iHAIV is a human-AI teaming visual framework for analyzing temporal multivariate networks.

This repository contains no dataset, although testers are encouraged to generate synthetic demo inputs locally, or point the pipeline at self-hosted data.

# generate_sample_metrics creates synthetic data.
python3 pipeline/generate_sample_metrics.py

# builds browser/server data pack
python3 pipeline/build_graph.py \
  --metrics examples/sample/metrics.json \
  --detector examples/sample/detector.json \
  --out viz/public/data \
  --top-n-jobs 40

# start frontend
cd viz && npm install && npm run dev

# server for ai interactions
cp .env.example .env   # then edit .env
cd server && pip install -r requirements.txt
python3 -m uvicorn app:app --reload --port 8000

Open the Vite URL (usually http://localhost:5173). The UI and server both read viz/public/data.

build_graph.py expects a metrics JSON with:

• Top-level: cluster, description, start, end, interval, timestamps, nodes, node_ips, data, …
• data.CPU_Usage.series[hostname][hour] (and power / memory / temperature)
• data.Jobs_Info.jobs[] (job_id, user_name, nodes, times, …)
• data.Nodes_State.entries[], data.NodeJobs_Correlation.snapshots[] (each snapshot has parallel jobs and cpus arrays)

Run python3 pipeline/generate_sample_metrics.py once and inspect the emitted files for a full worked example of the schema.

Detector findings are a JSON array:

[{
  "ips": ["10.0.0.1"],
  "tStartUs": 1767225600000000,
  "tEndUs": 1767229200000000,
  "attackType": "internal_crypto_idle",
  "responder": "10.0.0.1",
  "users": [],
  "jobs": [],
  "reason": "...",
  "evidence": "...",
  "confidence": 0.9,
  "caseFile": []
}]

Then:

python3 pipeline/build_graph.py \
  --metrics /path/to/your_metrics.json \
  --detector /path/to/your_detector.json \
  --out viz/public/data \
  --top-n-jobs 600