argus-detector

ARGUS — Architecture Component Detector (YOLO11)

Supervised object detector from the ARGUS project (FIAP IADT, Phase 5 Hackathon). It locates cloud/software components in architecture diagram images and classifies them into 21 cloud-agnostic canonical classes (AWS, Azure and GCP icons map to the same class). This is stage E1 of the ARGUS pipeline; the later stages (topology, DFD, STRIDE-per-element, Graph-RAG, scoring/report) operate only on the canonical classes, so only this visual stage is coupled to each cloud's iconography.

Classes (21)

• actor_user (ExternalEntity)
• edge_security (Process)
• api_gateway (Process)
• load_balancer (Process)
• compute (Process)
• serverless_fn (Process)
• app_service (Process)
• database_sql (DataStore)
• database_nosql (DataStore)
• cache (DataStore)
• object_storage (DataStore)
• file_storage (DataStore)
• message_queue (DataStore)
• cdn (Process)
• identity (Process)
• secrets (DataStore)
• search (DataStore)
• monitoring (DataStore)
• email_notify (Process)
• backend_external (ExternalEntity)
• trust_boundary (TrustBoundary)

Metrics (synthetic test set)

• mAP@50: 0.9931
• mAP@50-95: 0.9858
• Precision: 0.9878
• Recall: 0.9918

These figures are computed on a held-out split of the synthetic dataset (in-distribution). On real reference diagrams the detector recognizes most components correctly but exhibits a synthetic-to-real gap (e.g., it may confuse load balancers or external web services with the user class, or a key-vault with a database). Closing this gap with a real annotated set is planned future work.

Training data

Self-labeled synthetic dataset: official AWS/Azure/GCP architecture icons composited onto varied backgrounds with arrows, text labels and trust boundaries. Because the icon positions are known, YOLO labels are emitted automatically (no manual annotation), which makes the set scalable. Base model: yolo11s, imgsz=1280.

Usage

from ultralytics import YOLO

model = YOLO("best.pt")
results = model("diagram.png", conf=0.25, imgsz=1280)
for b in results[0].boxes:
    print(results[0].names[int(b.cls[0])], float(b.conf[0]))

Intended use & limitations

• Intended use: automatic, draft component extraction from cloud architecture diagrams, as the first stage of an automated STRIDE threat-modeling pipeline.
• Limitations: coupled to the appearance of AWS/Azure/GCP icons; generic/whiteboard diagrams or other clouds are meant to be covered by ARGUS's OCR (text-label) path, not by this detector. Outputs are drafts and should be reviewed by a human.

Links

• Project & training code: https://github.com/Zagari/argus-threat-modeling