---
license: apache-2.0
library_name: ultralytics
pipeline_tag: object-detection
tags:
  - object-detection
  - yolo11
  - ultralytics
  - threat-modeling
  - architecture-diagrams
  - stride
  - security
---

# ARGUS — Architecture Component Detector (YOLO11)

Supervised object detector from the **ARGUS** project (FIAP IADT, Phase 5 Hackathon).
It locates cloud/software components in **architecture diagram images** and classifies
them into **21 cloud-agnostic canonical classes** (AWS, Azure and GCP icons map to the
same class). This is **stage E1** of the ARGUS pipeline; the later stages (topology, DFD,
STRIDE-per-element, Graph-RAG, scoring/report) operate only on the canonical classes, so
only this visual stage is coupled to each cloud's iconography.

## Classes (21)
- `actor_user` (ExternalEntity)
- `edge_security` (Process)
- `api_gateway` (Process)
- `load_balancer` (Process)
- `compute` (Process)
- `serverless_fn` (Process)
- `app_service` (Process)
- `database_sql` (DataStore)
- `database_nosql` (DataStore)
- `cache` (DataStore)
- `object_storage` (DataStore)
- `file_storage` (DataStore)
- `message_queue` (DataStore)
- `cdn` (Process)
- `identity` (Process)
- `secrets` (DataStore)
- `search` (DataStore)
- `monitoring` (DataStore)
- `email_notify` (Process)
- `backend_external` (ExternalEntity)
- `trust_boundary` (TrustBoundary)

## Metrics (synthetic test set)
- **mAP@50**: 0.9931
- **mAP@50-95**: 0.9858
- **Precision**: 0.9878
- **Recall**: 0.9918

> These figures are computed on a held-out split of the **synthetic** dataset
> (in-distribution). On real reference diagrams the detector recognizes most components
> correctly but exhibits a **synthetic-to-real gap** (e.g., it may confuse load balancers
> or external web services with the user class, or a key-vault with a database). Closing
> this gap with a real annotated set is planned future work.

## Training data
**Self-labeled synthetic dataset**: official AWS/Azure/GCP architecture icons composited
onto varied backgrounds with arrows, text labels and trust boundaries. Because the icon
positions are known, YOLO labels are emitted automatically (no manual annotation), which
makes the set scalable. Base model: `yolo11s`, `imgsz=1280`.

## Usage
```python
from ultralytics import YOLO

model = YOLO("best.pt")
results = model("diagram.png", conf=0.25, imgsz=1280)
for b in results[0].boxes:
    print(results[0].names[int(b.cls[0])], float(b.conf[0]))
```

## Intended use & limitations
- **Intended use:** automatic, draft component extraction from cloud architecture diagrams,
  as the first stage of an automated STRIDE threat-modeling pipeline.
- **Limitations:** coupled to the appearance of AWS/Azure/GCP icons; generic/whiteboard
  diagrams or other clouds are meant to be covered by ARGUS's OCR (text-label) path, not by
  this detector. Outputs are drafts and should be reviewed by a human.

## Links
- Project & training code: https://github.com/Zagari/argus-threat-modeling