# visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection architecture

> Architecture diagram of the GitHub repository visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-03). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection
- Repository: https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection

## Overview

This is a real-time network IDS: packets are captured and converted into flow features, scored by a live Random Forest + Autoencoder fusion pipeline, and alerts are published for API and dashboard consumption. Flask/Socket.IO serves live alerts plus history, settings, system status, and threat intelligence; React provides dashboard, history, threat-intel, and settings views. Offline preprocessing, model training/evaluation, and CNN sequence comparison are separate from live detection. The documented architecture and selected source references establish the main wiring; some unsampled implementation details are intentionally not connected.

Main entry points: [`backend/routes.py`](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/routes.py) (REST API), [`frontend/src/App.jsx`](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/frontend/src/App.jsx) (React app routing), [`backend/main.py`](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/main.py) (IDS runtime), [`backend/src/ids_pipeline.py`](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/ids_pipeline.py) (Live flow pipeline)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_capture["Capture and scoring"]
  node_orchestrator["IDS runtime<br/>[main.py]"]
  node_pipeline["Live flow pipeline<br/>[ids_pipeline.py]"]
  node_scoring["Alert scoring<br/>[scoring.py]"]
  node_evidence["Threat evidence<br/>[threat_evidence.py]"]
end

subgraph group_models["Models and data"]
  node_preprocessing["Dataset preprocessing"]
  node_training["Model development"]
  node_sequences["CNN sequences"]
  node_evaluation["Model evaluation"]
  node_artifacts["Model artifacts<br/>[model_artifacts.py]"]
end

subgraph group_service["API and enrichment"]
  node_redis[("Redis store")]
  node_routes["REST API<br/>[routes.py]"]
  node_bridge["Alert bridge"]
  node_geo["Geolocation<br/>[geo_utils.py]"]
  node_threatintel["Threat intelligence"]
end

subgraph group_ui["Web interface"]
  node_app["React app routing<br/>[App.jsx]"]
  node_dashboard["Live dashboard<br/>[Dashboard.jsx]"]
  node_history["Alert history<br/>[History.jsx]"]
  node_settings["Detection settings<br/>[Settings.jsx]"]
  node_intelpage["Threat intel page<br/>[ThreatIntel.jsx]"]
end

node_traffic(("Network traffic"))
node_browser(("Operator browser"))
node_abuseipdb["AbuseIPDB"]

node_traffic -->|"captures packets"| node_orchestrator
node_orchestrator -->|"starts pipeline"| node_pipeline
node_pipeline -->|"scores flows"| node_scoring
node_pipeline -->|"builds evidence"| node_evidence
node_pipeline -->|"writes alerts"| node_redis
node_orchestrator -->|"registers routes"| node_routes
node_orchestrator -->|"starts bridge"| node_bridge
node_bridge -->|"reads alerts"| node_redis
node_routes -->|"reads alert data"| node_redis
node_routes -->|"adds locations"| node_geo
node_routes -->|"requests lookups"| node_threatintel
node_threatintel -->|"caches results"| node_redis
node_threatintel -->|"checks IPs"| node_abuseipdb
node_preprocessing -.->|"prepares training data"| node_training
node_training -.->|"produces models"| node_artifacts
node_sequences -.->|"prepares CNN input"| node_training
node_evaluation -->|"evaluates sequences"| node_sequences
node_browser -->|"opens interface"| node_app
node_app -->|"routes to"| node_dashboard
node_app -->|"routes to"| node_history
node_app -->|"routes to"| node_settings
node_app -->|"routes to"| node_intelpage
node_dashboard -->|"loads history"| node_routes
node_history -.->|"requests history"| node_routes
node_settings -->|"loads settings"| node_routes
node_intelpage -.->|"requests intelligence"| node_routes

click node_orchestrator "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/main.py"
click node_pipeline "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/ids_pipeline.py"
click node_scoring "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/scoring.py"
click node_evidence "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/threat_evidence.py"
click node_preprocessing "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/data_preprocessing.py"
click node_training "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/ai_model_development.py"
click node_sequences "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/sequence_builder.py"
click node_evaluation "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/model_evaluation.py"
click node_artifacts "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/model_artifacts.py"
click node_routes "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/routes.py"
click node_bridge "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/redis_alert_bridge.py"
click node_geo "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/geo_utils.py"
click node_threatintel "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/threat_intel_service.py"
click node_app "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/frontend/src/App.jsx"
click node_dashboard "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/frontend/src/pages/Dashboard.jsx"
click node_history "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/frontend/src/pages/History.jsx"
click node_settings "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/frontend/src/pages/Settings.jsx"
click node_intelpage "https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/frontend/src/pages/ThreatIntel.jsx"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_orchestrator,node_pipeline,node_scoring,node_evidence,node_browser toneBlue
class node_preprocessing,node_training,node_sequences,node_evaluation,node_artifacts toneAmber
class node_redis,node_routes,node_bridge,node_geo,node_threatintel toneMint
class node_app,node_dashboard,node_history,node_settings,node_intelpage toneRose
class node_traffic,node_abuseipdb toneIndigo
```

## Components

### Capture and scoring

- [IDS runtime](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/main.py): `backend/main.py`
- [Live flow pipeline](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/ids_pipeline.py): `backend/src/ids_pipeline.py`
- [Alert scoring](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/scoring.py): `backend/src/scoring.py`
- [Threat evidence](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/threat_evidence.py): `backend/src/threat_evidence.py`

### Models and data

- [Dataset preprocessing](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/data_preprocessing.py): `backend/src/data_preprocessing.py`
- [Model development](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/ai_model_development.py): `backend/src/ai_model_development.py`
- [CNN sequences](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/sequence_builder.py): `backend/src/sequence_builder.py`
- [Model evaluation](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/model_evaluation.py): `backend/src/model_evaluation.py`
- [Model artifacts](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/model_artifacts.py): `backend/src/model_artifacts.py`

### API and enrichment

- **Redis store**
- [REST API](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/routes.py): `backend/routes.py`
- [Alert bridge](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/redis_alert_bridge.py): `backend/src/redis_alert_bridge.py`
- [Geolocation](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/geo_utils.py): `backend/src/geo_utils.py`
- [Threat intelligence](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/backend/src/threat_intel_service.py): `backend/src/threat_intel_service.py`

### Web interface

- [React app routing](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/frontend/src/App.jsx): `frontend/src/App.jsx`
- [Live dashboard](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/frontend/src/pages/Dashboard.jsx): `frontend/src/pages/Dashboard.jsx`
- [Alert history](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/frontend/src/pages/History.jsx): `frontend/src/pages/History.jsx`
- [Detection settings](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/frontend/src/pages/Settings.jsx): `frontend/src/pages/Settings.jsx`
- [Threat intel page](https://github.com/visalsattar/ai-based-intrusion-detection-system-for-real-time-network-threat-detection/blob/main/frontend/src/pages/ThreatIntel.jsx): `frontend/src/pages/ThreatIntel.jsx`

### Other components

- **Network traffic**
- **Operator browser**
- **AbuseIPDB**

## Connections

- Network traffic → IDS runtime: captures packets
- IDS runtime → Live flow pipeline: starts pipeline (evidence: `backend/main.py`)
- Live flow pipeline → Alert scoring: scores flows (evidence: `backend/src/ids_pipeline.py`)
- Live flow pipeline → Threat evidence: builds evidence (evidence: `backend/src/ids_pipeline.py`)
- Live flow pipeline → Redis store: writes alerts
- IDS runtime → REST API: registers routes (evidence: `backend/main.py`)
- IDS runtime → Alert bridge: starts bridge (evidence: `backend/main.py`)
- Alert bridge → Redis store: reads alerts
- REST API → Redis store: reads alert data
- REST API → Geolocation: adds locations (evidence: `backend/routes.py`)
- REST API → Threat intelligence: requests lookups (evidence: `backend/routes.py`)
- Threat intelligence → Redis store: caches results (evidence: `backend/src/threat_intel_service.py`)
- Threat intelligence → AbuseIPDB: checks IPs (evidence: `backend/src/threat_intel_service.py`)
- Dataset preprocessing → Model development: prepares training data
- Model development → Model artifacts: produces models
- CNN sequences → Model development: prepares CNN input
- Model evaluation → CNN sequences: evaluates sequences (evidence: `backend/src/model_evaluation.py`)
- Operator browser → React app routing: opens interface (evidence: `frontend/src/App.jsx`)
- React app routing → Live dashboard: routes to (evidence: `frontend/src/App.jsx`)
- React app routing → Alert history: routes to (evidence: `frontend/src/App.jsx`)
- React app routing → Detection settings: routes to (evidence: `frontend/src/App.jsx`)
- React app routing → Threat intel page: routes to (evidence: `frontend/src/App.jsx`)
- Live dashboard → REST API: loads history (evidence: `frontend/src/pages/Dashboard.jsx`)
- Alert history → REST API: requests history
- Detection settings → REST API: loads settings (evidence: `frontend/src/pages/Settings.jsx`)
- Threat intel page → REST API: requests intelligence