# vkg6835/signature-traffic-detector architecture

> Architecture diagram of the GitHub repository vkg6835/signature-traffic-detector, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/vkg6835/signature-traffic-detector
- Repository: https://github.com/vkg6835/signature-traffic-detector

## Overview

sigdetect is a command-line network-traffic detector: it loads threat indicators before reading a capture, parses packets into bidirectional conversations, extracts identifying fields, classifies each flow, and reports verdicts with a simulated IPS action. The graph includes the documented synthetic-capture generator as a separate optional capability. Main and feed orchestration are shown from the excerpts and README; some internal wiring is documented at module level rather than demonstrated in sampled call sites.

Main entry points: [`src/feeds/mod.rs`](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/feeds/mod.rs) (Feed loading), [`src/main.rs`](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/main.rs) (CLI runner), [`src/flow.rs`](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/flow.rs) (Flow assembly), [`src/detect.rs`](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/detect.rs) (Detection engine)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_run["Run orchestration"]
  node_config["Config and key<br/>[config.rs]"]
  node_cli["CLI runner<br/>[main.rs]"]
end

subgraph group_intel["Threat intelligence"]
  node_feed_manager["Feed loading<br/>[mod.rs]"]
  node_urlhaus["URLhaus adapter<br/>[urlhaus.rs]"]
  node_threatfox["ThreatFox adapter<br/>[threatfox.rs]"]
  node_cache[("Feed cache<br/>[mod.rs]")]
  node_local_rules["Local indicators<br/>[local_rules.json]"]
  node_offline_signatures["Offline signatures"]
  node_signature_set["Signature set<br/>[ioc.rs]"]
end

subgraph group_traffic["Traffic analysis"]
  node_pcap_reader["PCAP reader<br/>[pcap.rs]"]
  node_packet_parser["Packet parser<br/>[packet.rs]"]
  node_flow_assembly["Flow assembly<br/>[flow.rs]"]
  node_app_fields["Protocol fields<br/>[appproto.rs]"]
end

subgraph group_verdict["Classification and reporting"]
  node_engine["Detection engine<br/>[detect.rs]"]
  node_reporter["Report output<br/>[report.rs]"]
end

subgraph group_synthetic["Synthetic capture"]
  node_generator_cli["Generator CLI<br/>[gen_pcap.rs]"]
  node_synth["Capture synthesis<br/>[synth.rs]"]
end

node_operator(("Operator"))
node_capture_file["PCAP file"]
node_abusech["abuse.ch feeds"]
node_report_file["JSON report"]

node_operator -->|"runs"| node_cli
node_cli -->|"loads config"| node_config
node_cli -->|"loads indicators"| node_feed_manager
node_config -->|"provides key"| node_feed_manager
node_feed_manager -->|"fetches URLs"| node_urlhaus
node_feed_manager -->|"fetches IOCs"| node_threatfox
node_urlhaus -->|"requests feed"| node_abusech
node_threatfox -->|"requests feed"| node_abusech
node_feed_manager -->|"reads and writes"| node_cache
node_feed_manager -->|"loads indicators"| node_local_rules
node_feed_manager -->|"fallback loads"| node_offline_signatures
node_feed_manager -->|"builds set"| node_signature_set
node_cli -->|"opens capture"| node_pcap_reader
node_capture_file -->|"provides bytes"| node_pcap_reader
node_pcap_reader -->|"parses frames"| node_packet_parser
node_cli -->|"adds packets"| node_flow_assembly
node_packet_parser -->|"provides packets"| node_flow_assembly
node_flow_assembly -->|"extracts fields"| node_app_fields
node_cli -->|"classifies flows"| node_engine
node_flow_assembly -->|"provides flows"| node_engine
node_signature_set -->|"matches indicators"| node_engine
node_cli -->|"builds report"| node_reporter
node_engine -->|"provides verdicts"| node_reporter
node_reporter -->|"writes JSON"| node_report_file
node_operator -.->|"runs optionally"| node_generator_cli
node_generator_cli -.->|"loads indicators"| node_feed_manager
node_generator_cli -.->|"builds capture"| node_synth
node_signature_set -.->|"selects targets"| node_synth
node_synth -.->|"writes PCAP"| node_capture_file

click node_config "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/config.rs"
click node_cli "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/main.rs"
click node_feed_manager "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/feeds/mod.rs"
click node_urlhaus "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/feeds/urlhaus.rs"
click node_threatfox "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/feeds/threatfox.rs"
click node_cache "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/feeds/mod.rs"
click node_local_rules "https://github.com/vkg6835/signature-traffic-detector/blob/main/data/local_rules.json"
click node_offline_signatures "https://github.com/vkg6835/signature-traffic-detector/blob/main/data/offline_signatures.json"
click node_signature_set "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/ioc.rs"
click node_pcap_reader "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/pcap.rs"
click node_packet_parser "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/packet.rs"
click node_flow_assembly "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/flow.rs"
click node_app_fields "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/appproto.rs"
click node_engine "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/detect.rs"
click node_reporter "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/report.rs"
click node_generator_cli "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/bin/gen_pcap.rs"
click node_synth "https://github.com/vkg6835/signature-traffic-detector/blob/main/src/synth.rs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_config,node_cli toneBlue
class node_feed_manager,node_urlhaus,node_threatfox,node_cache,node_local_rules,node_offline_signatures,node_signature_set toneAmber
class node_pcap_reader,node_packet_parser,node_flow_assembly,node_app_fields toneMint
class node_engine,node_reporter toneRose
class node_generator_cli,node_synth,node_operator,node_capture_file,node_abusech,node_report_file toneIndigo
```

## Components

### Run orchestration

- [Config and key](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/config.rs): `src/config.rs`
- [CLI runner](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/main.rs): `src/main.rs`

### Threat intelligence

- [Feed loading](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/feeds/mod.rs): `src/feeds/mod.rs`
- [URLhaus adapter](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/feeds/urlhaus.rs): `src/feeds/urlhaus.rs`
- [ThreatFox adapter](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/feeds/threatfox.rs): `src/feeds/threatfox.rs`
- [Feed cache](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/feeds/mod.rs): `src/feeds/mod.rs`
- [Local indicators](https://github.com/vkg6835/signature-traffic-detector/blob/main/data/local_rules.json): `data/local_rules.json`
- [Offline signatures](https://github.com/vkg6835/signature-traffic-detector/blob/main/data/offline_signatures.json): `data/offline_signatures.json`
- [Signature set](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/ioc.rs): `src/ioc.rs`

### Traffic analysis

- [PCAP reader](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/pcap.rs): `src/pcap.rs`
- [Packet parser](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/packet.rs): `src/packet.rs`
- [Flow assembly](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/flow.rs): `src/flow.rs`
- [Protocol fields](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/appproto.rs): `src/appproto.rs`

### Classification and reporting

- [Detection engine](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/detect.rs): `src/detect.rs`
- [Report output](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/report.rs): `src/report.rs`

### Synthetic capture

- [Generator CLI](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/bin/gen_pcap.rs): `src/bin/gen_pcap.rs`
- [Capture synthesis](https://github.com/vkg6835/signature-traffic-detector/blob/main/src/synth.rs): `src/synth.rs`

### Other components

- **Operator**
- **PCAP file**
- **abuse.ch feeds**
- **JSON report**

## Connections

- Operator → CLI runner: runs
- CLI runner → Config and key: loads config
- CLI runner → Feed loading: loads indicators
- Config and key → Feed loading: provides key
- Feed loading → URLhaus adapter: fetches URLs
- Feed loading → ThreatFox adapter: fetches IOCs
- URLhaus adapter → abuse.ch feeds: requests feed
- ThreatFox adapter → abuse.ch feeds: requests feed
- Feed loading → Feed cache: reads and writes
- Feed loading → Local indicators: loads indicators
- Feed loading → Offline signatures: fallback loads
- Feed loading → Signature set: builds set
- CLI runner → PCAP reader: opens capture
- PCAP file → PCAP reader: provides bytes
- PCAP reader → Packet parser: parses frames
- CLI runner → Flow assembly: adds packets
- Packet parser → Flow assembly: provides packets
- Flow assembly → Protocol fields: extracts fields
- CLI runner → Detection engine: classifies flows
- Flow assembly → Detection engine: provides flows
- Signature set → Detection engine: matches indicators
- CLI runner → Report output: builds report
- Detection engine → Report output: provides verdicts
- Report output → JSON report: writes JSON
- Operator → Generator CLI: runs optionally
- Generator CLI → Feed loading: loads indicators
- Generator CLI → Capture synthesis: builds capture
- Signature set → Capture synthesis: selects targets
- Capture synthesis → PCAP file: writes PCAP