store
- REST API
backend/routes.py - Alert bridge
backend/src/redis_alert_bridge.py - Geolocation
backend/src/geo_utils.py - Threat intelligence
backend/src/threat_intel_service.py
Web interface
- React app routing
frontend/src/App.jsx - Live dashboard
frontend/src/pages/Dashboard.jsx - Alert history
frontend/src/pages/History.jsx - Detection settings
frontend/src/pages/Settings.jsx - Threat intel page
frontend/src/pages/ThreatIntel.jsx
Other components
- Network traffic
- Operator browser
- AbuseIPDB
Connections 26
- Network traffic → IDS runtime: captures packets
- IDS runtime → Live flow pipeline: starts pipeline
backend/main.py - Live flow pipeline → Alert scoring: scores flows
backend/src/ids_pipeline.py - Live flow pipeline → Threat evidence: builds evidence
backend/src/ids_pipeline.py - Live flow pipeline → Redis store: writes alerts
- IDS runtime → REST API: registers routes
backend/main.py - IDS runtime → Alert bridge: starts bridge
backend/main.py - Alert bridge → Redis store: reads alerts
- REST API → Redis store: reads alert data
- REST API → Geolocation: adds locations
backend/routes.py - REST API → Threat intelligence: requests lookups
backend/routes.py - Threat intelligence → Redis store: caches results
backend/src/threat_intel_service.py - Threat intelligence → AbuseIPDB: checks IPs
backend/src/threat_intel_service.py - Dataset preprocessing → Model development: prepares training data
- Model development → Model artifacts: produces models
- CNN sequences → Model development: prepares CNN input
- Model evaluation → CNN sequences: evaluates sequences
backend/src/model_evaluation.py - Operator browser → React app routing: opens interface
frontend/src/App.jsx - React app routing → Live dashboard: routes to
frontend/src/App.jsx - React app routing → Alert history: routes to
frontend/src/App.jsx - React app routing → Detection settings: routes to
frontend/src/App.jsx - React app routing → Threat intel page: routes to
frontend/src/App.jsx - Live dashboard → REST API: loads history
frontend/src/pages/Dashboard.jsx - Alert history → REST API: requests history
- Detection settings → REST API: loads settings
frontend/src/pages/Settings.jsx - Threat intel page → REST API: requests intelligence