Upload 20 files

.dockerignore

@@ -0,0 +1,7 @@
+__pycache__
+*.pyc
+.env
+.git
+venv
+env
+.DS_Store

.env

@@ -0,0 +1 @@
+GROQ_API_KEY='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'

.gitignore

@@ -0,0 +1,5 @@
+.venv
+__pycache__/
+*.pyc
+instance/
+data/

blockchain/blockchain.py

@@ -0,0 +1,386 @@
+import streamlit as st
+import pandas as pd
+import json
+import os
+import sys
+from pathlib import Path
+import graphviz
+from typing import List, Optional
+import io
+
+ROOT = Path(__file__).resolve().parent.parent  # Project root
+ALT = ROOT  # Use project root instead of /mnt/data
+UPLOAD_DIR = ALT / "uploads"
+UPLOAD_DIR.mkdir(parents=True, exist_ok=True)
+
+# Make sure your merkle module is importable
+if str(ROOT / "Merkle_tree") not in sys.path:
+    sys.path.append(str(ROOT / "Merkle_tree"))
+
+# Import your Merkle utilities
+try:
+    from merkle_ledger import MerkleTree, ThreatLogEntry, sha256_hex
+except Exception as e:
+    st.warning("Could not import merkle_ledger module. Make sure merkle_ledger.py is in the same folder.")
+    st.stop()
+
+st.set_page_config(page_title="Blockchain Demo (Sidebar Nav)", layout="wide")
+st.title("🔐 Blockchain & IDS Demo")
+
+# ----------------- Utility: safe timestamp parsing -----------------
+def parse_timestamp_safe(ts) -> Optional[object]:
+    """
+    Accepts: None, empty, string, pandas.Timestamp, datetime.
+    Returns: datetime (python) or None.
+    """
+    if ts is None:
+        return None
+    try:
+        if pd.isna(ts):
+            return None
+    except Exception:
+        pass
+    if hasattr(ts, "isoformat"):
+        return ts
+    if isinstance(ts, pd.Timestamp):
+        try:
+            return ts.to_pydatetime()
+        except Exception:
+            return None
+    if isinstance(ts, str):
+        s = ts.strip()
+        if s == "":
+            return None
+        try:
+            return pd.to_datetime(s).to_pydatetime()
+        except Exception:
+            return None
+    return None
+
+def df_to_entries_safe(df: pd.DataFrame) -> List[ThreatLogEntry]:
+    entries = []
+    for _, r in df.iterrows():
+        ts_parsed = parse_timestamp_safe(r.get("timestamp", None))
+        try:
+            entry = ThreatLogEntry.create(
+                flow_id=str(r.get("flow_id", "")),
+                attack_label=str(r.get("attack_label", "")),
+                severity=float(r.get("severity", 0.0)) if pd.notna(r.get("severity", None)) else 0.0,
+                src_ip=str(r.get("src_ip", "")),
+                dst_ip=str(r.get("dst_ip", "")),
+                action=str(r.get("action", "")),
+                timestamp=ts_parsed
+            )
+        except Exception as e:
+            st.error(f"Failed to create ThreatLogEntry for row {_}: {e}")
+            raise
+        entries.append(entry)
+    return entries
+
+# ----------------- Sidebar navigation -----------------
+page = st.sidebar.radio("📑 Pages", ["Merkle Playground", "Upload Logs", "Blockchain Explorer"])
+
+# ----------------- Page 1: Merkle Playground -----------------
+if page == "Merkle Playground":
+    st.header("🌳 Merkle Playground")
+    st.write("Edit a small set of logs, build a Merkle tree, then verify to detect tampering.")
+    
+    n_leaves = st.slider("Number of leaves", min_value=4, max_value=16, value=8)
+
+    def make_sample(i):
+        e = ThreatLogEntry.create(
+            flow_id=f"flow_{i+1}",
+            attack_label="Benign" if i % 3 == 0 else "DoS Hulk" if i % 3 == 1 else "PortScan",
+            severity=round(0.1 + (i % 10) * 0.07, 2),
+            src_ip=f"10.0.0.{(i % 6) + 1}",
+            dst_ip=f"192.168.0.{(i % 10) + 1}",
+            action="",
+        )
+        return {
+            "timestamp": e.timestamp,
+            "flow_id": e.flow_id,
+            "attack_label": e.attack_label,
+            "severity": e.severity,
+            "src_ip": e.src_ip,
+            "dst_ip": e.dst_ip,
+            "action": e.action,
+        }
+
+    # Init dataset
+    if "merkle_df" not in st.session_state:
+        st.session_state.merkle_df = pd.DataFrame([make_sample(i) for i in range(n_leaves)])
+
+    if len(st.session_state.merkle_df) != n_leaves:
+        st.session_state.merkle_df = pd.DataFrame([make_sample(i) for i in range(n_leaves)])
+
+    try:
+        orig_entries = df_to_entries_safe(st.session_state.merkle_df)
+    except Exception:
+        st.error("Error converting rows to ThreatLogEntry.")
+        st.stop()
+
+    orig_leaf_hashes = [sha256_hex(e.to_canonical_string()) for e in orig_entries]
+    orig_tree = MerkleTree([e.to_canonical_string() for e in orig_entries])
+
+    # ---------------- GRAPH FIRST ----------------
+    st.markdown("### 🌲 Merkle Tree Visualization")
+    try:
+        dot = graphviz.Digraph()
+        dot.attr(rankdir="TB", size="14,10")
+        dot.attr("node", style="filled", fontname="Helvetica", fontsize="11")
+        dot.attr("edge", penwidth="2.5", color="#555555")
+
+        levels = orig_tree.levels
+        colors = ["#90EE90", "#87CEEB", "#FFB6C1", "#FFA07A", "#FF6B6B"]
+
+        for lvl_idx, level in enumerate(levels):
+            color = colors[min(lvl_idx, len(colors) - 1)]
+            for pos, h in enumerate(level):
+                node = f"n_{lvl_idx}_{pos}"
+                label = f"{h[:12]}...\\nLevel {lvl_idx} | Pos {pos}"
+
+                if lvl_idx == len(levels) - 1:
+                    dot.node(
+                        node,
+                        label=label,
+                        shape="box",
+                        fillcolor="#FF4444",
+                        fontcolor="white",
+                        penwidth="4",
+                        style="filled,bold",
+                    )
+                else:
+                    dot.node(node, label=label, shape="box", fillcolor=color, fontcolor="#333333", penwidth="2")
+
+        for lvl_idx in range(len(levels) - 1):
+            for pos in range(len(levels[lvl_idx])):
+                dot.edge(
+                    f"n_{lvl_idx}_{pos}",
+                    f"n_{lvl_idx+1}_{pos//2}",
+                    color=colors[min(lvl_idx + 1, len(colors) - 1)],
+                )
+
+        st.graphviz_chart(dot, use_container_width=True)
+
+    except Exception as e:
+        st.warning(f"Tree visualization failed: {e}")
+        st.write("Levels:", orig_tree.levels)
+
+    # ---------------- ROOT AFTER GRAPH ----------------
+    st.markdown("### 🔑 Original Merkle Root")
+    st.code(orig_tree.root, language="text")
+
+    # ---------------- EDIT TABLE BELOW GRAPH ----------------
+    st.markdown("### ✏️ Edit Entries")
+    edited = st.data_editor(
+        st.session_state.merkle_df,
+        num_rows="dynamic",
+        use_container_width=True,
+        key="editor",
+    )
+
+    # ---------------- SUMMARY ----------------
+    st.markdown("### 📊 Summary")
+    col1, col2, col3 = st.columns(3)
+    with col1:
+        st.metric("Total Leaves", len(orig_entries))
+    with col2:
+        st.metric("Tree Depth", len(orig_tree.levels))
+    with col3:
+        st.metric("Root Hash (short)", orig_tree.root[:16] + "...")
+
+    st.markdown("---")
+
+    # ---------------- VERIFICATION ----------------
+    if st.button("🔍 Verify Edits", type="primary"):
+
+        try:
+            new_entries = df_to_entries_safe(edited)
+        except Exception:
+            st.error("Invalid timestamps or formatting.")
+            st.stop()
+
+        new_hashes = [sha256_hex(e.to_canonical_string()) for e in new_entries]
+        new_tree = MerkleTree([e.to_canonical_string() for e in new_entries])
+        tampered = new_tree.root != orig_tree.root
+
+        changed = [i for i, (a, b) in enumerate(zip(orig_leaf_hashes, new_hashes)) if a != b]
+
+        col1, col2 = st.columns(2)
+        with col1:
+            st.write("**Original root:**")
+            st.code(orig_tree.root)
+        with col2:
+            st.write("**New root:**")
+            st.code(new_tree.root)
+
+        if tampered:
+            st.error(f"⚠️ TAMPERED — Changed leaf indices: {changed}")
+
+            highlighted = edited.copy()
+            highlighted["_tampered"] = ["✓ YES" if i in changed else "" for i in range(len(highlighted))]
+
+            st.dataframe(
+                highlighted.style.apply(
+                    lambda row: [
+                        "background-color: #ffdddd" if row.name in changed else "" for _ in row
+                    ],
+                    axis=1,
+                ),
+                use_container_width=True,
+            )
+
+        else:
+            st.success("✅ No tampering detected. Roots match!")
+            st.dataframe(edited, use_container_width=True)
+
+# ----------------- Page 2: Upload -----------------
+elif page == "Upload Logs":
+    st.header("📤 Upload Logs")
+    st.write("Upload a logs file and it will be saved to the uploads folder.")
+    
+    upload = st.file_uploader("Upload CSV or JSON logs", type=["csv", "json", "txt"], accept_multiple_files=False)
+    if upload is not None:
+        save_path = UPLOAD_DIR / upload.name
+        with open(save_path, "wb") as f:
+            f.write(upload.getbuffer())
+        st.success(f"✅ Saved upload to: `{save_path}`")
+        st.info("💡 Use Explorer or Merkle Playground to work with this file later.")
+
+# ----------------- Page 3: Explorer -----------------
+elif page == "Blockchain Explorer":
+    st.header("🔍 Blockchain Explorer")
+    
+    ledger_path = ALT / "blockchain_ledger.json"
+    summary_csv = ALT / "blockchain_blocks_summary.csv"
+    
+    if not ledger_path.exists():
+        st.warning(f"⚠️ No ledger found at `{ledger_path.name}`. You can upload one below.")
+        uploaded_ledger = st.file_uploader("Upload ledger JSON", type=["json"], key="ledger_upload")
+        if uploaded_ledger is not None:
+            try:
+                ledger_json = json.load(uploaded_ledger)
+                with open(ledger_path, "w", encoding="utf-8") as f:
+                    json.dump(ledger_json, f, indent=2)
+                st.success(f"✅ Ledger saved to {ledger_path}")
+                st.rerun()
+            except Exception as e:
+                st.error(f"❌ Failed to save ledger: {e}")
+    else:
+        try:
+            with open(ledger_path, "r", encoding="utf-8") as f:
+                ledger = json.load(f)
+            blocks = ledger.get("blocks", [])
+            
+            if not blocks:
+                st.info("ℹ️ Ledger exists but contains no blocks.")
+            else:
+                # Blocks table
+                rows = []
+                for b in blocks:
+                    idx = b.get("index")
+                    batch = b.get("batch", {})
+                    rows.append({
+                        "Index": idx,
+                        "Batch ID": batch.get("batch_id"),
+                        "Merkle Root": batch.get("merkle_root", "")[:16] + "...",
+                        "Entries": batch.get("entry_count"),
+                        "Sealed At": b.get("created_at"),
+                        "Block Hash": b.get("block_hash", "")[:16] + "...",
+                    })
+                
+                df_blocks = pd.DataFrame(rows)
+                st.markdown("### 📦 Blocks")
+                st.dataframe(df_blocks, use_container_width=True)
+                
+                # Chain validation
+                st.markdown("### ✅ Chain Validation")
+                validity = []
+                last_hash = ""
+                chain_ok = True
+
+                def batch_dict_to_canonical(batch: dict) -> str:
+                    # Reconstruct the same canonical string used by Block.create -> MerkleBatch.to_canonical_string
+                    # Note: batch dict fields must match the names used when the ledger was saved.
+                    return "|".join(
+                        [
+                            str(batch.get("batch_id", "")),
+                            str(batch.get("sealed_at", "")),
+                            str(batch.get("merkle_root", "")),
+                            str(batch.get("entry_count", "")),
+                            str(batch.get("signature", "")),
+                        ]
+                    )
+
+                for b in blocks:
+                    batch = b.get("batch", {})
+                    # Recreate canonical header exactly as Block.create does:
+                    header = "|".join(
+                        [
+                            str(b.get("index")),
+                            batch_dict_to_canonical(batch),
+                            str(b.get("prev_block_hash", "")),
+                            str(b.get("created_at", "")),
+                        ]
+                    )
+                    expected_hash = sha256_hex(header)
+                    ok = expected_hash == b.get("block_hash")
+                    prev_ok = (b.get("prev_block_hash") == last_hash) if last_hash != "" else True
+                    validity.append({
+                        "Index": b.get("index"),
+                        "Hash Valid": "✅" if ok else "❌",
+                        "Prev Link Valid": "✅" if prev_ok else "❌"
+                    })
+                    last_hash = b.get("block_hash")
+                    if not ok or not prev_ok:
+                        chain_ok = False
+
+                if chain_ok:
+                    st.success("✅ Chain is valid!")
+                else:
+                    st.error("❌ Chain integrity compromised!")
+
+                st.dataframe(pd.DataFrame(validity), use_container_width=True)
+                
+                
+                # Block viewer
+                st.markdown("### 🔎 Block Viewer")
+                idx_choice = st.number_input("Block index to view", min_value=1, max_value=len(blocks), value=1, step=1)
+                chosen = next((b for b in blocks if b.get("index") == int(idx_choice)), None)
+                
+                if chosen:
+                    st.json(chosen)
+                    
+                    pub = ledger.get("public_key_pem")
+                    if pub:
+                        with st.expander("🔐 Public Key (PEM)"):
+                            st.code(pub, language="text")
+                    
+                    if st.button("💾 Download this block JSON"):
+                        st.download_button(
+                            "Download block",
+                            data=json.dumps(chosen, indent=2),
+                            file_name=f"block_{chosen.get('index')}.json",
+                            mime="application/json"
+                        )
+        except Exception as e:
+            st.error(f"❌ Failed to read ledger: {e}")
+    
+    # Summary CSV
+    if summary_csv.exists():
+        st.markdown("---")
+        st.markdown("### 📊 Blocks Summary CSV")
+        try:
+            df_summary = pd.read_csv(summary_csv)
+            st.dataframe(df_summary.head(200), use_container_width=True)
+            
+            if st.button("💾 Download blocks summary CSV"):
+                with open(summary_csv, "rb") as f:
+                    st.download_button(
+                        "Download summary CSV",
+                        data=f,
+                        file_name="blockchain_blocks_summary.csv",
+                        mime="text/csv"
+                    )
+        except Exception as e:
+            st.error(f"❌ Failed to read summary CSV: {e}")

blockchain/blockchain_blocks_summary.csv

@@ -0,0 +1,30 @@
+block_index,batch_id,merkle_root,entry_count,sealed_at,block_hash,prev_block_hash
+1,2,6acfafddf5baf13ac165d3f20c75b67dbc1815e3962443c43f21c9905d177083,10000,2025-11-22T19:16:57Z,a45bd4fbbd550dec8538364d712fe215f3a576877458ffe85e588a0ccdbcf997,
+2,3,186449fff72c5a7bf962fbe6354a8481e7330dc0884fb0ab5db49bbcf513676e,10000,2025-11-22T19:16:57Z,64dc1768c2e5560d895aaa6bcb0f8fba0a4fc8be45156e6415ee643c38fd1b6a,a45bd4fbbd550dec8538364d712fe215f3a576877458ffe85e588a0ccdbcf997
+3,4,bb896cf321529c5e41dc71e508849890fcac031b4eebea67fc4271a08bd76803,10000,2025-11-22T19:16:58Z,c1ca2d8004cd922e26980fb407e0a58e226d7d4a24e1d03cd8629f81acccc708,64dc1768c2e5560d895aaa6bcb0f8fba0a4fc8be45156e6415ee643c38fd1b6a
+4,5,865ddfb1f70f486526ac9918d53f45b8de042bdad764286703ef9715646c0317,10000,2025-11-22T19:16:58Z,194f00146556d1772a906f7eb310743cff6c31519714e8158bbeccef5883cc7b,c1ca2d8004cd922e26980fb407e0a58e226d7d4a24e1d03cd8629f81acccc708
+5,6,21f3c7716b135d92f4ff7aeed4433e3146c24a67b2302a1436a5d924ac2379aa,10000,2025-11-22T19:16:58Z,faa11268c8f982c10e273aa721cb968c957767b5b23befebf5f1ad3679b5355b,194f00146556d1772a906f7eb310743cff6c31519714e8158bbeccef5883cc7b
+6,7,40d0aeefc769dd4b29618933450f0c92a6dc0c216b84f0e04ede7eec579be004,10000,2025-11-22T19:16:58Z,829849616cbc1923a1607930915a5c885a4dc4d72979e6d431e88190d6a780cb,faa11268c8f982c10e273aa721cb968c957767b5b23befebf5f1ad3679b5355b
+7,8,23132677c6725042d04ae403c5b51d79aa210ccb77ecb6bc872d7a5c1f45427e,10000,2025-11-22T19:16:59Z,fd349f81c5e25715d69405149c6db89ba9d1a556c6b66d15fdc9aaef57b6f6d3,829849616cbc1923a1607930915a5c885a4dc4d72979e6d431e88190d6a780cb
+8,9,97b4b53d92e027260779a3a0497fb478a0a7758055d97f57a50c8428ab7f6623,10000,2025-11-22T19:16:59Z,df3f2aaed6aad904cd8acf59d34d50290f29c83e27acbd2c5bbfa83e0187634b,fd349f81c5e25715d69405149c6db89ba9d1a556c6b66d15fdc9aaef57b6f6d3
+9,10,08c50fa39bdc316519fc833b0298c0f57588175bd758f46995b7962d18ffdae5,10000,2025-11-22T19:16:59Z,4bee927e6c99969b786dbba0683085af6538bd505853ffc40bbcf5d4a636787c,df3f2aaed6aad904cd8acf59d34d50290f29c83e27acbd2c5bbfa83e0187634b
+10,11,1e30e4933dffabb042c48fc63c4a4e4d0354cc69f0b4ad68a07ee34246512c59,10000,2025-11-22T19:17:00Z,2e31a182778accc2a0ccb798eb6d7a427a8ea250ca228aed76d96800bb29e346,4bee927e6c99969b786dbba0683085af6538bd505853ffc40bbcf5d4a636787c
+11,12,fb9bbb10b0ab3e17ec351237fb625c00a3fc05306138d597dad5fd51500f3a21,10000,2025-11-22T19:17:00Z,79b1584425440d085f6a023ae69b7836b9df6b1da617e2ca69a684a37234e01d,2e31a182778accc2a0ccb798eb6d7a427a8ea250ca228aed76d96800bb29e346
+12,13,b4b41031c11e05d451073a214d9cfc7d6a159de8e4f2ac2fac8f6b91b97eca6b,10000,2025-11-22T19:17:00Z,de2238a9ce0f32bea61e30e9e8f1983056fa150f6e39395372c7c914e87b07e3,79b1584425440d085f6a023ae69b7836b9df6b1da617e2ca69a684a37234e01d
+13,14,d0cdee06632777e094da1d6b6b5c7cfcb3af86daf546d915ad5bf39cfb2bbf47,10000,2025-11-22T19:17:01Z,c178ae13d6fffd822a63122c6ec07e871879306a2726ad358ac7aba9eef4340a,de2238a9ce0f32bea61e30e9e8f1983056fa150f6e39395372c7c914e87b07e3
+14,15,4d82fc97795ba932b1f271ed918ac4f5965a339787407453829518517987cd64,10000,2025-11-22T19:17:01Z,2525069c543260f8f208a0ef1a423fe7c36b8cffc2feab78c3124797503e51a1,c178ae13d6fffd822a63122c6ec07e871879306a2726ad358ac7aba9eef4340a
+15,16,8ef66e722ae0aad304a527c900513d9fdb1be47ff3351b01b89b8709cb282a05,10000,2025-11-22T19:17:01Z,583fc2a41a94aea3bf5a696f85e797e5153fbcda5bf412f6c27a437809424ea5,2525069c543260f8f208a0ef1a423fe7c36b8cffc2feab78c3124797503e51a1
+16,17,dd429836c08376bed6e9425d9b149fd270efa31732ddfc34b7077ce63e996003,10000,2025-11-22T19:17:02Z,abe5dbb5abafbd3704f8fa1bf394967eab912766fe8206fc811a52b86cba729d,583fc2a41a94aea3bf5a696f85e797e5153fbcda5bf412f6c27a437809424ea5
+17,18,5663054ef7f12bd5ed66cac5ce8ad974552f71fd8e39f179efbdd0047fef2769,10000,2025-11-22T19:17:02Z,0595e6027a5e2fbaec115c75d22f850689102ac45ff0ea19cfbc1d7a0b1e60af,abe5dbb5abafbd3704f8fa1bf394967eab912766fe8206fc811a52b86cba729d
+18,19,b97f2490f8e743851dae9aa89fd797e6ce88a643b22e2870bee5ee20f3ebfcda,10000,2025-11-22T19:17:02Z,75f0a6b245f6c9f9e6679325c051ef5fc3ae42f571c901f18a9a40db27b9c5bb,0595e6027a5e2fbaec115c75d22f850689102ac45ff0ea19cfbc1d7a0b1e60af
+19,20,7a3a09ac28fc14bf15e9f55fb6a188ba144593d14830b45e6b841a56f32f9a2e,10000,2025-11-22T19:17:03Z,a7de9e1275cc4736cf92933da9e2d9eac0c20d4dd5d6cee5631e321e70581a73,75f0a6b245f6c9f9e6679325c051ef5fc3ae42f571c901f18a9a40db27b9c5bb
+20,21,4f92611d565d047d4e2cb41e767ffcafe939a08172342176d0cb44e5c6e79b5b,10000,2025-11-22T19:17:03Z,4ff895d62dced30f43ca3461607b4d644c345f55dcab3e7b439369290c7bad0c,a7de9e1275cc4736cf92933da9e2d9eac0c20d4dd5d6cee5631e321e70581a73
+21,22,253fd455b73d3d0afd62f034f7b0e1b62cf73265377ef874c182a783ae1d1d19,10000,2025-11-22T19:17:03Z,61ba62b8d5192635792183e6004eb8bf7b8cc30af5f440f24c3db83d2aa2874e,4ff895d62dced30f43ca3461607b4d644c345f55dcab3e7b439369290c7bad0c
+22,23,39dc01050c07e6812b36572f0c17183b6bd6ede6ce126108e6e2e19b33458bd8,10000,2025-11-22T19:17:04Z,e14fe45413eb9cf5b094bc739e0bba0806a867c6ec4acb301caf2a4f35978a11,61ba62b8d5192635792183e6004eb8bf7b8cc30af5f440f24c3db83d2aa2874e
+23,24,1eef7d2939cdab5e8f1754f0d16d2c200fbeb63ba53a6c18ee04bad5fde7224e,10000,2025-11-22T19:17:04Z,01052c7193fedcf1f9f8fb2932699e9620cfe0485f30200fadb0c241e81f5db5,e14fe45413eb9cf5b094bc739e0bba0806a867c6ec4acb301caf2a4f35978a11
+24,25,f2db360b97eee849554925281f986af7deae46ca73289fb9ba2e76b22a01be6e,10000,2025-11-22T19:17:04Z,4a10e731d51d2d8f19da1da6f3a0a7181c9bf0665f41f3cce28f21220a8800a1,01052c7193fedcf1f9f8fb2932699e9620cfe0485f30200fadb0c241e81f5db5
+25,26,4c8b0541e6658c76a8847640ceab221c09e3d4e4e2e122cfe2dfb334d7dc5141,10000,2025-11-22T19:17:05Z,a02a76c97cdee3338e011c75eb812e417d8ab8deecd337bc63dc1d0cab7c3279,4a10e731d51d2d8f19da1da6f3a0a7181c9bf0665f41f3cce28f21220a8800a1
+26,27,5b1ad6a115f9edf1bc992160d212b502e3f35472fb4c306c1d21e1f54e73f782,10000,2025-11-22T19:17:05Z,0e43b0b3e902f69eadb068e53243298a5229155f0ecb76e0dda6d6ddc3516e11,a02a76c97cdee3338e011c75eb812e417d8ab8deecd337bc63dc1d0cab7c3279
+27,28,63231a181eb5585ef114d3c076d78977dfe49941b8ee918d5ea83406084d7b66,10000,2025-11-22T19:17:05Z,a4bb71d882bdbbc97aca798903d0c30cead1078b9810162b33ea06a646167be3,0e43b0b3e902f69eadb068e53243298a5229155f0ecb76e0dda6d6ddc3516e11
+28,29,894cac81366f977d3e57e13c2d4c97be976758ecdd160c3553f158a7bf25d6b6,10000,2025-11-22T19:17:06Z,eea819511c1ce3cf3e43e209d90d581b09985c1691344f288ed420d3a1c5c1e1,a4bb71d882bdbbc97aca798903d0c30cead1078b9810162b33ea06a646167be3
+29,30,c870566a387d06dfd75f2d78dd67e016233da1588cfcaebe51925109a1c13930,10000,2025-11-22T19:17:06Z,62965f0f9385c18691826f11315a82394da1355200ce3edb99a2a1472e5f8583,eea819511c1ce3cf3e43e209d90d581b09985c1691344f288ed420d3a1c5c1e1

blockchain/blockchain_ledger.json

@@ -0,0 +1,385 @@
+{
+  "batch_size": 10000,
+  "open_entries": [],
+  "sealed_batch_count": 29,
+  "blocks": [
+    {
+      "index": 1,
+      "batch": {
+        "batch_id": 2,
+        "sealed_at": "2025-11-22T19:16:57Z",
+        "merkle_root": "6acfafddf5baf13ac165d3f20c75b67dbc1815e3962443c43f21c9905d177083",
+        "entry_count": 10000,
+        "signature": "orU8R+YqabMiruDXq/FlFKI6PVgD1y34Idurem9iG1Hlt08fjDpls0ehrA/fu+PqVSpIrAxhBIdUap1xNVHB8F0psYTeeXMdzz+M5Gh3Xb+jiJiuOqlMwswu6pEVLpcFCB3oVc+KF2/TG3eI3D9N3wMr07IuOxuBonwqcWvBoQCitwqvfes86Rtid6N8Rwx0pKtPkC4ijq/wKP210Zt/9NMEffeTMgFgyANJdR5C8PamSNEjKXspZWhZxWyQ3+9jQh94/UxyhU3nTYXMQWVgCMDrJvFw4D6ksIMS3UjbmK8g8SxNz4240cW5Xa5AO3AV8In1tCXFzQfOeq3Glzctvw=="
+      },
+      "prev_block_hash": "",
+      "block_hash": "a45bd4fbbd550dec8538364d712fe215f3a576877458ffe85e588a0ccdbcf997",
+      "created_at": "2025-11-22T19:16:57Z"
+    },
+    {
+      "index": 2,
+      "batch": {
+        "batch_id": 3,
+        "sealed_at": "2025-11-22T19:16:57Z",
+        "merkle_root": "186449fff72c5a7bf962fbe6354a8481e7330dc0884fb0ab5db49bbcf513676e",
+        "entry_count": 10000,
+        "signature": "J50WnUzke002+0p5Zs+GR1J8erIqeeLNkI8k8DiXQ1IU6ncIuLoIhXmgXtra3Z19RtCHpx3f8N+0MWEbZ8kc5+zentmi5PpZm049VW1hp7N0h+bP42iyKwO/zjGhAbtN0wdtN4557InnKLG1qXY40Ov1EafvBVgH4dcuc9vxhvh0aLhWYUOfPCPAjqs9+kdeCbY1BQLtpQsO5SuzOK9A9FgLdf6laFB6A/kGut28XRvInbNKWhLizUFkB8sngjlv6Qm9byxyzf6UJQs4OZMhUtfFo2MVy2qpLkLuWCNkvehp0AASG7rG8473ARZVFY5qth//NKnZB2aQv5JaXf8sYg=="
+      },
+      "prev_block_hash": "a45bd4fbbd550dec8538364d712fe215f3a576877458ffe85e588a0ccdbcf997",
+      "block_hash": "64dc1768c2e5560d895aaa6bcb0f8fba0a4fc8be45156e6415ee643c38fd1b6a",
+      "created_at": "2025-11-22T19:16:57Z"
+    },
+    {
+      "index": 3,
+      "batch": {
+        "batch_id": 4,
+        "sealed_at": "2025-11-22T19:16:58Z",
+        "merkle_root": "bb896cf321529c5e41dc71e508849890fcac031b4eebea67fc4271a08bd76803",
+        "entry_count": 10000,
+        "signature": "YDec8aW8DUXgXevdJsrN0yhLbKq1po5GpDY/5qnPSf2eXNtjd+NzU0DVWrsZhTwvV+36mkLOnSNGcD5UIUBvEN0A/GXTo3SNgrHaSQTmVfB1h/miD1L3aBnGBRdXjdU86KcOC2iJ/31YZW3M9po4jq2AebibGXFgmFLYZdeayR6SWI9nRPl+bNblHCTJAj9lIf1dGpu0AtjJN+qrx+K6/JxnHKcrL7IXBwrAbaa+sIRVNAyz0h5xF7sscrQXZxRpy8+uPRwpvjTOE2KILhJicWkf3iEJBXaIWbboAv7IIFnh2FQM+EN2IfgsLSt4Ny/9dMpweHXQXqkKquP8Hg0E4A=="
+      },
+      "prev_block_hash": "64dc1768c2e5560d895aaa6bcb0f8fba0a4fc8be45156e6415ee643c38fd1b6a",
+      "block_hash": "c1ca2d8004cd922e26980fb407e0a58e226d7d4a24e1d03cd8629f81acccc708",
+      "created_at": "2025-11-22T19:16:58Z"
+    },
+    {
+      "index": 4,
+      "batch": {
+        "batch_id": 5,
+        "sealed_at": "2025-11-22T19:16:58Z",
+        "merkle_root": "865ddfb1f70f486526ac9918d53f45b8de042bdad764286703ef9715646c0317",
+        "entry_count": 10000,
+        "signature": "kskDt/a+cwmSXxRDPqzRIR0Cj/1yKSzM1Xp9dh8BuheM1hkkkO5gn5scgxWeE2LNRjaKRZZ88u0GXofQLSVbALI4fSZc7ZTEi8g1nSB2WBvDHBlddizPWrLXPrDiu8xgSVirgU+7HCow7YhzVSdaW0Q5Kjvk7fvRbovb/fK9j0O70GFIXoYhFM3MoRVNRE/5l70gvp/0yodx3kg7oRkGIlE7ALfSYnZZaJYseEx4m/mQEVPkNygb4ELtC2CdfBdb2M+k6ktSxtYHTU/ZP2mUD0XTtrJ/Pp/ev8Skksa56O1CrEj1RxSSXbgjenWuCPLjhius83AyF2/7Dz1JEVEz0A=="
+      },
+      "prev_block_hash": "c1ca2d8004cd922e26980fb407e0a58e226d7d4a24e1d03cd8629f81acccc708",
+      "block_hash": "194f00146556d1772a906f7eb310743cff6c31519714e8158bbeccef5883cc7b",
+      "created_at": "2025-11-22T19:16:58Z"
+    },
+    {
+      "index": 5,
+      "batch": {
+        "batch_id": 6,
+        "sealed_at": "2025-11-22T19:16:58Z",
+        "merkle_root": "21f3c7716b135d92f4ff7aeed4433e3146c24a67b2302a1436a5d924ac2379aa",
+        "entry_count": 10000,
+        "signature": "Mz3BSvPmz0zqbv0jrcvm+kk9giegJfPNxen967tolEeL8V0X0cg02mhttDv1+pEsj8WOb3USmTacYsDU8uei3QTCTPsvJk/nml4ilAxa1XwWuk5x26ajrLm6mF+e8SH2Pj5wu19HtEX8FXPkdk15eEwNhzmTaZVdt3cazHmM5SHuhSnOm29zm6ew8flByHHzCbBPriPKIO6gKyLmkmSUJhwnq8AzQin4JEmFNvTgaxr9V23FnXLSn1BrXJ9T6BzV5YVtpZcaN7PNfqu1LjmQCUiDbuyb1BcNaTYtYB6r6uASixED4tz4GfX3tu5gnZTKTPg3OFHzrfqhS/j9z+mSZA=="
+      },
+      "prev_block_hash": "194f00146556d1772a906f7eb310743cff6c31519714e8158bbeccef5883cc7b",
+      "block_hash": "faa11268c8f982c10e273aa721cb968c957767b5b23befebf5f1ad3679b5355b",
+      "created_at": "2025-11-22T19:16:58Z"
+    },
+    {
+      "index": 6,
+      "batch": {
+        "batch_id": 7,
+        "sealed_at": "2025-11-22T19:16:58Z",
+        "merkle_root": "40d0aeefc769dd4b29618933450f0c92a6dc0c216b84f0e04ede7eec579be004",
+        "entry_count": 10000,
+        "signature": "LqAcCueD4c0Ze6LRrLBRGtFmIJ4ydVVzYX/yU7G/XIL0ji6ZhkhPeVhFDfmTmadFKvaLN6BDvTh+bFF8KElV7n9kRhy13yMQG9PGbuY7WZAFDb/C8iQXfXE4ElojcEkEyTY3za+Mfa9XDiCYzlG/3fUkc/s69jcuLzzcQHq+4+YHVU8lPne+Ea5C4hvs1Ld9i77K4SIWCjpaAOR1CAsJgF3lZAkk6LSuZ6GSiPiG3jGM1zSfk7iLoWKJEi4sKXFCP6GGt2Ddj7mzGUPc/EjhzAki4QJ5oNnzeYYqRZeCbEkw7tPQ+ArJt4BZ07WjqT/hIugtxdeNjl+UHUHjwYYuQg=="
+      },
+      "prev_block_hash": "faa11268c8f982c10e273aa721cb968c957767b5b23befebf5f1ad3679b5355b",
+      "block_hash": "829849616cbc1923a1607930915a5c885a4dc4d72979e6d431e88190d6a780cb",
+      "created_at": "2025-11-22T19:16:58Z"
+    },
+    {
+      "index": 7,
+      "batch": {
+        "batch_id": 8,
+        "sealed_at": "2025-11-22T19:16:59Z",
+        "merkle_root": "23132677c6725042d04ae403c5b51d79aa210ccb77ecb6bc872d7a5c1f45427e",
+        "entry_count": 10000,
+        "signature": "J3eVEMm8y1BshkvV9JDSpmMQPZD2uwPIpJPg0EauJeqSng5lR4QOiqnK11FucQmayI1WzNDnjGHZMaE1XbUctEwdOmTUY3ouQxKfkQ9gkIkxDgLUnbd6mYwk4aqP//DJaozJ9l5ZZ7i7A/j++R170lXmqYmbo5r5L0ijCLvAoA7RDKMADqM3U1pThND6JDnIP7Tu8XakLqJNnJ2M7KOIY/vm7w4xU72/iizA51OpokawsrPLVa1JTmFCLm/NIeQJNM9CLxl+uWoL0EVdIBDDaYpcaBBTBryIDlvl2dKGIiSSAs0bZpUqIt6wlcYmkc9xUukbCCZ5pSLLo8fqRQGPtg=="
+      },
+      "prev_block_hash": "829849616cbc1923a1607930915a5c885a4dc4d72979e6d431e88190d6a780cb",
+      "block_hash": "fd349f81c5e25715d69405149c6db89ba9d1a556c6b66d15fdc9aaef57b6f6d3",
+      "created_at": "2025-11-22T19:16:59Z"
+    },
+    {
+      "index": 8,
+      "batch": {
+        "batch_id": 9,
+        "sealed_at": "2025-11-22T19:16:59Z",
+        "merkle_root": "97b4b53d92e027260779a3a0497fb478a0a7758055d97f57a50c8428ab7f6623",
+        "entry_count": 10000,
+        "signature": "XgQVZGboCSrBvGgPWeVxVA0NwmQHlbQTJlaOtXnT0jD0C8WUui2Y/9mdzctQY2yjlPg7T9Lx+FUb1ypBgftlav1s80ZWMxInmq8DEBIokPtDjImZyT05QuYzmIh68R5+mDJU5ZcZ3AIHedmychvETJAWELsE4CMl7Ll/IN7KiC2xm9YtGkI70/0iQZJtLr2e1pLvigWfPCNUcPEY5U9R7kvLpLeqUxUnpLDnd0lf8TAkX8y5AWGuqHwZUE+2SWGkVkfuO37joCIMOpvIg2/l+ZsSeisNq6YelxMxg45BndyKTnY1sbctr8zBKfKbdg8B1etMSpMno8T4imTZRMfEsg=="
+      },
+      "prev_block_hash": "fd349f81c5e25715d69405149c6db89ba9d1a556c6b66d15fdc9aaef57b6f6d3",
+      "block_hash": "df3f2aaed6aad904cd8acf59d34d50290f29c83e27acbd2c5bbfa83e0187634b",
+      "created_at": "2025-11-22T19:16:59Z"
+    },
+    {
+      "index": 9,
+      "batch": {
+        "batch_id": 10,
+        "sealed_at": "2025-11-22T19:16:59Z",
+        "merkle_root": "08c50fa39bdc316519fc833b0298c0f57588175bd758f46995b7962d18ffdae5",
+        "entry_count": 10000,
+        "signature": "DSNgtLT0FW9IbuOXpS7HsOH6XENY+PFBsJPlRSUvf0IvkHvXBEkVwFSr0msJv0Xs0p4i1nc+bii857QaQs9svc2EBCCh/UhSwJeHTHDIRRRqwGFwv7L05Gh+IeDfQTpkNg2odvAfUgfC4nnwzYEZTDEeTjx0M4LJMDbE5Efrd7Dg6mcG1ZNrWhjffiSaSAlFgs8bvb0G5jTtghASPxVFHynUVWS/zkMLRzmKUpe3eQULQ0/jxXmrezrdgjQ79RWawzX6WksGuHqAP0maTlqwqLVcgC1acbPY3NQ7tctNjPif082joFjBECWvSgQqPUax5FT1/Xzc3h13qWIJWO7YTQ=="
+      },
+      "prev_block_hash": "df3f2aaed6aad904cd8acf59d34d50290f29c83e27acbd2c5bbfa83e0187634b",
+      "block_hash": "4bee927e6c99969b786dbba0683085af6538bd505853ffc40bbcf5d4a636787c",
+      "created_at": "2025-11-22T19:16:59Z"
+    },
+    {
+      "index": 10,
+      "batch": {
+        "batch_id": 11,
+        "sealed_at": "2025-11-22T19:17:00Z",
+        "merkle_root": "1e30e4933dffabb042c48fc63c4a4e4d0354cc69f0b4ad68a07ee34246512c59",
+        "entry_count": 10000,
+        "signature": "TMZiRx2AqJqQ31b85+IftfMkMYEbSxlPBflySVNDdYh8M9APW/u4PIlZdP2CSug5NgaDECtXmAEZl3uWyMbq55Lqq73+n820Lb9cwrPteCyqnMz2ns3uCn1eM+BptmX4OcWLkAHUKzaVZnrvC4fZFOMLsyIohD6NrwImcvz3yFJnA2N5+yAE8fP6/1XVrS7jqhjFzE8VhrKs8rMSuVNiKMuut3N7UTIIeD/geBqr10U/9zz0V85DmuNPaMZBMQb4Ixn4/hABgaexR8dEh7UeQRVxtRhQidUYrJ1h8X6ahwPpEtBUiqTbjr4HzbvPQti+zUfYmuZCZc10exA+t4UIYw=="
+      },
+      "prev_block_hash": "4bee927e6c99969b786dbba0683085af6538bd505853ffc40bbcf5d4a636787c",
+      "block_hash": "2e31a182778accc2a0ccb798eb6d7a427a8ea250ca228aed76d96800bb29e346",
+      "created_at": "2025-11-22T19:17:00Z"
+    },
+    {
+      "index": 11,
+      "batch": {
+        "batch_id": 12,
+        "sealed_at": "2025-11-22T19:17:00Z",
+        "merkle_root": "fb9bbb10b0ab3e17ec351237fb625c00a3fc05306138d597dad5fd51500f3a21",
+        "entry_count": 10000,
+        "signature": "D96d3nJIznUb32IImUAzAQTZGOxN7EIVmzMsajRsaJb4WfmqE7Lr/FvurZmP/bO15mMKJPBa4t7PA5hIp5ZaYc9LJRaC85Xx7AmOEyjS0WssZvqyZPuVfb/TutOFe7f6GUh4geOWNmkTegVLLhgu2TwpQ/c4E9In9DU7tjVlcFvhOvbGYPObZVLUmY5NtTPpQcLBh5DCT/owsZ7215FtWhJSeF9NXV70Nbv9m5MwLZjmirL4ydqFFWhzNImzY4YdCf4uKw1Y//KT589Cjj/rUvusTbGUT548sSIJENXPuqTj4OR8UZezR52GNHNgiYq9ioVkYCBQhJSPHHbtH/a4cw=="
+      },
+      "prev_block_hash": "2e31a182778accc2a0ccb798eb6d7a427a8ea250ca228aed76d96800bb29e346",
+      "block_hash": "79b1584425440d085f6a023ae69b7836b9df6b1da617e2ca69a684a37234e01d",
+      "created_at": "2025-11-22T19:17:00Z"
+    },
+    {
+      "index": 12,
+      "batch": {
+        "batch_id": 13,
+        "sealed_at": "2025-11-22T19:17:00Z",
+        "merkle_root": "b4b41031c11e05d451073a214d9cfc7d6a159de8e4f2ac2fac8f6b91b97eca6b",
+        "entry_count": 10000,
+        "signature": "hUBP3ok+wqBWpPeX2DKbH+Yfzb/Ly2al4tLfbo8B23CkaT/4sA5vje2nt0DzLifJ3s1IipOe3aqrvEp+kFUakfBHRNDR9RzforAfDB6+FVDMPD7+PyVgK+rkqhB3hAV3GRKE73bhP+OzwNp3xDaxka5qODHJj8efo1XMkOUa+1gw5BtmkNoDl12eW2OFCTctBuppwyKEmR4zpWUnNsxwVQF+yD95Wjt83NEWe8OVlvz9iegMOSyN9POzAEMSXzMNECu1mMVYLnrZw4K7p0d4nM3Gqy+QMTQhMsmiT3Bnnl/4J/ILQGX8wTYJkej2ti/EVKDgpfXnwnvVvKTzzQ1NtQ=="
+      },
+      "prev_block_hash": "79b1584425440d085f6a023ae69b7836b9df6b1da617e2ca69a684a37234e01d",
+      "block_hash": "de2238a9ce0f32bea61e30e9e8f1983056fa150f6e39395372c7c914e87b07e3",
+      "created_at": "2025-11-22T19:17:00Z"
+    },
+    {
+      "index": 13,
+      "batch": {
+        "batch_id": 14,
+        "sealed_at": "2025-11-22T19:17:01Z",
+        "merkle_root": "d0cdee06632777e094da1d6b6b5c7cfcb3af86daf546d915ad5bf39cfb2bbf47",
+        "entry_count": 10000,
+        "signature": "kozzJR+ykNTUesygy/tTXv8BTcQOY1CcmHORp2n+E5v6drSj2cy2NvEzpY1QW3LykTq+CR2h5faULv5h3Ntt54evmZJ91ovoXDI1JQgRw/TzH7OLs9mf2oWoNSZvUrKmduav+42upIIvg9OT0n5oBuiRspAtyZG4oNS/Jv8JddYCwXADSQrEUyZG5muhBkWiRP11Hx8X344i05k/s41zT9j+IUO+qH9Y/2wFY4NelB80sI4A3UgkaZzn1i0q5FrPv3pQ0vYdw8HllGAUHtLz8Qxt7nMpoSOCAFlIeInL++4z4orJLPIkWx2dmy1FOxq1OKU2Vh9U2SXZXau9NBZ7Iw=="
+      },
+      "prev_block_hash": "de2238a9ce0f32bea61e30e9e8f1983056fa150f6e39395372c7c914e87b07e3",
+      "block_hash": "c178ae13d6fffd822a63122c6ec07e871879306a2726ad358ac7aba9eef4340a",
+      "created_at": "2025-11-22T19:17:01Z"
+    },
+    {
+      "index": 14,
+      "batch": {
+        "batch_id": 15,
+        "sealed_at": "2025-11-22T19:17:01Z",
+        "merkle_root": "4d82fc97795ba932b1f271ed918ac4f5965a339787407453829518517987cd64",
+        "entry_count": 10000,
+        "signature": "KJvIz2DgoPMP5eMvz3GA2RLx6c45ZMnke8rTAFlIk/AW4qjGZZmA3BcIzAVqXrbaHnAi6JrHbTCrY1+g0DwBCU22GDp/heHcGoqXtZ06JPra2rbGHmznGK8847L9SsBca+wQ3J/nXBKWoMTT7PE2mewCJVf+7CJf0c+mwvHOhdy6Ll+DuKVmRVNlZnWow10uSXOUxmUYDdotkXgM4ZlY9/T3y5cyk3TIh3nloYD1J1ZHzMnoSY3+GX+t/cVqgEA5CkNY7vO/TKIC7EQtZow8+CwKRpCQOWyIzyJOOU1T+c8sYvRmlxhdP3YHZy+vLitLqxVDKM0kJgPrNU4Wzivv/Q=="
+      },
+      "prev_block_hash": "c178ae13d6fffd822a63122c6ec07e871879306a2726ad358ac7aba9eef4340a",
+      "block_hash": "2525069c543260f8f208a0ef1a423fe7c36b8cffc2feab78c3124797503e51a1",
+      "created_at": "2025-11-22T19:17:01Z"
+    },
+    {
+      "index": 15,
+      "batch": {
+        "batch_id": 16,
+        "sealed_at": "2025-11-22T19:17:01Z",
+        "merkle_root": "8ef66e722ae0aad304a527c900513d9fdb1be47ff3351b01b89b8709cb282a05",
+        "entry_count": 10000,
+        "signature": "Wi7N9XxVk+WFC0qDetxSoVvg0JzhurngKftKhIDvrEglLPZwYfZZbLP4I9vfgjsGJandxoVu7/jswvciBY8u7eYMccsHHXejwLvOl9eegRlGaPEFvfj+XK1sk/8wDZfNkp1B9h59qwVFkHv7XurPxA67jQ0XLR/wWRxlo3QGZzA59w9qY/JfY45vPfm8Yic0D+aePH45r/FGPjzJNy6GneJbS8+AXEY/9vbz0iQm1QwR5AhgKiy4PmOcpuQQ1qHpHVOmT3XROtg673opWRjW5RsE4RtDURgSWiiYsbPm94WEuXQ5Zy+ldl0RmOtWX8IAuuE2OAXqRP09NNVyUC9XTA=="
+      },
+      "prev_block_hash": "2525069c543260f8f208a0ef1a423fe7c36b8cffc2feab78c3124797503e51a1",
+      "block_hash": "583fc2a41a94aea3bf5a696f85e797e5153fbcda5bf412f6c27a437809424ea5",
+      "created_at": "2025-11-22T19:17:01Z"
+    },
+    {
+      "index": 16,
+      "batch": {
+        "batch_id": 17,
+        "sealed_at": "2025-11-22T19:17:02Z",
+        "merkle_root": "dd429836c08376bed6e9425d9b149fd270efa31732ddfc34b7077ce63e996003",
+        "entry_count": 10000,
+        "signature": "j+da5VuJpW6YfISCQzABBPZl9RyJrwqxv0LcLLPfen+2eloiMuudghqTDX1QhP3D//98YHdahqS3vNDALBV24nppH3bo7f/+Vl94xsK5t0tbloT4KOlV2DAppbGY+bRAirswB7wQwbsBcklZBezLePKsw3yWYygdH37f382Up3W+OUza2O0EjA/Lk289LDsha1yHKEspHVWglsQ6huqxtX28F/K/tc+CrfIVXkhhRojhP9jJsPwQ6nOF/eCqWDmUMIDK5/3K6UC0k7UD/iRgc1MzDGzrFkK9+GNR6eCh2xj+xKcNXgiq+w213nI7clRYX2U1lyVMwUxsrKEpyjLE0A=="
+      },
+      "prev_block_hash": "583fc2a41a94aea3bf5a696f85e797e5153fbcda5bf412f6c27a437809424ea5",
+      "block_hash": "abe5dbb5abafbd3704f8fa1bf394967eab912766fe8206fc811a52b86cba729d",
+      "created_at": "2025-11-22T19:17:02Z"
+    },
+    {
+      "index": 17,
+      "batch": {
+        "batch_id": 18,
+        "sealed_at": "2025-11-22T19:17:02Z",
+        "merkle_root": "5663054ef7f12bd5ed66cac5ce8ad974552f71fd8e39f179efbdd0047fef2769",
+        "entry_count": 10000,
+        "signature": "XBIT+qZxRYGkDmBCBhSAGvDr/FPW/2PeAfTll66hB13q0E8YW5KrT/LvZSN9SXPvoe07cTcMCYN/LRiGh101CCAkGdAf/ZX/AqStOmLjwA7MoFOyDwooLUVZ8vh+96vgQPdYU1mqW5a6+ZFV7p1+xxaQ1Bf22K0sHVUY5BMdLsqxACWAOIM+/Q3TwWlEisaYA/WT0E1P3D4BdaylrhxluODU8o6nWwFM+c/rJpb0e+Vie3TFlPqYdWMYnTQhPpYJbPMLwuumLh5tx0yNarvPADfGPlbVnLCEt+szuV3KkGuDB3wJz7Pd3ByNq6PXtPguNdf++wCdX7eY/7sl8t8aHQ=="
+      },
+      "prev_block_hash": "abe5dbb5abafbd3704f8fa1bf394967eab912766fe8206fc811a52b86cba729d",
+      "block_hash": "0595e6027a5e2fbaec115c75d22f850689102ac45ff0ea19cfbc1d7a0b1e60af",
+      "created_at": "2025-11-22T19:17:02Z"
+    },
+    {
+      "index": 18,
+      "batch": {
+        "batch_id": 19,
+        "sealed_at": "2025-11-22T19:17:02Z",
+        "merkle_root": "b97f2490f8e743851dae9aa89fd797e6ce88a643b22e2870bee5ee20f3ebfcda",
+        "entry_count": 10000,
+        "signature": "YfGjfWbWkUq0e5nE2wpW6xVqSFpQ+OGDdbnAy9d+2bEmQxEVO9/Yl/HxCPNFBgBuXKqBVMEACe9y/zOvo+SRL2lpW4EcMu5rMxOF2I6JQziWdfvF9GsJ4+ci9zy9BHj/lWYrlb1y6IVQqhnSIjB9Q5GH1gccguSLD5d4xBcTHa8XUHwiHlst+4+vV2dGnCKBJLO14EupV+1KTSMfSc1N49qDxEvVmkxtFalkqhhsZV2Dm0XqZ1ZUebWY2eZRdhYL0FxuumGMU6T5AuMfmg87EB94DXRCIT9Kr5JV/WICqaq6ucuIFOnS9fDwG+obThpsc0+9jG/elgZsZANenOSb4A=="
+      },
+      "prev_block_hash": "0595e6027a5e2fbaec115c75d22f850689102ac45ff0ea19cfbc1d7a0b1e60af",
+      "block_hash": "75f0a6b245f6c9f9e6679325c051ef5fc3ae42f571c901f18a9a40db27b9c5bb",
+      "created_at": "2025-11-22T19:17:02Z"
+    },
+    {
+      "index": 19,
+      "batch": {
+        "batch_id": 20,
+        "sealed_at": "2025-11-22T19:17:03Z",
+        "merkle_root": "7a3a09ac28fc14bf15e9f55fb6a188ba144593d14830b45e6b841a56f32f9a2e",
+        "entry_count": 10000,
+        "signature": "k0OyqOP5Qt2eiATYDKhiPg+JMLf/qOkfTTVBkqYkQF4bk34W6+rPeyhmKHzCmPV2EfNhf7NVJyM5VFSgjFpY4oYuq+mqx47JxtH9cq/kAT1Ua9uM8FwhgQWmTgxwLtyE1S//qP5ARjHdpY2SDZo5/IssFKX3QAiuW1ehv3lMnpMhPMTZgqrPHI1m5EIwTsaiL/KalBnmYIIhFaYvdfjKYirXb/Tmemw2GYmN3EUm4JJULoc6QKhs681fr3UK+C/rzq8SPAUVn0LsROVbO5NJuROa39vXMcovkt/XIO0eZU7nZOZ2ZTd8xZ4jcn6QnISMWV37/3wJ3ASfvjtJDR6Udg=="
+      },
+      "prev_block_hash": "75f0a6b245f6c9f9e6679325c051ef5fc3ae42f571c901f18a9a40db27b9c5bb",
+      "block_hash": "a7de9e1275cc4736cf92933da9e2d9eac0c20d4dd5d6cee5631e321e70581a73",
+      "created_at": "2025-11-22T19:17:03Z"
+    },
+    {
+      "index": 20,
+      "batch": {
+        "batch_id": 21,
+        "sealed_at": "2025-11-22T19:17:03Z",
+        "merkle_root": "4f92611d565d047d4e2cb41e767ffcafe939a08172342176d0cb44e5c6e79b5b",
+        "entry_count": 10000,
+        "signature": "Tl6nkPucuZaPzQQsaro6IJuprVcCYouDz0caZI60IRtkHtcPs2XAkxRh4kkfubvYAFnW0ootbbffM3ym1dMB3XopivTqwWn8fvOSomxxhVW/PNSJR8Czt1uVgWLCefLgDbNj+GsGxTS5iriWT2h/KiFHIxD2d9OUcGj4lLEOyuVbdsWWgHG48b3OZkfavRxqTmofbpPoP2tTkV+DA1hn9mgk/qH3+6VKQAcIdvXdpISaBSxUqoJLFfx0YUkpO4bjMf3EFFXHRkuPTdWeimNtgTD/lqMV0EL7EMiijBiipS6ySJyxUNi7OKwNm3cyCKAK1In75XrBwo8ABckE/ym9fA=="
+      },
+      "prev_block_hash": "a7de9e1275cc4736cf92933da9e2d9eac0c20d4dd5d6cee5631e321e70581a73",
+      "block_hash": "4ff895d62dced30f43ca3461607b4d644c345f55dcab3e7b439369290c7bad0c",
+      "created_at": "2025-11-22T19:17:03Z"
+    },
+    {
+      "index": 21,
+      "batch": {
+        "batch_id": 22,
+        "sealed_at": "2025-11-22T19:17:03Z",
+        "merkle_root": "253fd455b73d3d0afd62f034f7b0e1b62cf73265377ef874c182a783ae1d1d19",
+        "entry_count": 10000,
+        "signature": "ouPGDamyoFCenaEyGKY7HGH3BfJBNBJM4jPVyJkHZ1/Z06ONlLvvwov4T36qe8IDkX4gyMF08O0Eo8ijhpwHHBhtKGD/FMboXf9EJaQLak5QkP0/1Ibo4GNBcHkT8NzlAUCLagI+y6zAZyr37uOcJXziWJHaDz1sV06/WDFLG0NKSpz0+T46C23fujeDdrm+Y/Safcu8MIR67BZDma8d6ALusRlM+IXvqciyd/JfaCMYumtRaQayGetEhyFIus+UYLDRqo7s+v8Y4nJvqNaO6DBrrNv8QN9WNExLroS3f4Mob7gQY3AXJqFg8K9Vyg+EUc5eT8cth6F05sWRYZHlBw=="
+      },
+      "prev_block_hash": "4ff895d62dced30f43ca3461607b4d644c345f55dcab3e7b439369290c7bad0c",
+      "block_hash": "61ba62b8d5192635792183e6004eb8bf7b8cc30af5f440f24c3db83d2aa2874e",
+      "created_at": "2025-11-22T19:17:03Z"
+    },
+    {
+      "index": 22,
+      "batch": {
+        "batch_id": 23,
+        "sealed_at": "2025-11-22T19:17:04Z",
+        "merkle_root": "39dc01050c07e6812b36572f0c17183b6bd6ede6ce126108e6e2e19b33458bd8",
+        "entry_count": 10000,
+        "signature": "WOqnfXvK/tvosnh0QDFubBp8jatWfDo2rO9PCnjDQjXu4vJEoCJitGaVkoADTV5l/dNoTgXHdzE9HmsCu8uC7W7AyybKpf6gX9IPXeyT/WTLQBPIerXfzFZMyRDFwF4Rd5E6DQhftjrruvFTZJjKcFVBEDBVGQiyqCoab7fTzLbUSkk6NY9AEun241bdS4LI3LR73y6f4nDqHDaxagcDPQ8XpILMnI89yCozqstHbyY7IITxlMtO2CkKxCzYuYpT2Ju06dVbQvTBoYotWNPPUBQpafsSkY83JRdhK4lTgzzjX4WHwUbgOogwz/7bn6YD842YbGQ5zZIlBSL2RlyIKw=="
+      },
+      "prev_block_hash": "61ba62b8d5192635792183e6004eb8bf7b8cc30af5f440f24c3db83d2aa2874e",
+      "block_hash": "e14fe45413eb9cf5b094bc739e0bba0806a867c6ec4acb301caf2a4f35978a11",
+      "created_at": "2025-11-22T19:17:04Z"
+    },
+    {
+      "index": 23,
+      "batch": {
+        "batch_id": 24,
+        "sealed_at": "2025-11-22T19:17:04Z",
+        "merkle_root": "1eef7d2939cdab5e8f1754f0d16d2c200fbeb63ba53a6c18ee04bad5fde7224e",
+        "entry_count": 10000,
+        "signature": "eVH7g6Enoeqgo9k/t8b19djauyzbD3Ya1qftgydD/cu2Z9r0R4CJHpHV1K6e2sCjMoGyf2Btfmw+nXHRrE5pb7sNISIR2lNJBntlmTmiYlS1Qy38U13Lm7Y41ceRzTCkS7+zGot3gehJ6IcaSWJeWA7nUHjxC+20AdEbuIyaAp5DLzTl9hSDv3y5U+8pvKAD+pyUpgPgIik/Y9S3w8LfVMNXHcRgPWQKela8LnNNz9geuJ8tGAp4MsQmhKX0bRCHhq5gGVad8on57CS4AIdMfbWNWasCPDl9Zm4WYgmRaMS6qdd99WbcBkubzHnMcei/cp5Xk1ghZnCFBf/yAfFgng=="
+      },
+      "prev_block_hash": "e14fe45413eb9cf5b094bc739e0bba0806a867c6ec4acb301caf2a4f35978a11",
+      "block_hash": "01052c7193fedcf1f9f8fb2932699e9620cfe0485f30200fadb0c241e81f5db5",
+      "created_at": "2025-11-22T19:17:04Z"
+    },
+    {
+      "index": 24,
+      "batch": {
+        "batch_id": 25,
+        "sealed_at": "2025-11-22T19:17:04Z",
+        "merkle_root": "f2db360b97eee849554925281f986af7deae46ca73289fb9ba2e76b22a01be6e",
+        "entry_count": 10000,
+        "signature": "W0rKbXjW3cvStfpjsmKo98zJRJwKS6b5bfdEYw2w27i5/70ex4CXbTuVg7A5VcAcS6OXONihGBn3QFUV8j4JZlIpnJJVsfAnhbg0bbaJgr1s98pKF0Lx7vZfimVX/a5wbdLmOY655kETcQxASyVUIGCb/8sOAqb/rMcZBpfnBYX2jNScXL+Cp89Hh9WVqng/YG6KWNnZacJJMxfnId91ohIV3EuOjrJB4xCA6Ohy+Pnp8Hy7OP4UqYBP39S3rulFrUGu6tiOlo3H1WGz6e75RCHeX6ovFKJIiUuxJDJNktk8/rNV8x5vQJijwyvhUDwXaWzySMbm4rLufrZtAS/tLg=="
+      },
+      "prev_block_hash": "01052c7193fedcf1f9f8fb2932699e9620cfe0485f30200fadb0c241e81f5db5",
+      "block_hash": "4a10e731d51d2d8f19da1da6f3a0a7181c9bf0665f41f3cce28f21220a8800a1",
+      "created_at": "2025-11-22T19:17:04Z"
+    },
+    {
+      "index": 25,
+      "batch": {
+        "batch_id": 26,
+        "sealed_at": "2025-11-22T19:17:05Z",
+        "merkle_root": "4c8b0541e6658c76a8847640ceab221c09e3d4e4e2e122cfe2dfb334d7dc5141",
+        "entry_count": 10000,
+        "signature": "RdS+AvjSUovp6EtbQuzSniWW42UeAymTP8mS2+YGvAOPb9gJAzeNRzZomD8z+wG3JKAQ+IS/qPTTMPI0boVMgDSOrsTcfBuRs723hvvCO/r0j+vMd7oSSuQCcpVHgRgU9n/YazioNZqnXWZ70leTyxaJTe3HSrA55FAYkuqD2q4bjTWbeFXcAI7uwJjwRYwTQNTTrIWXqCsyPRTNKRKhCFMCv2GXUZTPCdLeOKadjZWKKSEJLYPz7DUa1ibjtMGYHA0HqK9hnJJVpn8OckJNo1znXuOJY+h0mAy+Tz8jK45DIRMIBvuNeXtyVLMDbMrcrx1mqBhJhm32zJeb7CvIIw=="
+      },
+      "prev_block_hash": "4a10e731d51d2d8f19da1da6f3a0a7181c9bf0665f41f3cce28f21220a8800a1",
+      "block_hash": "a02a76c97cdee3338e011c75eb812e417d8ab8deecd337bc63dc1d0cab7c3279",
+      "created_at": "2025-11-22T19:17:05Z"
+    },
+    {
+      "index": 26,
+      "batch": {
+        "batch_id": 27,
+        "sealed_at": "2025-11-22T19:17:05Z",
+        "merkle_root": "5b1ad6a115f9edf1bc992160d212b502e3f35472fb4c306c1d21e1f54e73f782",
+        "entry_count": 10000,
+        "signature": "bsFUkfrstgZSPdw1a380HpkI13gpUP2gzli4N3SWAOhm7D7uVd4fUfRCESgrvNueI1QDXX0Vq3NEl1RRSMS2DriRiLx5UafStgtwX4wJOWh0TbTFAY4BGELU1H++36xysBMnjsIIsE8AeDE36TrrXKr/SfvgkRjIv7IVJKmbNXmId0SchesHZv0dbIinwLbGpkv1noCj+inlRhJ9LJJHV8pJsljNdTV3U+Kuea6fx1zZJPeqfioGIL941d5GLnksFZ3P9nbz9tQy9LN3pMD6I2CdoZNm5D7ESPXN7jUVz06pMSuISa/O+Ndz3k4GUqNFnYDhR+ANxYfEh7pBZJhgaw=="
+      },
+      "prev_block_hash": "a02a76c97cdee3338e011c75eb812e417d8ab8deecd337bc63dc1d0cab7c3279",
+      "block_hash": "0e43b0b3e902f69eadb068e53243298a5229155f0ecb76e0dda6d6ddc3516e11",
+      "created_at": "2025-11-22T19:17:05Z"
+    },
+    {
+      "index": 27,
+      "batch": {
+        "batch_id": 28,
+        "sealed_at": "2025-11-22T19:17:05Z",
+        "merkle_root": "63231a181eb5585ef114d3c076d78977dfe49941b8ee918d5ea83406084d7b66",
+        "entry_count": 10000,
+        "signature": "B5fA65MbJGGYBrNb9Wdxrwe6yUkRAw3aATCKuwG+O2TMdiQGhY2i2OC/umnFryYGsjRL8ccV4BZ1pLginSTpL+HkDDaZ3HJeXSDZVT2nS7mkz+z33b4YP2YJwVsBvVaQNWQaKYf52vzBQDSF5Ts40X+MGyUzqF581hBJnOlgxq0RqK1xDUGjyuiOUbeqiXviJN/Ik0eJ8EN/6QoEpZs80E6l8bq3FyqBRIiAVBMd1T8VILtT8cqK8Oeq2Upb/Eh0M72G9MSqFN3V4kG4Y78vFApHMlNbcnmtXGZJ5FnbyYMLG7aqsq3wFlbi2+4lj0eeAIwhg+5gVp2z27iQoy08DQ=="
+      },
+      "prev_block_hash": "0e43b0b3e902f69eadb068e53243298a5229155f0ecb76e0dda6d6ddc3516e11",
+      "block_hash": "a4bb71d882bdbbc97aca798903d0c30cead1078b9810162b33ea06a646167be3",
+      "created_at": "2025-11-22T19:17:05Z"
+    },
+    {
+      "index": 28,
+      "batch": {
+        "batch_id": 29,
+        "sealed_at": "2025-11-22T19:17:06Z",
+        "merkle_root": "894cac81366f977d3e57e13c2d4c97be976758ecdd160c3553f158a7bf25d6b6",
+        "entry_count": 10000,
+        "signature": "WSQ1KTMh1FYJexPLaRX/3rEl0Yh51HI8QyeAD+FM8I6Gijv2bZu6OR84+ElfxqzuYb6e+c+mO6VarS0GVUdBu8+bCEyEkvmr+9rs2RQ8iTcMokLFXAHEUAB8KdsB0Nu6iyIc/cuFVnlshBYIxDXmgLcyHVQkAQGUjPNDMFF8ZOl/cvmPiP02LNfkuGqEiQqL4soSqwti9APKI92lO/FmI/gbvQ3BoDSeZ7gPXzEQmXlzGl5Npqqo2dwvg+OWQ5tiEGFDg8Xwr+UzFyrLGB/XoFVNgU4G+rx4VLKPt7dBNBHk1jNW5oAl4o4MvaGhPlbkqHlKJEStqH3QLG+/ioxx6w=="
+      },
+      "prev_block_hash": "a4bb71d882bdbbc97aca798903d0c30cead1078b9810162b33ea06a646167be3",
+      "block_hash": "eea819511c1ce3cf3e43e209d90d581b09985c1691344f288ed420d3a1c5c1e1",
+      "created_at": "2025-11-22T19:17:06Z"
+    },
+    {
+      "index": 29,
+      "batch": {
+        "batch_id": 30,
+        "sealed_at": "2025-11-22T19:17:06Z",
+        "merkle_root": "c870566a387d06dfd75f2d78dd67e016233da1588cfcaebe51925109a1c13930",
+        "entry_count": 10000,
+        "signature": "HxYqKt6P+H3vC8HMwdO5nMoL8tPU+LMMRXkVAbLJ0UKprZPI+M/hcUxA18qd4yhWORO0NIsorkFm41HEqBhNJOl0k7SNZLIxgCRY0bRprfEsgldHlILjv4ItUa59qpXh+ZejbnK2dfe/t9GShgwf+bSrcullWc6M7woAIE4fLnC0XbtoyUjVPwh17Xbg2HCn1Bsv/2KuLT/pYrOg9wSvubUj2xedNTsBb2cMxYTCmeL4+aD/as0EcXg30ORLiG9Wfq54tUGD1SyTOlkd60lm3afVuDLbLURDxAJQ+1mYa9hHgQD5YraU37ZpZXc5O8ZWe8Mc9DQ1iZbYtMzAJ6yYtg=="
+      },
+      "prev_block_hash": "eea819511c1ce3cf3e43e209d90d581b09985c1691344f288ed420d3a1c5c1e1",
+      "block_hash": "62965f0f9385c18691826f11315a82394da1355200ce3edb99a2a1472e5f8583",
+      "created_at": "2025-11-22T19:17:06Z"
+    }
+  ],
+  "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApce+84VPBf4npojIggpk\nEQY59UizBU0Aitm6a2W9CBY46j40mGsqoljzgsqxcfHyz0P5i7lP4j0e/G5ihl0D\nkvyYfxyGbP9XRRl60qBEyJsqHCeSid7bTa8P28Hw4lqEbI1nTOldo4PSzpoQ61/K\nztym/Ts2tDSEjp2H6vqZFzBrqbhYszB9IVfXyvS/V3bUfbfYrJnmrLYkePWrzvIF\nOkQm3Dw/Ct19nsdtrKjRFFDzoDfkGV3n0h3Q+r3WQ3BksYzRI7lAGpGzMhuk67mw\nTm6pD7jrYU3Uh+ZTs0Ulb6qo2Y+BcrNy0HlNW8fdb42Gr7PAXvN/LDIUKk48glst\nLQIDAQAB\n-----END PUBLIC KEY-----\n"
+}

frontend/dashboard.py

@@ -0,0 +1,658 @@
+import streamlit as st
+import pandas as pd
+import numpy as np
+import plotly.express as px
+import plotly.graph_objects as go
+import time
+from datetime import datetime
+import requests
+import json
+import base64
+import os
+
+# API Configuration
+API_URL = "http://localhost:8000"
+
+# Page config
+st.set_page_config(
+    page_title="Network IDS Dashboard",
+    page_icon="🛡️",
+    layout="wide",
+    initial_sidebar_state="expanded"
+)
+
+# Custom CSS
+st.markdown("""
+<style>
+    .threat-high { background-color: #ff4444; color: white; padding: 5px 10px; border-radius: 5px; }
+    .threat-medium { background-color: #ff8800; color: white; padding: 5px 10px; border-radius: 5px; }
+    .threat-low { background-color: #ffbb33; color: white; padding: 5px 10px; border-radius: 5px; }
+    .benign { background-color: #00C851; color: white; padding: 5px 10px; border-radius: 5px; }
+</style>
+""", unsafe_allow_html=True)
+
+# Load test data
+@st.cache_data
+def load_data():
+    # Try to find data relative to this file
+    current_dir = os.path.dirname(os.path.abspath(__file__))
+    # Expected: backend/frontend/dashboard.py -> backend/data/test.csv
+    data_path = os.path.join(current_dir, '..', 'data', 'test.csv')
+    
+    if not os.path.exists(data_path):
+        st.error(f"Data file not found at {data_path}")
+        return pd.DataFrame(), data_path
+        
+    # Limit to 100,000 rows as requested
+    df = pd.read_csv(data_path, nrows=100000)
+    return df, data_path
+
+# API Helper Functions
+def api_predict_flow(features):
+    try:
+        # Ensure features are native Python types (float) not numpy types
+        # Handle None values which might come from backend NaNs
+        clean_features = {k: float(v) if v is not None else 0.0 for k, v in features.items()}
+        response = requests.post(f"{API_URL}/predict/", json={"features": clean_features})
+        if response.status_code == 200:
+            return response.json()
+        else:
+            st.error(f"Prediction failed: {response.text}")
+            return None
+    except Exception as e:
+        st.error(f"API Error: {e}")
+        return None
+
+def api_batch_predict(features_list):
+    try:
+        # Limit batch size to avoid timeouts if necessary, or handle in chunks
+        # For this demo, we'll send chunks of 1000
+        results = []
+        chunk_size = 1000
+        
+        progress_bar = st.progress(0)
+        total = len(features_list)
+        
+        for i in range(0, total, chunk_size):
+            chunk = features_list[i:i+chunk_size]
+            # Convert to list of dicts with native types
+            clean_chunk = [{k: float(v) if v is not None else 0.0 for k, v in item.items()} for item in chunk]
+            
+            response = requests.post(f"{API_URL}/predict/batch", json={"items": clean_chunk})
+            if response.status_code == 200:
+                results.extend(response.json()['results'])
+            else:
+                st.error(f"Batch prediction failed: {response.text}")
+                return []
+            
+            progress_bar.progress(min((i + chunk_size) / total, 1.0))
+            
+        progress_bar.empty()
+        return results
+    except Exception as e:
+        st.error(f"API Error: {e}")
+        return []
+
+def api_generate_report(attack_summary, classification_report, threat_statistics):
+    try:
+        payload = {
+            "attack_summary": attack_summary,
+            "classification_report": classification_report,
+            "threat_statistics": threat_statistics
+        }
+        response = requests.post(f"{API_URL}/reports/generate", json=payload)
+        if response.status_code == 200:
+            return response.json().get("report"), None
+        else:
+            return None, f"API Error: {response.text}"
+    except Exception as e:
+        return None, str(e)
+
+def api_get_monitor_flow(index):
+    try:
+        response = requests.get(f"{API_URL}/monitor/next/{index}")
+        if response.status_code == 200:
+            return response.json()
+        else:
+            st.error(f"Backend Error ({response.status_code}): {response.text}")
+            return None
+    except Exception as e:
+        st.error(f"Connection Error: {e}")
+        return None
+
+def api_get_feature_importance():
+    try:
+        response = requests.get(f"{API_URL}/predict/feature-importance")
+        if response.status_code == 200:
+            return response.json()
+        return None
+    except:
+        return None
+
+# Initialize session state
+if 'predictions' not in st.session_state:
+    st.session_state.predictions = [] # List of result dicts
+if 'monitoring' not in st.session_state:
+    st.session_state.monitoring = False
+if 'current_index' not in st.session_state:
+    st.session_state.current_index = 0
+if 'threat_log' not in st.session_state:
+    st.session_state.threat_log = []
+
+# Sidebar
+st.sidebar.title("🛡️ Network IDS Control")
+page = st.sidebar.radio("Navigation", 
+    ["📊 Dashboard", "🔴 Live Monitor", "📈 Analytics", "🎯 Manual Prediction"])
+
+if st.sidebar.button("🗑️ Clear Cache & Reset"):
+    st.cache_data.clear()
+    st.session_state.predictions = []
+    st.session_state.threat_log = []
+    st.rerun()
+
+df, data_path = load_data()
+st.sidebar.markdown("---")
+st.sidebar.success(f"📂 **Data Source:**\n`{os.path.abspath(data_path)}`")
+st.sidebar.info(f"📊 **Loaded Flows:** {len(df):,}")
+
+if df.empty:
+    st.stop()
+
+# Prepare feature columns (exclude labels)
+feature_cols = [col for col in df.columns if col not in ['Attack_type', 'Attack_encode']]
+
+# Main Dashboard
+if page == "📊 Dashboard":
+    st.title("🛡️ Network Intrusion Detection System")
+    st.markdown("---")
+    
+    # Run batch prediction if not done
+    if len(st.session_state.predictions) == 0:
+        st.info(f"Starting analysis on full dataset ({len(df):,} flows). This may take a while...")
+        
+        results = []
+        chunk_size = 2000 
+        total_rows = len(df)
+        progress_bar = st.progress(0)
+        status_text = st.empty()
+        
+        start_time = time.time()
+        
+        # Process full dataset in chunks to manage memory and avoid timeouts
+        for start_idx in range(0, total_rows, chunk_size):
+            end_idx = min(start_idx + chunk_size, total_rows)
+            
+            # Slice and convert only this chunk
+            chunk_df = df.iloc[start_idx:end_idx]
+            chunk_features = chunk_df[feature_cols].to_dict(orient='records')
+            
+            # Clean features (handle NaNs/None)
+            clean_chunk = [{k: float(v) if pd.notnull(v) else 0.0 for k, v in item.items()} for item in chunk_features]
+            
+            try:
+                response = requests.post(f"{API_URL}/predict/batch", json={"items": clean_chunk})
+                if response.status_code == 200:
+                    results.extend(response.json()['results'])
+                else:
+                    st.error(f"Batch failed at index {start_idx}: {response.text}")
+                    # Continue or break? Breaking is safer to avoid cascading errors
+                    break
+            except Exception as e:
+                st.error(f"Connection error at index {start_idx}: {e}")
+                break
+            
+            # Update progress
+            progress = end_idx / total_rows
+            progress_bar.progress(progress)
+            
+            # Calculate ETA
+            elapsed = time.time() - start_time
+            if elapsed > 0:
+                rate = end_idx / elapsed
+                remaining = (total_rows - end_idx) / rate
+                status_text.caption(f"Processed {end_idx:,}/{total_rows:,} flows ({rate:.0f} flows/s). Est. remaining: {remaining:.0f}s")
+            
+        st.session_state.predictions = results
+        status_text.empty()
+        progress_bar.empty()
+        
+        if len(results) < total_rows:
+            st.warning(f"Analysis completed partially. Processed {len(results)}/{total_rows} flows.")
+        else:
+            st.success(f"Analysis complete! Processed all {len(results):,} flows.")
+    
+    results = st.session_state.predictions
+    
+    if not results:
+        st.warning("No predictions available. Backend might be down.")
+        st.stop()
+        
+    # Extract data for metrics
+    pred_labels = [r['attack'] for r in results]
+    severities = [r['severity'] for r in results]
+    
+    # KPI Metrics
+    col1, col2, col3, col4, col5 = st.columns(5)
+    
+    total_flows = len(results)
+    benign_count = pred_labels.count('Benign')
+    malicious_count = total_flows - benign_count
+    detection_rate = (malicious_count / total_flows * 100) if total_flows > 0 else 0
+    
+    with col1:
+        st.metric("Total Flows", f"{total_flows:,}")
+    with col2:
+        st.metric("Benign", f"{benign_count:,}", delta=f"{benign_count/total_flows*100:.1f}%")
+    with col3:
+        st.metric("Malicious", f"{malicious_count:,}", delta=f"{malicious_count/total_flows*100:.1f}%", delta_color="inverse")
+    with col4:
+        st.metric("Detection Rate", f"{detection_rate:.2f}%")
+    with col5:
+        st.metric("Threats Logged", len(st.session_state.threat_log))
+    
+    st.markdown("---")
+    
+    # Charts Row 1
+    col1, col2 = st.columns(2)
+    
+    with col1:
+        st.subheader("Attack Distribution")
+        attack_counts = pd.Series(pred_labels).value_counts()
+        
+        fig = px.pie(values=attack_counts.values, names=attack_counts.index,
+                     color_discrete_sequence=px.colors.qualitative.Set3,
+                     hole=0.4)
+        fig.update_traces(textposition='inside', textinfo='percent+label')
+        st.plotly_chart(fig, use_container_width=True)
+    
+    with col2:
+        st.subheader("Attack Type Counts")
+        fig = px.bar(x=attack_counts.index, y=attack_counts.values,
+                     labels={'x': 'Attack Type', 'y': 'Count'},
+                     color=attack_counts.index,
+                     color_discrete_sequence=px.colors.qualitative.Bold)
+        fig.update_layout(showlegend=False)
+        st.plotly_chart(fig, use_container_width=True)
+    
+    # Charts Row 2
+    col1, col2 = st.columns(2)
+    
+    with col1:
+        st.subheader("Protocol Distribution (All Traffic)")
+        # Use full processed data
+        processed_df = df.head(len(results))
+        protocol_counts = processed_df['Protocol'].value_counts().head(10)
+        fig = px.bar(x=protocol_counts.index, y=protocol_counts.values,
+                     labels={'x': 'Protocol', 'y': 'Flow Count'},
+                     color=protocol_counts.values,
+                     color_continuous_scale='Reds')
+        st.plotly_chart(fig, use_container_width=True)
+    
+    with col2:
+        st.subheader("Protocol Distribution (Malicious Only)")
+        # Filter malicious from processed data
+        malicious_mask = [p != 'Benign' for p in pred_labels]
+        malicious_df = processed_df[malicious_mask]
+        
+        if len(malicious_df) > 0:
+            mal_protocol = malicious_df['Protocol'].value_counts().head(10)
+            fig = px.bar(x=mal_protocol.index, y=mal_protocol.values,
+                         labels={'x': 'Protocol', 'y': 'Attack Count'},
+                         color=mal_protocol.values,
+                         color_continuous_scale='OrRd')
+            st.plotly_chart(fig, use_container_width=True)
+        else:
+            st.info("No malicious traffic detected")
+    
+    # Recent Detections
+    st.markdown("---")
+    st.subheader("🚨 Recent Threat Detections")
+    
+    # Filter malicious
+    malicious_indices = [i for i, r in enumerate(results) if r['attack'] != 'Benign']
+    
+    if malicious_indices:
+        recent_indices = malicious_indices[-10:][::-1]
+        threat_data = []
+        
+        for idx in recent_indices:
+            res = results[idx]
+            # Map back to original DF for protocol info (assuming 1:1 mapping with sample)
+            orig_row = df.iloc[idx]
+            
+            threat_data.append({
+                'Flow ID': idx,
+                'Attack Type': res['attack'],
+                'Severity': f"{res['severity']:.2f}",
+                'Protocol': orig_row.get('Protocol', 'N/A'),
+                'Action': res['action'],
+                'Fwd Packets': int(orig_row.get('Total Fwd Packets', 0)),
+                'Bwd Packets': int(orig_row.get('Total Backward Packets', 0))
+            })
+        
+        st.dataframe(pd.DataFrame(threat_data), use_container_width=True, hide_index=True)
+    else:
+        st.success("✅ No threats detected in current sample")
+
+# Live Monitor
+elif page == "🔴 Live Monitor":
+    st.title("🔴 Real-Time Threat Monitor")
+    st.markdown("Simulated real-time monitoring using test data")
+    
+    col1, col2, col3 = st.columns([2, 2, 1])
+    with col1:
+        if st.button("▶️ Start Monitoring" if not st.session_state.monitoring else "⏸️ Pause Monitoring"):
+            st.session_state.monitoring = not st.session_state.monitoring
+    
+    with col2:
+        if st.button("🔄 Reset"):
+            st.session_state.current_index = 0
+            st.session_state.threat_log = []
+            st.rerun()
+    
+    with col3:
+        speed = st.slider("Speed", 1, 10, 2)
+    
+    placeholder = st.empty()
+    
+    if st.session_state.monitoring:
+        while st.session_state.monitoring:
+            idx = st.session_state.current_index
+            
+            # 1. Get Flow Data from Backend Monitor Endpoint
+            monitor_data = api_get_monitor_flow(idx)
+            
+            if not monitor_data or monitor_data.get('end'):
+                st.session_state.monitoring = False
+                st.info("Monitoring complete or backend unreachable")
+                break
+                
+            flow_data = monitor_data['flow']
+            
+            # 2. Send to Predict Endpoint
+            # Filter flow_data to only feature columns expected by model
+            pred_features = {k: v for k, v in flow_data.items() if k in feature_cols}
+            
+            prediction = api_predict_flow(pred_features)
+            
+            if prediction:
+                attack_label = prediction['attack']
+                severity = prediction['severity']
+                action = prediction['action']
+                
+                # Log threats
+                if attack_label != 'Benign':
+                    st.session_state.threat_log.append({
+                        'timestamp': datetime.now().strftime('%Y-%m-%d %H:%M:%S'),
+                        'flow_id': idx,
+                        'attack_type': attack_label,
+                        'severity': severity,
+                        'action': action
+                    })
+                
+                with placeholder.container():
+                    st.markdown(f"### Flow #{idx} - {datetime.now().strftime('%H:%M:%S')}")
+                    
+                    col1, col2, col3, col4 = st.columns(4)
+                    col1.metric("Attack Type", attack_label)
+                    col2.metric("Severity", f"{severity:.2f}")
+                    col3.metric("Protocol", flow_data.get('Protocol', 'N/A'))
+                    col4.metric("Action", action)
+                    
+                    if attack_label != 'Benign':
+                        st.error(f"🚨 THREAT DETECTED: {attack_label}")
+                        
+                        st.markdown("**Key Flow Characteristics:**")
+                        key_features = ['Total Fwd Packets', 'Total Backward Packets', 
+                                      'Flow Bytes/s', 'SYN Flag Count', 'ACK Flag Count']
+                        
+                        cols = st.columns(len(key_features))
+                        for i, feat in enumerate(key_features):
+                            val = flow_data.get(feat, 0)
+                            cols[i].metric(feat, f"{float(val):.2f}")
+                    else:
+                        st.success("✅ Benign Traffic - Allowed")
+                    
+                    st.progress((idx % 100) / 100) # Simple progress bar
+                    
+                    # Show recent threat log
+                    if len(st.session_state.threat_log) > 0:
+                        st.markdown("---")
+                        st.markdown("**Recent Threats:**")
+                        log_df = pd.DataFrame(st.session_state.threat_log[-5:][::-1])
+                        st.dataframe(log_df, use_container_width=True, hide_index=True)
+            
+            st.session_state.current_index += 1
+            time.sleep(1.0 / speed)
+
+# Analytics
+elif page == "📈 Analytics":
+    st.title("📈 Detailed Analytics")
+    
+    if len(st.session_state.predictions) == 0:
+        st.warning("Please visit the Dashboard page first to run the initial analysis.")
+        st.stop()
+        
+    results = st.session_state.predictions
+    pred_labels = [r['attack'] for r in results]
+    
+    # Confusion Matrix (if labels exist in loaded df)
+    if 'Attack_encode' in df.columns:
+        # We need to align results with the DF. 
+        # Assuming results correspond to df.head(len(results))
+        sample_df = df.head(len(results))
+        y_true = sample_df['Attack_encode'].values
+        
+        # Filter out NaN values
+        valid_mask = ~np.isnan(y_true)
+        
+        if valid_mask.sum() > 0:
+            y_true_clean = y_true[valid_mask]
+            # Convert predictions to encode if possible, or map names to indices
+            # ATTACK_MAP = {0: 'Benign', 1: 'DoS', 2: 'BruteForce', 3: 'Scan', 4: 'Malware', 5: 'WebAttack'}
+            # Inverse map
+            NAME_TO_ENCODE = {'Benign': 0, 'DoS': 1, 'BruteForce': 2, 'Scan': 3, 'Malware': 4, 'WebAttack': 5, 'Unknown': -1}
+            
+            preds_clean = [NAME_TO_ENCODE.get(p, -1) for p in np.array(pred_labels)[valid_mask]]
+            
+            st.subheader("Confusion Matrix")
+            from sklearn.metrics import confusion_matrix
+            
+            # Filter out unknowns if any
+            valid_preds_mask = [p != -1 for p in preds_clean]
+            if any(valid_preds_mask):
+                y_true_final = y_true_clean[valid_preds_mask]
+                preds_final = np.array(preds_clean)[valid_preds_mask]
+                
+                cm = confusion_matrix(y_true_final, preds_final)
+                
+                attack_names = ['Benign', 'DoS', 'BruteForce', 'Scan', 'Malware', 'WebAttack']
+                # Ensure labels match unique values present or use fixed list if we are sure
+                
+                fig = px.imshow(cm, 
+                                labels=dict(x="Predicted", y="Actual", color="Count"),
+                                x=attack_names[:len(cm)], # Simplified, might need proper alignment
+                                y=attack_names[:len(cm)],
+                                color_continuous_scale='Blues',
+                                text_auto=True)
+                st.plotly_chart(fig, use_container_width=True)
+
+    # Report Generation
+    st.markdown("---")
+    st.subheader("📄 Generate Comprehensive Threat Report")
+    
+    col1, col2 = st.columns([3, 1])
+    with col1:
+        st.info("The report will include attack classifications, MITRE ATT&CK framework recommendations, and actionable security measures.")
+    
+    with col2:
+        if st.button("📥 Generate Report", type="primary", use_container_width=True):
+            with st.spinner("Generating comprehensive threat report using AI..."):
+                # Prepare stats
+                attack_counts = pd.Series(pred_labels).value_counts().to_dict()
+                
+                # Mock classification report summary
+                report_summary = {
+                    "analyzed_flows": len(results),
+                    "attack_distribution": attack_counts
+                }
+                
+                threat_stats = {
+                    "total_flows": len(results),
+                    "malicious_flows": len([p for p in pred_labels if p != 'Benign']),
+                    "benign_flows": pred_labels.count('Benign'),
+                    "threat_percentage": len([p for p in pred_labels if p != 'Benign']) / len(results) * 100
+                }
+                
+                report_text, error = api_generate_report(attack_counts, report_summary, threat_stats)
+                
+                if error:
+                    st.error(error)
+                    st.info("💡 To use report generation, please set your GROQ_API_KEY in Streamlit secrets (st.secrets) or as an environment variable.")
+                else:
+                    st.success("✅ Report generated successfully!")
+                    st.markdown("### 📋 Report Preview")
+                    with st.expander("View Generated Report", expanded=True):
+                        st.markdown(report_text)
+                    
+                    # Download
+                    b64 = base64.b64encode(report_text.encode()).decode()
+                    href = f'<a href="data:text/plain;base64,{b64}" download="threat_report.txt" style="background-color: #764ba2; color: white; padding: 10px 20px; text-decoration: none; border-radius: 5px; display: inline-block;">📄 Download Text Report</a>'
+                    st.markdown(href, unsafe_allow_html=True)
+
+    # Feature Importance
+    st.markdown("---")
+    st.subheader("Top 15 Important Features")
+    
+    fi_data = api_get_feature_importance()
+    if fi_data:
+        importances = None
+        if 'importances' in fi_data and fi_data['importances']:
+            importances = np.array(fi_data['importances'])
+            indices = np.argsort(importances)[::-1][:15]
+            top_features = [feature_cols[i] for i in indices]
+            top_importances = importances[indices]
+        elif 'importances_dict' in fi_data:
+            # Sort dict by value
+            sorted_items = sorted(fi_data['importances_dict'].items(), key=lambda x: x[1], reverse=True)[:15]
+            top_features = [k for k, v in sorted_items]
+            top_importances = [v for k, v in sorted_items]
+        
+        if importances is not None or 'importances_dict' in fi_data:
+            fig = px.bar(x=top_features, 
+                         y=top_importances,
+                         labels={'x': 'Feature', 'y': 'Importance'},
+                         color=top_importances,
+                         color_continuous_scale='Viridis')
+            fig.update_layout(xaxis_tickangle=-45)
+            st.plotly_chart(fig, use_container_width=True)
+    else:
+        st.info("Feature importance not available from backend model.")
+
+    # Feature correlation for malicious traffic
+    st.markdown("---")
+    st.subheader("Feature Correlation Heatmap (Malicious Traffic)")
+    
+    sample_df = df.head(len(results))
+    malicious_mask = [p != 'Benign' for p in pred_labels]
+    malicious_df = sample_df[malicious_mask]
+    
+    if len(malicious_df) > 0:
+        key_features = ['Total Fwd Packets', 'Total Backward Packets', 
+                       'Flow Bytes/s', 'Flow Packets/s', 'Packet Length Mean',
+                       'SYN Flag Count', 'ACK Flag Count', 'PSH Flag Count']
+        key_features = [f for f in key_features if f in df.columns]
+        
+        corr = malicious_df[key_features].corr()
+        
+        fig = px.imshow(corr, 
+                        labels=dict(color="Correlation"),
+                        x=key_features, y=key_features,
+                        color_continuous_scale='RdBu_r',
+                        zmin=-1, zmax=1,
+                        text_auto='.2f')
+        st.plotly_chart(fig, use_container_width=True)
+        
+    # Statistical summary by attack type
+    st.markdown("---")
+    st.subheader("Statistical Summary by Attack Type")
+    
+    df_with_pred = sample_df.copy()
+    df_with_pred['Predicted_Attack'] = pred_labels
+    
+    selected_attack = st.selectbox("Select Attack Type", 
+                                   sorted(df_with_pred['Predicted_Attack'].unique()))
+    
+    attack_subset = df_with_pred[df_with_pred['Predicted_Attack'] == selected_attack]
+    
+    summary_features = ['Total Fwd Packets', 'Total Backward Packets', 
+                       'Flow Bytes/s', 'Packet Length Mean', 'Flow IAT Mean']
+    summary_features = [f for f in summary_features if f in df.columns]
+    
+    st.dataframe(attack_subset[summary_features].describe(), use_container_width=True)
+
+# Manual Prediction
+elif page == "🎯 Manual Prediction":
+    st.title("🎯 Manual Flow Classification")
+    st.markdown("Upload a CSV or input features manually")
+    
+    tab1, tab2 = st.tabs(["📁 Upload CSV", "⌨️ Manual Input"])
+    
+    with tab1:
+        uploaded_file = st.file_uploader("Upload CSV file", type=['csv'])
+        if uploaded_file:
+            test_df = pd.read_csv(uploaded_file)
+            st.success(f"Loaded {len(test_df)} flows")
+            
+            if st.button("🔍 Classify Flows"):
+                features_list = test_df[feature_cols].to_dict(orient='records')
+                with st.spinner("Classifying..."):
+                    results = api_batch_predict(features_list)
+                    
+                    if results:
+                        # Add results to DF
+                        test_df['Prediction'] = [r['attack'] for r in results]
+                        test_df['Severity'] = [r['severity'] for r in results]
+                        test_df['Action'] = [r['action'] for r in results]
+                        
+                        st.dataframe(test_df, use_container_width=True)
+                        
+                        csv = test_df.to_csv(index=False)
+                        st.download_button("📥 Download Results", csv, 
+                                         "predictions.csv", "text/csv")
+    
+    with tab2:
+        st.markdown("**Enter flow features:**")
+        
+        input_data = {}
+        cols = st.columns(3)
+        
+        # Dynamically create inputs for all features
+        for i, feature in enumerate(feature_cols):
+            col_idx = i % 3
+            with cols[col_idx]:
+                input_data[feature] = st.number_input(feature, value=0.0, 
+                                                     format="%.2f", key=feature)
+                
+        if st.button("🔍 Classify Flow"):
+            with st.spinner("Querying API..."):
+                result = api_predict_flow(input_data)
+                
+                if result:
+                    st.markdown("---")
+                    st.markdown("### 🎯 Prediction Result")
+                    
+                    col1, col2, col3 = st.columns(3)
+                    col1.metric("Attack Type", result['attack'])
+                    col2.metric("Severity", f"{result['severity']:.2f}")
+                    col3.metric("Recommended Action", result['action'])
+                    
+                    if result['attack'] != 'Benign':
+                        st.error(f"🚨 THREAT DETECTED: {result['attack']}")
+                        st.markdown(f"**Recommended Action:** {result['action']}")
+                    else:
+                        st.success("✅ Benign Traffic - Allow")
+
+# Footer
+st.sidebar.markdown("---")
+st.sidebar.info(f"Dashboard v1.0 | {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")

models/request_models.py

@@ -0,0 +1,8 @@
+from pydantic import BaseModel
+from typing import Dict, List, Any
+
+class FlowFeatures(BaseModel):
+    features: Dict[str, Any]
+
+class BatchRequest(BaseModel):
+    items: List[Dict[str, Any]]

models/response_models.py

@@ -0,0 +1,6 @@
+from pydantic import BaseModel
+
+class PredictionResponse(BaseModel):
+    attack: str
+    severity: float
+    action: str

requirements.txt

@@ -1,5 +1,80 @@
-fastapi
-uvicorn
-pandas
-numpy
-scikit-learn
+altair==5.5.0
+annotated-doc==0.0.4
+annotated-types==0.7.0
+anyio==4.11.0
+appdirs==1.4.4
+attrs==25.4.0
+blinker==1.9.0
+cachetools==6.2.2
+certifi==2025.11.12
+charset-normalizer==3.4.4
+click==8.3.1
+cloudpickle==3.1.2
+colorama==0.4.6
+contourpy==1.3.3
+cycler==0.12.1
+distro==1.9.0
+dotenv==0.9.9
+fastapi==0.121.3
+fonttools==4.60.1
+gitdb==4.0.12
+GitPython==3.1.45
+groq==0.36.0
+h11==0.16.0
+httpcore==1.0.9
+httpx==0.28.1
+idna==3.11
+Jinja2==3.1.6
+joblib==1.5.2
+jsonschema==4.25.1
+jsonschema-specifications==2025.9.1
+kiwisolver==1.4.9
+llvmlite==0.45.1
+lxml==6.0.2
+MarkupSafe==3.0.3
+matplotlib==3.10.7
+narwhals==2.12.0
+numba==0.62.1
+numpy==2.3.5
+packaging==25.0
+pandas==2.3.3
+pillow==12.0.0
+plotly==6.5.0
+protobuf==6.33.1
+pyarrow==21.0.0
+pydantic==2.12.4
+pydantic_core==2.41.5
+pydeck==0.9.1
+pyparsing==3.2.5
+pyshark==0.6
+python-dateutil==2.9.0.post0
+python-dotenv==1.2.1
+python-multipart==0.0.20
+pytz==2025.2
+referencing==0.37.0
+reportlab==4.4.5
+requests==2.32.5
+rpds-py==0.29.0
+scikit-learn==1.7.2
+scipy==1.16.3
+shap==0.50.0
+six==1.17.0
+slicer==0.0.8
+smmap==5.0.2
+sniffio==1.3.1
+starlette==0.50.0
+streamlit==1.51.0
+tenacity==9.1.2
+termcolor==3.2.0
+threadpoolctl==3.6.0
+toml==0.10.2
+tornado==6.5.2
+tqdm==4.67.1
+typing-inspection==0.4.2
+typing_extensions==4.15.0
+tzdata==2025.2
+unicorn==2.1.4
+urllib3==2.5.0
+uvicorn==0.38.0
+watchdog==6.0.0
+xgboost==3.1.2

routers/blockchain.py

@@ -0,0 +1,22 @@
+from fastapi import APIRouter, HTTPException
+import json
+from pathlib import Path
+
+router = APIRouter()
+
+# Path to the ledger file
+# backend/routers/blockchain.py -> parent = backend/routers -> parent.parent = backend
+# ledger is in backend/blockchain/blockchain_ledger.json
+LEDGER_PATH = Path(__file__).resolve().parent.parent / "blockchain" / "blockchain_ledger.json"
+
+@router.get("/ledger")
+def get_ledger():
+    if not LEDGER_PATH.exists():
+        # Return empty structure if not found, or error
+        return {"blocks": [], "sealed_batch_count": 0, "open_entries": []}
+    try:
+        with open(LEDGER_PATH, "r", encoding="utf-8") as f:
+            data = json.load(f)
+        return data
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))

routers/monitor.py

@@ -0,0 +1,131 @@
+from fastapi import APIRouter
+import pandas as pd
+
+router = APIRouter()
+
+import os
+
+# Robust data path finding
+DATA_PATH = "data/test.csv"
+if not os.path.exists(DATA_PATH):
+    # Try finding it relative to this file
+    current_dir = os.path.dirname(os.path.abspath(__file__))
+    parent_dir = os.path.dirname(current_dir)
+    DATA_PATH = os.path.join(parent_dir, "data", "test.csv")
+
+if os.path.exists(DATA_PATH):
+    df = pd.read_csv(DATA_PATH)
+else:
+    print(f"Warning: Test data not found at {DATA_PATH}")
+    df = pd.DataFrame() # Empty dataframe to prevent crash on import
+
+@router.get("/next/{index}")
+def get_flow(index: int):
+    try:
+        if index >= len(df):
+            return {"end": True}
+
+        row = df.iloc[index]
+        # Handle NaN values for JSON serialization
+        # Use a simpler approach if where() fails
+        d = row.to_dict()
+        clean_d = {}
+        for k, v in d.items():
+            if pd.isna(v):
+                clean_d[k] = None
+            else:
+                clean_d[k] = v
+        
+        return {
+            "index": index,
+            "flow": clean_d,
+            "end": False
+        }
+    except Exception as e:
+        import traceback
+        return {"error": str(e), "trace": traceback.format_exc(), "end": True}
+
+# Import necessary modules for prediction
+from routers.predict import model, predict_with_model, ATTACK_MAP
+import numpy as np
+
+@router.get("/stats")
+def get_dashboard_stats():
+    try:
+        if df.empty:
+            return {"error": "No data loaded"}
+            
+        # Limit to 100,000 rows for stats calculation as requested
+        limit = 100000
+        stats_df = df.head(limit)
+        
+        # Perform Prediction on the loaded data (replicating dashboard1.py logic)
+        # We need to predict to get the actual current model's view of the data
+        # Filter out non-feature columns explicitly
+        feature_cols = [col for col in stats_df.columns if col not in ['Attack_type', 'Attack_encode']]
+        X = stats_df[feature_cols]
+        
+        # Predict
+        if model:
+            preds = predict_with_model(model, X)
+            # Convert predictions to labels
+            # preds might be floats from XGBoost, cast to int
+            pred_labels = [int(p) if isinstance(p, (int, float, np.number)) else int(p) for p in preds]
+            pred_names = [ATTACK_MAP.get(p, 'Unknown') for p in pred_labels]
+        else:
+            # Fallback if model not loaded (shouldn't happen if app started correctly)
+            return {"error": "Model not loaded"}
+
+        # 1. Total Flows
+        total_flows = len(stats_df)
+        
+        # 2. Attack Distribution (based on PREDICTIONS)
+        attack_counts = {}
+        for name in pred_names:
+            attack_counts[name] = attack_counts.get(name, 0) + 1
+            
+        # 3. Protocol Distribution (All)
+        if 'Protocol' in stats_df.columns:
+            protocol_counts = stats_df['Protocol'].value_counts().head(10).to_dict()
+        else:
+            protocol_counts = {}
+            
+        # 4. Protocol Distribution (Malicious)
+        malicious_protocol_counts = {}
+        recent_threats = []
+        
+        # Filter malicious based on predictions
+        # Create a temporary dataframe with predictions for filtering
+        temp_df = stats_df.copy()
+        temp_df['Predicted_Attack'] = pred_names
+        
+        malicious_df = temp_df[temp_df['Predicted_Attack'] != 'Benign']
+        
+        if not malicious_df.empty:
+            if 'Protocol' in malicious_df.columns:
+                malicious_protocol_counts = malicious_df['Protocol'].value_counts().head(10).to_dict()
+            
+            # 5. Recent Threats (Take last 20 malicious flows)
+            threats_df = malicious_df.tail(20).iloc[::-1]
+            
+            for idx, row in threats_df.iterrows():
+                recent_threats.append({
+                    "id": int(idx),
+                    "attack": row['Predicted_Attack'],
+                    "protocol": row['Protocol'] if 'Protocol' in row else "Unknown",
+                    "severity": "High", # Simplified for summary
+                    "fwd_packets": int(row.get('Total Fwd Packets', 0)),
+                    "bwd_packets": int(row.get('Total Backward Packets', 0))
+                })
+
+        return {
+            "total_flows": total_flows,
+            "attack_counts": attack_counts,
+            "protocol_counts": protocol_counts,
+            "malicious_protocol_counts": malicious_protocol_counts,
+            "recent_threats": recent_threats
+        }
+    except Exception as e:
+        import traceback
+        print(traceback.format_exc())
+        return {"error": str(e)}

routers/predict.py

@@ -0,0 +1,136 @@
+from fastapi import APIRouter, HTTPException
+from utils.model_loader import load_model
+from utils.severity import calculate_severity
+from models.request_models import FlowFeatures, BatchRequest
+from models.response_models import PredictionResponse
+import numpy as np
+import pandas as pd
+import xgboost as xgb
+
+router = APIRouter()
+
+# Load model on startup (or lazy load)
+try:
+    model = load_model()
+except Exception as e:
+    print(f"Error loading model: {e}")
+    model = None
+
+ATTACK_MAP = {0: "Benign", 1: "DoS", 2: "BruteForce", 3: "Scan", 4: "Malware", 5: "WebAttack"}
+
+ACTIONS = {
+    'DoS': 'BLOCK IP + Rate Limiting',
+    'BruteForce': 'BLOCK IP + Account Lockout',
+    'Scan': 'LOG + Monitor Suspicious Activity',
+    'Malware': 'QUARANTINE + Deep Scan',
+    'WebAttack': 'BLOCK Request + WAF Rule Update',
+    'Benign': 'Allow Traffic'
+}
+
+def predict_with_model(model, data):
+    """
+    Wrapper to handle prediction for both XGBoost (DMatrix) and Sklearn (DataFrame) models.
+    """
+    if model is None:
+        raise HTTPException(status_code=503, detail="Model not loaded")
+
+    # Check if it's an XGBoost Booster
+    if isinstance(model, xgb.Booster):
+        dmatrix = xgb.DMatrix(data)
+        return model.predict(dmatrix)
+    
+    # Default to sklearn-style predict
+    try:
+        return model.predict(data)
+    except Exception as e:
+        # Fallback: try converting to DMatrix
+        try:
+            dmatrix = xgb.DMatrix(data)
+            return model.predict(dmatrix)
+        except:
+            raise e
+
+@router.post("/", response_model=PredictionResponse)
+def predict_flow(data: FlowFeatures):
+    try:
+        # Sanitize features: ensure all values are numeric
+        clean_features = {}
+        for k, v in data.features.items():
+            try:
+                clean_features[k] = float(v)
+            except (ValueError, TypeError):
+                clean_features[k] = 0.0
+                
+        # Convert dict to DataFrame
+        df = pd.DataFrame([clean_features])
+        
+        # Remove target columns if present (they shouldn't be in features, but just in case)
+        cols_to_drop = [col for col in df.columns if col in ['Attack_type', 'Attack_encode']]
+        if cols_to_drop:
+            df = df.drop(columns=cols_to_drop)
+            
+        # Predict
+        raw_pred = predict_with_model(model, df)
+        pred = int(raw_pred[0]) if isinstance(raw_pred[0], (int, float, np.number)) else int(raw_pred[0])
+        
+        attack = ATTACK_MAP.get(pred, "Unknown")
+        
+        # Calculate severity
+        severity = calculate_severity(data.features, attack)
+        action = ACTIONS.get(attack, "Monitor")
+
+        return PredictionResponse(
+            attack=attack,
+            severity=severity,
+            action=action
+        )
+    except Exception as e:
+        import traceback
+        print(traceback.format_exc())
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.post("/batch")
+def batch_predict(data: BatchRequest):
+    try:
+        df = pd.DataFrame(data.items)
+        preds = predict_with_model(model, df)
+
+        results = []
+        for i, p in enumerate(preds):
+            pred_val = int(p) if isinstance(p, (int, float, np.number)) else int(p)
+            attack = ATTACK_MAP.get(pred_val, "Unknown")
+            
+            # Get features for this item to calculate severity
+            # Note: data.items is a list of dicts
+            sev = calculate_severity(data.items[i], attack)
+            
+            results.append({
+                "attack": attack,
+                "severity": sev,
+                "action": ACTIONS.get(attack, "Monitor")
+            })
+
+        return {"results": results}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+@router.get("/feature-importance")
+def get_feature_importance():
+    try:
+        if model is None:
+            raise HTTPException(status_code=503, detail="Model not loaded")
+            
+        # Check for feature_importances_ (sklearn style)
+        if hasattr(model, 'feature_importances_'):
+            return {"importances": model.feature_importances_.tolist()}
+            
+        # Check for get_score (XGBoost native)
+        if hasattr(model, 'get_score'):
+            # This returns a dict {feature_name: score}
+            # We might need to map it back to feature indices if names aren't preserved or match input
+            return {"importances_dict": model.get_score(importance_type='weight')}
+            
+        return {"importances": []}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))

routers/reports.py

@@ -0,0 +1,309 @@
+from fastapi import APIRouter, HTTPException
+from pydantic import BaseModel
+from typing import Dict, List
+import io
+import base64
+from reportlab.lib.pagesizes import letter, A4
+from reportlab.lib.styles import getSampleStyleSheet, ParagraphStyle
+from reportlab.lib.units import inch
+from reportlab.platypus import SimpleDocTemplate, Paragraph, Spacer, Image, PageBreak, Table, TableStyle
+from reportlab.lib import colors
+from reportlab.lib.enums import TA_CENTER, TA_LEFT
+import matplotlib
+matplotlib.use('Agg')  # Non-interactive backend
+import matplotlib.pyplot as plt
+import numpy as np
+from datetime import datetime
+import os
+from groq import Groq
+
+router = APIRouter()
+
+class ReportRequest(BaseModel):
+    attack_summary: Dict[str, int]
+    classification_report: Dict
+    threat_statistics: Dict
+    attack_counts: Dict[str, int]
+    protocol_counts: Dict[str, int]
+
+def create_pie_chart(data: Dict[str, int], title: str) -> str:
+    """Create a pie chart and return as base64 image"""
+    fig, ax = plt.subplots(figsize=(6, 4))
+    
+    labels = list(data.keys())
+    sizes = list(data.values())
+    colors_list = ['#00C851', '#ff4444', '#ff8800', '#33b5e5', '#aa66cc', '#2BBBAD']
+    
+    ax.pie(sizes, labels=labels, autopct='%1.1f%%', colors=colors_list[:len(labels)], startangle=90)
+    ax.set_title(title, fontsize=14, fontweight='bold')
+    
+    # Save to bytes
+    buf = io.BytesIO()
+    plt.savefig(buf, format='png', dpi=150, bbox_inches='tight')
+    buf.seek(0)
+    plt.close()
+    
+    return buf
+
+def create_bar_chart(data: Dict[str, int], title: str, color='#33b5e5') -> str:
+    """Create a bar chart and return as base64 image"""
+    fig, ax = plt.subplots(figsize=(8, 4))
+    
+    labels = list(data.keys())
+    values = list(data.values())
+    
+    ax.barh(labels, values, color=color)
+    ax.set_xlabel('Count', fontsize=10)
+    ax.set_title(title, fontsize=14, fontweight='bold')
+    ax.grid(axis='x', alpha=0.3)
+    
+    # Save to bytes
+    buf = io.BytesIO()
+    plt.savefig(buf, format='png', dpi=150, bbox_inches='tight')
+    buf.seek(0)
+    plt.close()
+    
+    return buf
+
+@router.post("/generate-pdf")
+async def generate_pdf_report(data: ReportRequest):
+    try:
+        # Create PDF buffer
+        buffer = io.BytesIO()
+        doc = SimpleDocTemplate(buffer, pagesize=letter, topMargin=0.5*inch, bottomMargin=0.5*inch)
+        
+        # Styles
+        styles = getSampleStyleSheet()
+        title_style = ParagraphStyle(
+            'CustomTitle',
+            parent=styles['Heading1'],
+            fontSize=24,
+            textColor=colors.HexColor('#1a1a2e'),
+            spaceAfter=30,
+            alignment=TA_CENTER,
+            fontName='Helvetica-Bold'
+        )
+        
+        heading_style = ParagraphStyle(
+            'CustomHeading',
+            parent=styles['Heading2'],
+            fontSize=16,
+            textColor=colors.HexColor('#2d4059'),
+            spaceAfter=12,
+            spaceBefore=20,
+            fontName='Helvetica-Bold'
+        )
+        
+        body_style = ParagraphStyle(
+            'CustomBody',
+            parent=styles['BodyText'],
+            fontSize=11,
+            leading=16,
+            spaceAfter=12,
+            alignment=TA_LEFT
+        )
+        
+        # Build content
+        content = []
+        
+        # Title
+        content.append(Paragraph("Network Intrusion Detection System", title_style))
+        content.append(Paragraph("Comprehensive Threat Analysis Report", styles['Heading2']))
+        content.append(Spacer(1, 0.2*inch))
+        
+        # Metadata
+        meta_data = [
+            ['Report Generated:', datetime.now().strftime('%Y-%m-%d %H:%M:%S')],
+            ['Total Flows Analyzed:', str(data.threat_statistics.get('total', 0))],
+            ['Malicious Flows:', str(data.threat_statistics.get('malicious', 0))],
+            ['Benign Flows:', str(data.threat_statistics.get('benign', 0))],
+        ]
+        
+        meta_table = Table(meta_data, colWidths=[2*inch, 3*inch])
+        meta_table.setStyle(TableStyle([
+            ('BACKGROUND', (0, 0), (0, -1), colors.HexColor('#e8eaf6')),
+            ('TEXTCOLOR', (0, 0), (-1, -1), colors.black),
+            ('ALIGN', (0, 0), (-1, -1), 'LEFT'),
+            ('FONTNAME', (0, 0), (0, -1), 'Helvetica-Bold'),
+            ('FONTSIZE', (0, 0), (-1, -1), 10),
+            ('BOTTOMPADDING', (0, 0), (-1, -1), 8),
+            ('GRID', (0, 0), (-1, -1), 0.5, colors.grey)
+        ]))
+        content.append(meta_table)
+        content.append(Spacer(1, 0.3*inch))
+        
+        # Executive Summary (AI Generated)
+        content.append(Paragraph("Executive Summary", heading_style))
+        
+        # Generate AI summary using Groq
+        api_key = os.getenv("GROQ_API_KEY")
+        client = Groq(api_key=api_key)
+        
+        summary_prompt = f"""Generate a professional executive summary for a network security report with these statistics:
+
+Total Flows: {data.threat_statistics.get('total', 0)}
+Malicious: {data.threat_statistics.get('malicious', 0)}
+Attack Distribution: {data.attack_summary}
+
+Provide a 3-4 sentence executive summary in plain text (no markdown) covering:
+1. Overall security posture
+2. Key threats detected
+3. Critical recommendations
+
+Keep it professional and concise."""
+
+        try:
+            response = client.chat.completions.create(
+                messages=[{"role": "user", "content": summary_prompt}],
+                model="llama-3.1-8b-instant",
+                temperature=0.7,
+                max_tokens=200
+            )
+            summary_text = response.choices[0].message.content
+        except:
+            summary_text = f"Analysis of {data.threat_statistics.get('total', 0)} network flows revealed {data.threat_statistics.get('malicious', 0)} malicious activities. The system successfully identified multiple attack vectors requiring immediate attention."
+        
+        content.append(Paragraph(summary_text, body_style))
+        content.append(Spacer(1, 0.2*inch))
+        
+        # Attack Distribution Chart
+        content.append(Paragraph("Attack Distribution Analysis", heading_style))
+        pie_buf = create_pie_chart(data.attack_counts, "Attack Type Distribution")
+        img = Image(pie_buf, width=5*inch, height=3.3*inch)
+        content.append(img)
+        content.append(Spacer(1, 0.2*inch))
+        
+        # Attack Statistics Table
+        attack_data = [['Attack Type', 'Count', 'Percentage']]
+        total = sum(data.attack_counts.values())
+        for attack, count in sorted(data.attack_counts.items(), key=lambda x: x[1], reverse=True):
+            percentage = f"{(count/total*100):.1f}%" if total > 0 else "0%"
+            attack_data.append([attack, str(count), percentage])
+        
+        attack_table = Table(attack_data, colWidths=[2.5*inch, 1.5*inch, 1.5*inch])
+        attack_table.setStyle(TableStyle([
+            ('BACKGROUND', (0, 0), (-1, 0), colors.HexColor('#3f51b5')),
+            ('TEXTCOLOR', (0, 0), (-1, 0), colors.whitesmoke),
+            ('ALIGN', (0, 0), (-1, -1), 'CENTER'),
+            ('FONTNAME', (0, 0), (-1, 0), 'Helvetica-Bold'),
+            ('FONTSIZE', (0, 0), (-1, 0), 12),
+            ('BOTTOMPADDING', (0, 0), (-1, 0), 12),
+            ('BACKGROUND', (0, 1), (-1, -1), colors.beige),
+            ('GRID', (0, 0), (-1, -1), 1, colors.black)
+        ]))
+        content.append(attack_table)
+        content.append(PageBreak())
+        
+        # Protocol Distribution
+        content.append(Paragraph("Protocol Distribution Analysis", heading_style))
+        bar_buf = create_bar_chart(data.protocol_counts, "Top Protocols by Flow Count", '#33b5e5')
+        img2 = Image(bar_buf, width=6*inch, height=3*inch)
+        content.append(img2)
+        content.append(Spacer(1, 0.3*inch))
+        
+        # Recommendations
+        content.append(Paragraph("Security Recommendations", heading_style))
+        recommendations = [
+            "Implement rate limiting and DDoS protection for high-volume attack vectors",
+            "Enable multi-factor authentication to prevent brute force attacks",
+            "Deploy Web Application Firewall (WAF) rules for detected web attack patterns",
+            "Conduct regular security audits and penetration testing",
+            "Update intrusion detection signatures based on identified attack patterns"
+        ]
+        
+        for i, rec in enumerate(recommendations, 1):
+            content.append(Paragraph(f"{i}. {rec}", body_style))
+        
+        content.append(Spacer(1, 0.3*inch))
+        
+        # Footer
+        content.append(Spacer(1, 0.5*inch))
+        footer_style = ParagraphStyle('Footer', parent=styles['Normal'], fontSize=9, textColor=colors.grey, alignment=TA_CENTER)
+        content.append(Paragraph("This report was generated by SkyFort IDS - Network Intrusion Detection System", footer_style))
+        content.append(Paragraph(f"Report ID: RPT-{datetime.now().strftime('%Y%m%d-%H%M%S')}", footer_style))
+        
+        # Build PDF
+        doc.build(content)
+        
+        # Get PDF bytes
+        pdf_bytes = buffer.getvalue()
+        buffer.close()
+        
+        # Return as base64
+        pdf_base64 = base64.b64encode(pdf_bytes).decode('utf-8')
+        
+        return {
+            "pdf": pdf_base64,
+            "filename": f"threat_report_{datetime.now().strftime('%Y%m%d_%H%M%S')}.pdf"
+        }
+        
+    except Exception as e:
+        import traceback
+        print(traceback.format_exc())
+        raise HTTPException(status_code=500, detail=str(e))
+
+@router.post("/generate")
+async def generate_text_report(data: ReportRequest):
+    """Generate a text-based threat report"""
+    try:
+        api_key = os.getenv("GROQ_API_KEY")
+        client = Groq(api_key=api_key)
+        
+        # Prepare statistics
+        total = data.threat_statistics.get('total', 0)
+        malicious = data.threat_statistics.get('malicious', 0)
+        benign = data.threat_statistics.get('benign', 0)
+        
+        # Create attack summary string
+        attack_summary = ", ".join([f"{k}: {v}" for k, v in data.attack_counts.items()])
+        
+        prompt = f"""Generate a professional cybersecurity threat analysis report based on these statistics:
+
+Total Network Flows Analyzed: {total}
+Malicious Flows Detected: {malicious}
+Benign Flows: {benign}
+Attack Distribution: {attack_summary}
+
+Create a comprehensive report with the following sections:
+1. Executive Summary (2-3 sentences)
+2. Threat Overview (detailed analysis of detected attacks)
+3. Attack Pattern Analysis (breakdown by type)
+4. Risk Assessment
+5. Recommended Actions (5-7 specific mitigation strategies)
+6. Conclusion
+
+Format the report professionally with clear section headers. Keep it factual and actionable."""
+
+        response = client.chat.completions.create(
+            messages=[{"role": "user", "content": prompt}],
+            model="llama-3.1-8b-instant",
+            temperature=0.7,
+            max_tokens=1500
+        )
+        
+        report_text = response.choices[0].message.content
+        
+        # Add header and footer
+        full_report = f"""
+╔══════════════════════════════════════════════════════════════════╗
+║          NETWORK INTRUSION DETECTION SYSTEM (IDS)                ║
+║                  THREAT ANALYSIS REPORT                          ║
+╚══════════════════════════════════════════════════════════════════╝
+
+Generated: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}
+Report ID: RPT-{datetime.now().strftime('%Y%m%d-%H%M%S')}
+
+{report_text}
+
+═══════════════════════════════════════════════════════════════════
+This report was automatically generated by SkyFort IDS
+For questions or concerns, contact your security team
+═══════════════════════════════════════════════════════════════════
+"""
+        
+        return {"report": full_report}
+        
+    except Exception as e:
+        import traceback
+        print(traceback.format_exc())
+        raise HTTPException(status_code=500, detail=str(e))

routers/upload.py

@@ -0,0 +1,275 @@
+from fastapi import APIRouter, UploadFile, File, HTTPException
+from typing import Dict
+import pandas as pd
+import io
+import os
+import tempfile
+from routers.predict import model, predict_with_model, ATTACK_MAP
+# from utils.pcap_converter import convert_pcap_to_csv  # Temporarily commented
+import numpy as np
+
+router = APIRouter()
+
+# @router.post("/convert-pcap")
+# async def convert_pcap(file: UploadFile = File(...)):
+#     """
+#     Convert uploaded PCAP file to CSV and return it as a download
+#     """
+#     try:
+#         filename = file.filename.lower()
+#         if not (filename.endswith('.pcap') or filename.endswith('.pcapng')):
+#             raise HTTPException(status_code=400, detail="Only .pcap or .pcapng files are allowed")
+#             
+#         # Save PCAP to temp file
+#         with tempfile.NamedTemporaryFile(delete=False, suffix=os.path.splitext(filename)[1]) as tmp:
+#             content = await file.read()
+#             tmp.write(content)
+#             tmp_path = tmp.name
+#         
+#         try:
+#             # Convert to DataFrame
+#             df = convert_pcap_to_csv(tmp_path)
+#             
+#             # Convert to CSV string
+#             stream = io.StringIO()
+#             df.to_csv(stream, index=False)
+#             response = stream.getvalue()
+#             
+#             # Return as file
+#             from fastapi.responses import Response
+#             return Response(
+#                 content=response,
+#                 media_type="text/csv",
+#                 headers={"Content-Disposition": f"attachment; filename={filename}.csv"}
+#             )
+#             
+#         finally:
+#             # Cleanup temp file
+#             if os.path.exists(tmp_path):
+#                 os.remove(tmp_path)
+#                 
+#     except Exception as e:
+#         import traceback
+#         print(traceback.format_exc())
+#         raise HTTPException(status_code=500, detail=f"Error converting file: {str(e)}")
+
+@router.post("/upload")
+async def analyze_csv(file: UploadFile = File(...)):
+    """
+    Upload a CSV file and get analysis similar to dashboard stats
+    """
+    try:
+        # Validate file type
+        if not file.filename.endswith('.csv'):
+            raise HTTPException(status_code=400, detail="Only CSV files are allowed")
+        
+        # Read CSV file
+        contents = await file.read()
+        df = pd.read_csv(io.StringIO(contents.decode('utf-8')))
+        
+        # Limit to 100,000 rows for performance
+        if len(df) > 100000:
+            df = df.head(100000)
+        
+        # Validate required columns
+        required_cols = ['Protocol', 'Total Fwd Packets', 'Total Backward Packets']
+        missing_cols = [col for col in required_cols if col not in df.columns]
+        if missing_cols:
+            raise HTTPException(
+                status_code=400, 
+                detail=f"CSV is missing required columns: {', '.join(missing_cols)}"
+            )
+        
+        # Filter out non-feature columns
+        feature_cols = [col for col in df.columns if col not in ['Attack_type', 'Attack_encode']]
+        X = df[feature_cols]
+        
+        # Handle NaN values
+        X = X.fillna(0)
+        
+        # Predict
+        if model:
+            preds = predict_with_model(model, X)
+            pred_labels = [int(p) if isinstance(p, (int, float, np.number)) else int(p) for p in preds]
+            pred_names = [ATTACK_MAP.get(p, 'Unknown') for p in pred_labels]
+        else:
+            raise HTTPException(status_code=503, detail="Model not loaded")
+        
+        # Calculate statistics
+        total_flows = len(df)
+        
+        # Attack Distribution
+        attack_counts = {}
+        for name in pred_names:
+            attack_counts[name] = attack_counts.get(name, 0) + 1
+        
+        # Protocol Distribution (All)
+        protocol_counts = {}
+        if 'Protocol' in df.columns:
+            protocol_counts = df['Protocol'].value_counts().head(10).to_dict()
+        
+        # Protocol Distribution (Malicious)
+        malicious_protocol_counts = {}
+        recent_threats = []
+        
+        # Create temporary dataframe with predictions
+        temp_df = df.copy()
+        temp_df['Predicted_Attack'] = pred_names
+        
+        malicious_df = temp_df[temp_df['Predicted_Attack'] != 'Benign']
+        
+        if not malicious_df.empty:
+            if 'Protocol' in malicious_df.columns:
+                malicious_protocol_counts = malicious_df['Protocol'].value_counts().head(10).to_dict()
+            
+            # Recent Threats (last 20)
+            threats_df = malicious_df.tail(20).iloc[::-1]
+            
+            for idx, row in threats_df.iterrows():
+                recent_threats.append({
+                    "id": int(idx),
+                    "attack": row['Predicted_Attack'],
+                    "protocol": str(row['Protocol']) if 'Protocol' in row else "Unknown",
+                    "severity": "High",
+                    "fwd_packets": int(row.get('Total Fwd Packets', 0)),
+                    "bwd_packets": int(row.get('Total Backward Packets', 0))
+                })
+        
+        return {
+            "success": True,
+            "filename": file.filename,
+            "total_flows": total_flows,
+            "attack_counts": attack_counts,
+            "protocol_counts": protocol_counts,
+            "malicious_protocol_counts": malicious_protocol_counts,
+            "recent_threats": recent_threats
+        }
+        
+    except pd.errors.EmptyDataError:
+        raise HTTPException(status_code=400, detail="CSV file is empty")
+    except pd.errors.ParserError:
+        raise HTTPException(status_code=400, detail="Invalid CSV format")
+    except Exception as e:
+        import traceback
+        print(traceback.format_exc())
+        raise HTTPException(status_code=500, detail=f"Error processing file: {str(e)}")
+
+@router.post("/feature-importance")
+async def calculate_feature_importance(file: UploadFile = File(...)):
+    """
+    Calculate feature importance (SHAP values) for uploaded CSV file
+    """
+    try:
+        # Validate file type
+        if not file.filename.endswith('.csv'):
+            raise HTTPException(status_code=400, detail="Only CSV files are allowed")
+        
+        # Read CSV file
+        contents = await file.read()
+        df = pd.read_csv(io.StringIO(contents.decode('utf-8')))
+        
+        # Limit to 10,000 rows for SHAP calculation (performance)
+        if len(df) > 10000:
+            df = df.head(10000)
+        
+        # Filter out non-feature columns
+        feature_cols = [col for col in df.columns if col not in ['Attack_type', 'Attack_encode']]
+        X = df[feature_cols]
+        
+        # Handle NaN values
+        X = X.fillna(0)
+        
+        # Get feature importance from model
+        if model:
+            try:
+                feature_names = X.columns.tolist()
+                print(f"Model type: {type(model)}")
+                print(f"Model attributes: {dir(model)}")
+                
+                # Try to get feature importances using different methods
+                importances = {}
+                
+                # Method 1: Try feature_importances_ attribute (sklearn-style)
+                if hasattr(model, 'feature_importances_'):
+                    print("Using feature_importances_ attribute")
+                    importances = dict(zip(feature_names, model.feature_importances_.tolist()))
+                    print(f"Got {len(importances)} importances, sample: {list(importances.items())[:3]}")
+                    
+                # Method 2: Try get_score for XGBoost Booster
+                elif hasattr(model, 'get_score'):
+                    print("Using get_score method")
+                    # Try different importance types
+                    for importance_type in ['weight', 'gain', 'cover']:
+                        try:
+                            importance_dict = model.get_score(importance_type=importance_type)
+                            print(f"get_score({importance_type}): {list(importance_dict.items())[:3] if importance_dict else 'empty'}")
+                            if importance_dict:
+                                # Create a case-insensitive map of importance keys
+                                importance_map_lower = {k.lower(): v for k, v in importance_dict.items()}
+                                
+                                # Map f0, f1, f2... to actual feature names
+                                # OR use the feature names directly if they exist in the dict (case-insensitive)
+                                for i, fname in enumerate(feature_names):
+                                    f_key = f'f{i}'
+                                    fname_lower = fname.lower()
+                                    
+                                    if fname in importance_dict:
+                                        importances[fname] = float(importance_dict[fname])
+                                    elif fname_lower in importance_map_lower:
+                                        importances[fname] = float(importance_map_lower[fname_lower])
+                                    elif f_key in importance_dict:
+                                        importances[fname] = float(importance_dict[f_key])
+                                    else:
+                                        importances[fname] = 0.0
+                                
+                                # Debug print
+                                print(f"Mapped {len(importances)} features. Top 3: {list(importances.items())[:3]}")
+                                break
+                        except Exception as e:
+                            print(f"get_score({importance_type}) failed: {e}")
+                            continue
+                    
+                    # If still empty, try without importance_type
+                    if not importances:
+                        try:
+                            importance_dict = model.get_score()
+                            for i, fname in enumerate(feature_names):
+                                key = f'f{i}'
+                                if key in importance_dict:
+                                    importances[fname] = float(importance_dict[key])
+                                else:
+                                    importances[fname] = 0.0
+                        except:
+                            pass
+                
+                # Skip SHAP calculation - just use what we have or return zeros
+                # SHAP is too slow for real-time analysis
+                if not importances or all(v == 0 for v in importances.values()):
+                    print("No importances found, returning uniform values")
+                    # Return uniform importance as fallback (fast)
+                    importances = {fname: 1.0 for fname in feature_names}
+                
+                if importances:
+                    return {
+                        "success": True,
+                        "importances_dict": importances,
+                        "feature_count": len(importances)
+                    }
+                else:
+                    raise HTTPException(status_code=500, detail="Could not extract feature importance")
+                    
+            except Exception as e:
+                import traceback
+                print(traceback.format_exc())
+                raise HTTPException(status_code=500, detail=f"Error calculating importance: {str(e)}")
+        else:
+            raise HTTPException(status_code=503, detail="Model not loaded")
+        
+    except pd.errors.EmptyDataError:
+        raise HTTPException(status_code=400, detail="CSV file is empty")
+    except pd.errors.ParserError:
+        raise HTTPException(status_code=400, detail="Invalid CSV format")
+    except Exception as e:
+        import traceback
+        print(traceback.format_exc())
+        raise HTTPException(status_code=500, detail=f"Error processing file: {str(e)}")

utils/model_loader.py

@@ -0,0 +1,49 @@
+import os
+import joblib
+import xgboost as xgb
+import pickle
+import sys
+
+# Default model name
+MODEL_NAME = 'xgb_classifier.pkl'
+
+def load_model(model_name=MODEL_NAME):
+    # Paths to check (relative to backend directory)
+    paths_to_check = [
+        os.path.join('data', model_name),
+        os.path.join('..', 'data', model_name),
+        os.path.join('models', model_name),
+        model_name
+    ]
+    
+    model_path = None
+    for p in paths_to_check:
+        if os.path.exists(p):
+            model_path = p
+            break
+            
+    if not model_path:
+        # Fallback for development environment
+        current_dir = os.path.dirname(os.path.abspath(__file__))
+        parent_dir = os.path.dirname(current_dir)
+        model_path = os.path.join(parent_dir, 'data', model_name)
+        
+        if not os.path.exists(model_path):
+            raise FileNotFoundError(f"Model file '{model_name}' not found in data/ or other expected locations.")
+
+    try:
+        # 1. Try loading with joblib (standard for sklearn)
+        return joblib.load(model_path)
+    except:
+        try:
+            # 2. Try loading as XGBoost native
+            model = xgb.Booster()
+            model.load_model(model_path)
+            return model
+        except:
+            try:
+                # 3. Try standard pickle
+                with open(model_path, 'rb') as f:
+                    return pickle.load(f)
+            except Exception as e:
+                raise RuntimeError(f"Failed to load model '{model_name}': {e}")

utils/pcap_converter.py

@@ -0,0 +1,235 @@
+import pandas as pd
+import numpy as np
+from scapy.all import rdpcap, IP, TCP, UDP, IPv6
+import os
+from collections import defaultdict
+import statistics
+
+def safe_div(x, y):
+    return x / y if y != 0 else 0
+
+def calculate_stats(values):
+    if not values:
+        return 0, 0, 0, 0
+    return min(values), max(values), statistics.mean(values), statistics.stdev(values) if len(values) > 1 else 0
+
+def convert_pcap_to_csv(pcap_file_path):
+    """
+    Convert a PCAP file to a Pandas DataFrame with CIC-IDS-2017 like features using Scapy.
+    """
+    try:
+        # Read PCAP file
+        packets = rdpcap(pcap_file_path)
+        
+        flows = defaultdict(lambda: {
+            "src_ip": None, "dst_ip": None, "src_port": 0, "dst_port": 0, "protocol": 0,
+            "timestamps": [], "fwd_timestamps": [], "bwd_timestamps": [],
+            "fwd_pkt_lens": [], "bwd_pkt_lens": [], "all_pkt_lens": [],
+            "fwd_header_lens": [], "bwd_header_lens": [],
+            "flags": {"FIN": 0, "SYN": 0, "RST": 0, "PSH": 0, "ACK": 0, "URG": 0, "CWR": 0, "ECE": 0},
+            "fwd_flags": {"PSH": 0, "URG": 0},
+            "init_fwd_win": 0, "init_bwd_win": 0,
+            "fwd_act_data_pkts": 0, "fwd_seg_size_min": 0
+        })
+
+        for pkt in packets:
+            if IP in pkt:
+                src_ip = pkt[IP].src
+                dst_ip = pkt[IP].dst
+                proto = pkt[IP].proto
+                header_len = pkt[IP].ihl * 4
+            elif IPv6 in pkt:
+                src_ip = pkt[IPv6].src
+                dst_ip = pkt[IPv6].dst
+                proto = pkt[IPv6].nh
+                header_len = 40 # Fixed for IPv6
+            else:
+                continue
+
+            src_port = 0
+            dst_port = 0
+            payload_len = len(pkt.payload)
+            
+            if TCP in pkt:
+                src_port = pkt[TCP].sport
+                dst_port = pkt[TCP].dport
+                flags = pkt[TCP].flags
+                window = pkt[TCP].window
+            elif UDP in pkt:
+                src_port = pkt[UDP].sport
+                dst_port = pkt[UDP].dport
+                flags = None
+                window = 0
+            else:
+                continue
+
+            # Flow Key (5-tuple)
+            key = (src_ip, dst_ip, src_port, dst_port, proto)
+            rev_key = (dst_ip, src_ip, dst_port, src_port, proto)
+
+            if key in flows:
+                flow = flows[key]
+                direction = "fwd"
+            elif rev_key in flows:
+                flow = flows[rev_key]
+                direction = "bwd"
+            else:
+                flow = flows[key]
+                flow["src_ip"] = src_ip
+                flow["dst_ip"] = dst_ip
+                flow["src_port"] = src_port
+                flow["dst_port"] = dst_port
+                flow["protocol"] = proto
+                direction = "fwd"
+
+            timestamp = float(pkt.time)
+            flow["timestamps"].append(timestamp)
+            flow["all_pkt_lens"].append(payload_len)
+
+            if direction == "fwd":
+                flow["fwd_timestamps"].append(timestamp)
+                flow["fwd_pkt_lens"].append(payload_len)
+                flow["fwd_header_lens"].append(header_len)
+                if TCP in pkt:
+                    if flow["init_fwd_win"] == 0: flow["init_fwd_win"] = window
+                    if payload_len > 0: flow["fwd_act_data_pkts"] += 1
+                    flow["fwd_seg_size_min"] = header_len # Approximation
+            else:
+                flow["bwd_timestamps"].append(timestamp)
+                flow["bwd_pkt_lens"].append(payload_len)
+                flow["bwd_header_lens"].append(header_len)
+                if TCP in pkt:
+                    if flow["init_bwd_win"] == 0: flow["init_bwd_win"] = window
+
+            if TCP in pkt and flags:
+                if 'F' in flags: flow["flags"]["FIN"] += 1
+                if 'S' in flags: flow["flags"]["SYN"] += 1
+                if 'R' in flags: flow["flags"]["RST"] += 1
+                if 'P' in flags: 
+                    flow["flags"]["PSH"] += 1
+                    if direction == "fwd": flow["fwd_flags"]["PSH"] += 1
+                if 'A' in flags: flow["flags"]["ACK"] += 1
+                if 'U' in flags: 
+                    flow["flags"]["URG"] += 1
+                    if direction == "fwd": flow["fwd_flags"]["URG"] += 1
+                if 'C' in flags: flow["flags"]["CWR"] += 1
+                if 'E' in flags: flow["flags"]["ECE"] += 1
+
+        # Process flows into features
+        rows = []
+        for flow in flows.values():
+            # Basic Stats
+            total_fwd_pkts = len(flow["fwd_pkt_lens"])
+            total_bwd_pkts = len(flow["bwd_pkt_lens"])
+            total_fwd_len = sum(flow["fwd_pkt_lens"])
+            total_bwd_len = sum(flow["bwd_pkt_lens"])
+            
+            fwd_min, fwd_max, fwd_mean, fwd_std = calculate_stats(flow["fwd_pkt_lens"])
+            bwd_min, bwd_max, bwd_mean, bwd_std = calculate_stats(flow["bwd_pkt_lens"])
+            pkt_min, pkt_max, pkt_mean, pkt_std = calculate_stats(flow["all_pkt_lens"])
+
+            # Time Stats
+            duration = max(flow["timestamps"]) - min(flow["timestamps"]) if flow["timestamps"] else 0
+            if duration == 0: duration = 1e-6 # Avoid division by zero
+
+            flow_bytes_s = (total_fwd_len + total_bwd_len) / duration
+            flow_pkts_s = (total_fwd_pkts + total_bwd_pkts) / duration
+            fwd_pkts_s = total_fwd_pkts / duration
+            bwd_pkts_s = total_bwd_pkts / duration
+
+            # IAT Stats
+            flow_iats = [t2 - t1 for t1, t2 in zip(flow["timestamps"][:-1], flow["timestamps"][1:])]
+            fwd_iats = [t2 - t1 for t1, t2 in zip(flow["fwd_timestamps"][:-1], flow["fwd_timestamps"][1:])]
+            bwd_iats = [t2 - t1 for t1, t2 in zip(flow["bwd_timestamps"][:-1], flow["bwd_timestamps"][1:])]
+
+            flow_iat_min, flow_iat_max, flow_iat_mean, flow_iat_std = calculate_stats(flow_iats)
+            _, fwd_iat_max, _, fwd_iat_std = calculate_stats(fwd_iats)
+            _, bwd_iat_max, _, bwd_iat_std = calculate_stats(bwd_iats)
+
+            # Active/Idle (Simplified)
+            active_mean = 0
+            active_std = 0
+            active_max = 0
+            active_min = 0
+            idle_mean = 0
+            idle_std = 0
+            idle_max = 0
+            idle_min = 0
+            
+            if flow_iats:
+                idle_threshold = 5.0 # seconds
+                idles = [iat for iat in flow_iats if iat > idle_threshold]
+                actives = [iat for iat in flow_iats if iat <= idle_threshold]
+                
+                if idles:
+                    idle_min, idle_max, idle_mean, idle_std = calculate_stats(idles)
+                if actives:
+                    active_min, active_max, active_mean, active_std = calculate_stats(actives)
+
+            row = {
+                "Protocol": flow["protocol"],
+                "Total Fwd Packets": total_fwd_pkts,
+                "Total Backward Packets": total_bwd_pkts,
+                "Fwd Packets Length Total": total_fwd_len,
+                "Bwd Packets Length Total": total_bwd_len,
+                "Fwd Packet Length Max": fwd_max,
+                "Fwd Packet Length Min": fwd_min,
+                "Fwd Packet Length Std": fwd_std,
+                "Bwd Packet Length Max": bwd_max,
+                "Bwd Packet Length Min": bwd_min,
+                "Bwd Packet Length Std": bwd_std,
+                "Flow Bytes/s": flow_bytes_s,
+                "Flow Packets/s": flow_pkts_s,
+                "Flow IAT Mean": flow_iat_mean,
+                "Flow IAT Std": flow_iat_std,
+                "Flow IAT Max": flow_iat_max,
+                "Fwd IAT Std": fwd_iat_std,
+                "Fwd IAT Max": fwd_iat_max,
+                "Bwd IAT Std": bwd_iat_std,
+                "Bwd IAT Max": bwd_iat_max,
+                "Fwd PSH Flags": flow["fwd_flags"]["PSH"],
+                "Fwd URG Flags": flow["fwd_flags"]["URG"],
+                "Fwd Header Length": sum(flow["fwd_header_lens"]),
+                "Bwd Header Length": sum(flow["bwd_header_lens"]),
+                "Fwd Packets/s": fwd_pkts_s,
+                "Bwd Packets/s": bwd_pkts_s,
+                "Packet Length Min": pkt_min,
+                "Packet Length Max": pkt_max,
+                "Packet Length Mean": pkt_mean,
+                "Packet Length Std": pkt_std,
+                "FIN Flag Count": flow["flags"]["FIN"],
+                "SYN Flag Count": flow["flags"]["SYN"],
+                "RST Flag Count": flow["flags"]["RST"],
+                "PSH Flag Count": flow["flags"]["PSH"],
+                "ACK Flag Count": flow["flags"]["ACK"],
+                "URG Flag Count": flow["flags"]["URG"],
+                "CWE Flag Count": flow["flags"]["CWR"],
+                "ECE Flag Count": flow["flags"]["ECE"],
+                "Down/Up Ratio": safe_div(total_bwd_pkts, total_fwd_pkts),
+                "Init Fwd Win Bytes": flow["init_fwd_win"],
+                "Init Bwd Win Bytes": flow["init_bwd_win"],
+                "Fwd Act Data Packets": flow["fwd_act_data_pkts"],
+                "Fwd Seg Size Min": flow["fwd_seg_size_min"],
+                "Active Mean": active_mean,
+                "Active Std": active_std,
+                "Active Max": active_max,
+                "Active Min": active_min,
+                "Idle Mean": idle_mean,
+                "Idle Std": idle_std,
+                "Idle Max": idle_max,
+                "Idle Min": idle_min,
+                "Attack_type": "Unknown",
+                "Attack_encode": 0,
+                "mapped_label": "Unknown",
+                "severity_raw": 0,
+                "severity": "Unknown"
+            }
+            rows.append(row)
+
+        df = pd.DataFrame(rows)
+        return df
+
+    except Exception as e:
+        print(f"Error converting PCAP: {e}")
+        # Return empty DataFrame with expected columns on error
+        return pd.DataFrame()

utils/severity.py

@@ -0,0 +1,23 @@
+import numpy as np
+
+LABEL_BOOST = {
+    'benign': -2.0, 'bruteforce': 0.9, 'dos': 1.2,
+    'malware': 1.3, 'scan': 0.7, 'webattack': 1.0
+}
+
+def sigmoid(x):
+    return 1 / (1 + np.exp(-np.clip(x, -500, 500)))
+
+def get_label_boost(label: str):
+    label = label.lower()
+    for key, val in LABEL_BOOST.items():
+        if key in label:
+            return val
+    return 0.5
+
+def calculate_severity(features, attack_label):
+    values = np.array(list(features.values()))
+    weights = np.ones(len(values)) / len(values)
+
+    raw = np.dot(values, weights) + get_label_boost(attack_label) / 2
+    return float(sigmoid(raw))