flowchart LR
    accTitle: The Realizability Gap in Adversarial NIDS
    accDescr: Feature-space attacks succeed mathematically, but most fail when forced through real TCP/IP constraints. This research measures and closes that gap.

    attack["🧮 Feature-space attack"] --> gate{"Survives real TCP/IP stack?"}
    gate -->|"most do not"| gap["❌ Realizability gap"]
    gate -->|"few do"| real["✅ Real threat"]
    gap --> work["🔬 Measure + close the gap"]
    real --> work

    classDef q fill:#fef9c3,stroke:#ca8a04,stroke-width:2px,color:#713f12
    classDef bad fill:#fde2e2,stroke:#c0392b,stroke-width:2px,color:#5a1212
    classDef good fill:#dcfce7,stroke:#16a34a,stroke-width:2px,color:#14532d
    classDef focus fill:#ede9fe,stroke:#6f42c1,stroke-width:2px,color:#3b1f6b

    class gate q
    class gap bad
    class real good
    class attack,work focus

flowchart LR
    accTitle: Wazuh SOC Home Lab Architecture
    accDescr: A five-node security monitoring lab. A Raspberry Pi runs Suricata network detection while agents on Linux and Windows hosts report to a central Wazuh SIEM server.

    net["🌐 Home Network"] --> rpi["🛡️ Raspberry Pi 4 · Suricata NIDS"]
    rpi --> sw["🔀 Switch"]
    sw --> linux["🐧 PC · Linux Agent"]
    sw --> win["🪟 PC · Windows Agent"]
    rpi -. "network alerts" .-> siem["📊 Laptop · Wazuh SIEM"]
    linux --> siem
    win --> siem

    classDef sensor fill:#fde2e2,stroke:#c0392b,stroke-width:2px,color:#5a1212
    classDef agent fill:#dbeafe,stroke:#2563eb,stroke-width:2px,color:#1e3a5f
    classDef core fill:#dcfce7,stroke:#16a34a,stroke-width:2px,color:#14532d
    classDef infra fill:#f3f4f6,stroke:#6b7280,stroke-width:1px,color:#1f2937

    class rpi sensor
    class linux,win agent
    class siem core
    class net,sw infra

flowchart LR
    accTitle: MikroTik ISP Access and Backbone Lab
    accDescr: A provider-edge router runs a PPPoE server authenticated against FreeRADIUS with deterministic CGNAT, on a tagged VLAN. A customer router has no internet path of its own and must authenticate a PPPoE session to reach the internet. The provider edge also peers over OSPF and BGP with a backbone router, which in turn peers with a simulated upstream transit AS and a simulated BDIX local exchange under a proven no-transit policy.

    net["🌐 Internet"] --> pe["🛰️ CHR-PE · Provider Edge<br/>PPPoE + FreeRADIUS · CGNAT<br/>firewall · PCQ · SNMP · Netwatch"]
    pe -- "VLAN 100 tagged" --> cpe["🏠 CHR-CPE · Customer Router<br/>PPPoE client · LAN DHCP"]
    cpe --> lan["💻 Subscriber LAN<br/>192.168.88.0/24"]
    pe -- "OSPF + iBGP, AS 65001" --> core["🧭 CHR-CORE · Backbone"]
    core -- "eBGP, AS 65002" --> upstream["☁️ CHR-UPSTREAM · simulated IIG"]
    core -- "eBGP, AS 65100 · no-transit policy" --> bdix["🔀 CHR-BDIX · simulated local exchange"]

    classDef edge fill:#ede9fe,stroke:#6f42c1,stroke-width:2px,color:#3b1f6b
    classDef cust fill:#dbeafe,stroke:#2563eb,stroke-width:2px,color:#1e3a5f
    classDef infra fill:#f3f4f6,stroke:#6b7280,stroke-width:1px,color:#1f2937
    classDef backbone fill:#fef3c7,stroke:#b45309,stroke-width:2px,color:#78350f

    class pe edge
    class cpe,lan cust
    class net infra
    class core,upstream,bdix backbone