How vivek-kamannavar/cyber-threat works
This is a passive, unidirectional network-threat monitoring prototype: flow records are ingested and normalized, analyzed over sliding windows, turned into standardized alerts, and surfaced through a SOC dashboard. The documented detection stages include heuristic threat rules and anomaly detection; alerts can be persisted and streamed to the UI. The dashboard also provides simulation and manual inspection capabilities. The graph reflects the sampled detector, parser, storage, and UI evidence plus README-documented features; unsampled backend routing details are not expanded into speculative call chains.
Main entry points: App.jsx Dashboard app · threat_detector.py Detection orchestrator · main.py FastAPI gateway · parser.py Parse and normalize
Components 21
Flow ingestion
- Parse and normalize
ingest/parser.py - PCAP loading
ingest/pcap_loader.py - Traffic simulation
ingest/traffic_generator.py
Threat analysis
- Feature engineering
engine/features.py - Sliding window
engine/window_manager.py - Threat rules
engine/models/heuristic_rules.py - Isolation Forest
engine/models/isolation_forest.py - Detection orchestrator
engine/threat_detector.py
API and state
- FastAPI gateway
backend/main.py - SQLite records
backend/database.py
SOC dashboard
- Dashboard app
dashboard/src/App.jsx - Manual inspection
dashboard/src/components/ManualInspectionPanel.jsx - Alert feed
dashboard/src/components/AlertFeed.jsx - Topology graph
dashboard/src/components/NetworkTopologyGraph.jsx - Throughput chart
dashboard/src/components/ThroughputChart.jsx - Simulation controls
dashboard/src/components/SimulationControl.jsx
AI assistance
- Incident copilot
backend/services/groq_service.py
Other components
- Mirrored traffic
- Zeek / PCAP files
- SOC analyst
- Groq API
Connections 23
- Mirrored traffic → Parse and normalize: passive flows
- Zeek / PCAP files → Parse and normalize: parse records
- Zeek / PCAP files → PCAP loading: load captures
- Traffic simulation → Detection orchestrator: simulated flows
- Parse and normalize → FastAPI gateway: normalized flows
- PCAP loading → FastAPI gateway: capture flows
- FastAPI gateway → Detection orchestrator: submit flows
- Detection orchestrator → Sliding window: add and query
- Detection orchestrator → Threat rules: classify flows
- Detection orchestrator → Isolation Forest: score anomalies
- Threat rules → Feature engineering: calculate features
- Detection orchestrator → SQLite records: persist alerts
- FastAPI gateway → SQLite records: read records
- SOC analyst → Dashboard app: view telemetry
- Dashboard app → FastAPI gateway: REST / WebSocket
- Dashboard app → Manual inspection: render panel
- Dashboard app → Alert feed: show alerts
- Dashboard app → Topology graph: show topology
- Dashboard app → Throughput chart: show metrics
- Dashboard app → Simulation controls: render controls
- Simulation controls → FastAPI gateway: trigger simulation
- SOC analyst → Manual inspection: inspect target
- Incident copilot → Groq API: request analysis