feat: enhance alert aggregation and date validation

[Fidelisaboke]

User description

Description

• Adds volumetric attack detection.
• Adds new real-time dashboard widgets.
• Redesigns the network map page.
• Refactors threat synthesis logic.

Related Issue

None

Type of Change

• 🐛 Bug fix
• ✨ New feature
• 🔧 Enhancement
• 📖 Documentation update

How Has This Been Tested?

• Unit tests
• Manual testing
• Other:

Screenshots (if applicable)

Checklist

• Code follows project style guidelines
• Documentation updated
• Tests added or updated
• No new warnings/errors

---

PR Type

Enhancement, Bug fix

---

Description

• Enhanced alert aggregation with volumetric attack detection and rate limiting

• Added comprehensive date validation for alert summaries and report generation

• Improved threat synthesis logic with clearer decision tree for threat levels

• Replaced dashboard dummy components with real-time network statistics widgets

• Updated network map page with live threat data visualization

---

Diagram Walkthrough

flowchart LR
  A["Alert Aggregation"] -->|Volumetric Detection| B["Rate Limiting"]
  B -->|Burst Handling| C["Incident Grouping"]
  D["Threat Synthesis"] -->|Model Outputs| E["Threat Level Decision"]
  E -->|Critical/High/Medium| F["Alert Creation"]
  G["Dashboard"] -->|Live Data| H["Network Stats Widgets"]
  I["Network Map"] -->|Threat Data| J["Attack Sources & Targets"]

Loading

File Walkthrough

	Relevant files
Enhancement	nids.py Add volumetric attack detection and date validation            backend/api/routers/nids.py Added VOLUMETRIC_ATTACKS constant import for DoS and Mirai detection Implemented rate limiting with RATE_LIMIT_WINDOW and RATE_LIMIT_THRESHOLD constants Enhanced handle_redis_incident() with volumetric attack detection and burst handling logic Added date validation in get_alerts_summary() to check start/end dates and 1-year range limit Improved code comments for clarity +53/-6    reports.py Add date range validation for report generation                    backend/api/routers/reports.py Added comprehensive date validation in request_new_report() endpoint Validates end date is after start date, range not exceeding 30 days, and dates not in future Improved code comments for better readability +27/-3    constants.py Add volumetric attacks constant                                                    backend/utils/constants.py Added new VOLUMETRIC_ATTACKS constant containing DoS and Mirai attack types Used for identifying volumetric attacks in alert aggregation logic +3/-0      NetworkStatsWidgets.tsx Create real-time network statistics widgets                            frontend/src/app/(dashboard)/dashboard/components/NetworkStatsWidgets.tsx Created three new widget components for real-time network statistics TopAttackTypesWidget: Displays top 5 attack types with percentages and animated bars NetworkActivityWidget: Shows unique sources, destinations, total flows, and malicious traffic rate TopTargetsWidget: Lists top 5 most targeted destination IPs with attempt counts All widgets consume live threat data from useLiveThreats() hook +324/-0  page.tsx Replace dummy dashboard components with live metrics          frontend/src/app/(dashboard)/dashboard/page.tsx Replaced unused Users and Server icon imports with new widget imports Replaced dummy "System Health" and "Active Sessions" sections with real TopAttackTypesWidget, NetworkActivityWidget, and TopTargetsWidget Made "Active Threats" banner conditional to only show when threats exist Updated auto-refresh interval from 30 seconds to 2 seconds in UI text Improved layout with grid-based organization of new components +44/-118 page.tsx Transform network map to real-time threat visualization    frontend/src/app/(dashboard)/network-map/page.tsx Completely redesigned from static topology diagram to dynamic threat visualization Added three stat cards showing unique sources, attack vectors, and targeted assets Implemented "Top Attack Sources" section with ranked source IPs and attack counts Implemented "Most Targeted Assets" section with ranked destination IPs Added "Attack Type Distribution" grid showing all detected attack types All data sourced from live threats via useLiveThreats() hook Removed hardcoded node topology in favor of real-time threat data +260/-109
Bug fix	predict.py Improve threat synthesis and timezone handling                      backend/ml/models/predict.py Fixed timezone-aware datetime generation using timezone.utc Refactored threat level synthesis logic with clearer variable names and decision tree Improved threat level determination based on combined model outputs (binary, multiclass, autoencoder) Simplified code comments and removed redundant logic +30/-23
Configuration changes	run_dos.sh Optimize DoS attack demo parameters                                            backend/scripts/demo/run_dos.sh Reduced attack duration from 15 to 10 seconds Increased packet rate from 1ms to 500µs delay (2000 packets/sec) Added explicit packet count parameter (-c 20000) Improved comments and added file rotation wait time Updated dashboard expectation message +14/-11

---

The managed version of the open source project PR-Agent is sunsetting on the 1st December 2025. The commercial version of this project will remain available and free to use as a hosted service. Install Qodo.

[codiumai-pr-agent-free]

This app will be decommissioned on Dec 1st. Please remove this app and install Qodo Git.

PR Compliance Guide 🔍

(Compliance updated until commit e6e8522)

Below is a summary of compliance checks for this PR:

Security Compliance
🟢	No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed
	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Passed

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

---

Previous compliance checks

Compliance check up to commit 02a8023

Security Compliance
🟢	No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed
	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Passed

The managed version of the open source project PR-Agent is sunsetting on the 1st December 2025. The commercial version of this project will remain available and free to use as a hosted service. Install Qodo.

[codiumai-pr-agent-free]

PR Code Suggestions ✨

This app will be decommissioned on Dec 1st. Please remove this app and install Qodo Git.

Explore these optional code suggestions:

Category	Suggestion	Impact
High-level	Clarify project status before merging The PR description states the app is being decommissioned, which contradicts the significant feature enhancements in the code. This conflict regarding the project's future must be clarified before merging. Examples: frontend/src/app/(dashboard)/dashboard/components/NetworkStatsWidgets.tsx [1-324] import React from "react"; import { motion } from "framer-motion"; import { Activity, Globe, Shield, Zap } from "lucide-react"; import { useLiveThreats } from "@/hooks/useNids"; /** * Top Attack Types Widget * Shows the most common attack types from live threat data */ export const TopAttackTypesWidget: React.FC = () => { ... (clipped 314 lines) backend/api/routers/nids.py [91-124] async def handle_redis_incident(result, request, alert_service, email_service, background_tasks): """Handles Redis incident aggregation and alert creation.""" src_ip = result.get("src_ip", "unknown") dst_ip = result.get("dst_ip", "unknown") attack_type = result["multiclass"]["label"] now = datetime.now(timezone.utc) incident_key_str = f"incident:{attack_type}:{src_ip}" is_volumetric = attack_type in VOLUMETRIC_ATTACKS # Rate limit burst handling ... (clipped 24 lines) Solution Walkthrough: Before: PR Description: > This app will be decommissioned on Dec 1st. > Please remove this app and install [Qodo Git]... PR Content: - Adds volumetric attack detection. - Adds new real-time dashboard widgets. - Redesigns the network map page. - Refactors threat synthesis logic. After: PR Description: [Decommissioning notice is removed as it contradicts the work done.] ## Description This PR enhances alert aggregation and date evaluation. ... PR Content: - Adds volumetric attack detection. - Adds new real-time dashboard widgets. - Redesigns the network map page. - Refactors threat synthesis logic. Suggestion importance[1-10]: 10 __ Why: This suggestion addresses a critical, high-level contradiction between the PR's stated intent (decommissioning) and its content (major enhancements), which is a fundamental issue that must be resolved before any code review.	High
General	✅ Avoid redundant expensive calculations Suggestion Impact: The suggestion was fully implemented. The commit created a memoized avgConfidence value using React.useMemo and replaced the inline calculation with this memoized value in the UI component. code diff: + const avgConfidence = React.useMemo(() => { + if (!threats || threats.length === 0) return 0; + + const total = threats.reduce( + (sum, t) => sum + (t?.binary?.confidence ?? 0), + 0, + ); + + return (total / threats.length) * 100; + }, [threats]); + const stats = [ { label: "Unique Sources", @@ -227,14 +238,7 @@ <div className="flex items-center justify-between mb-2"> <span className="text-sm text-gray-400">Avg Confidence</span> <span className="text-sm text-white font-medium"> - {threats && threats.length > 0 - ? ( - (threats.reduce((sum, t) => sum + t.binary.confidence, 0) / - threats.length) * - 100 - ).toFixed(1) - : "0"} - % + {avgConfidence.toFixed(1)}% </span> Calculate the average confidence once using React.useMemo and reuse the value to avoid redundant calculations and improve performance. frontend/src/app/(dashboard)/dashboard/components/NetworkStatsWidgets.tsx [229-238] <span className="text-sm text-white font-medium"> - {threats && threats.length > 0 - ? ( - (threats.reduce((sum, t) => sum + t.binary.confidence, 0) / - threats.length) * - 100 - ).toFixed(1) - : "0"} - % + {avgConfidence.toFixed(1)}% </span> [Suggestion processed] Suggestion importance[1-10]: 6 __ Why: The suggestion correctly identifies a repeated calculation and proposes memoizing it, which improves both performance and code readability by avoiding redundant logic.	Low
Possible issue	✅ Remove duplicated code block Suggestion Impact: The commit directly implemented the suggestion by removing the duplicated if/else block that was determining the incident_key_str value, exactly as suggested. code diff: - if is_volumetric or burst_count > RATE_LIMIT_THRESHOLD: - # Collapse all alerts into a single key - incident_key_str = ( - f"incident:dest:{dst_ip}:{attack_type if is_volumetric else 'SuspiciousTrafficBurst'}" - ) - attack_type = attack_type if is_volumetric else "SuspiciousTrafficBurst" - else: - # Normal non-volumetric aggregation per attacker - incident_key_str = f"incident:src:{src_ip}:{attack_type}" - Remove the duplicated if/else block that determines incident_key_str to improve code clarity and maintainability. backend/api/routers/nids.py [105-123] if is_volumetric or burst_count > RATE_LIMIT_THRESHOLD: # Collapse all alerts into a single key incident_key_str = ( f"incident:dest:{dst_ip}:{attack_type if is_volumetric else 'SuspiciousTrafficBurst'}" ) attack_type = attack_type if is_volumetric else "SuspiciousTrafficBurst" else: # Normal non-volumetric aggregation per attacker incident_key_str = f"incident:src:{src_ip}:{attack_type}" -if is_volumetric or burst_count > RATE_LIMIT_THRESHOLD: - # Collapse all alerts into a single key - incident_key_str = ( - f"incident:dest:{dst_ip}:{attack_type if is_volumetric else 'SuspiciousTrafficBurst'}" - ) - attack_type = attack_type if is_volumetric else "SuspiciousTrafficBurst" -else: - # Normal non-volumetric aggregation per attacker - incident_key_str = f"incident:src:{src_ip}:{attack_type}" - [Suggestion processed] Suggestion importance[1-10]: 5 __ Why: The suggestion correctly identifies a duplicated if/else block introduced in the PR, and removing it improves code maintainability and readability.	Low
Update

The managed version of the open source project PR-Agent is sunsetting on the 1st December 2025. The commercial version of this project will remain available and free to use as a hosted service. Install Qodo.