feat: add attack path correlation and visualization engine

[KolaSailaja]

Linked issue

Closes #145

What this PR does

Implements Attack Path Correlation & Visualization for Security Findings.

This feature correlates findings from multiple scanners, generates attack chains, calculates attack path risk scores, visualizes attack progression through an interactive graph, and includes attack path artifacts in Evidence Packs.

Type of change

• Bug fix
• New feature
• ML model / training pipeline
• Refactor (no behaviour change)
• Documentation
• Tests only

ML tier (if applicable)

• Tier 1 — Triage
• Tier 2 — Predictive
• Tier 3 — Autonomous
• Not ML-related

Stack affected

• Backend
• Frontend
• Both

---

Changes

Backend

• Added attack path correlation engine
• Added attack graph generation service
• Added attack path risk scoring
• Added attack path API endpoint
• Added attack path evidence pack generation
• Added attack-paths.json export
• Added attack-graph-report.json export
• Added attack-path-summary.txt export
• Added backend tests for attack path generation and scoring

Frontend

• Added Attack Paths page
• Added interactive attack graph visualization
• Added attack path summary card
• Added node details sheet
• Added loading, empty, and error states
• Added route support for attack paths
• Added navigation entry
• Added risk score highlighting for highest-risk attack chains

New dependencies

• @xyflow/react (React Flow visualization)

Database / schema changes

• None

---

Testing

How did you test this?

• Tested attack path generation from correlated findings
• Verified attack path API responses
• Verified graph rendering with populated attack paths
• Verified empty-state behavior when no attack paths exist
• Verified error-state behavior on API failures
• Verified Evidence Pack generation includes attack path artifacts
• Ran backend and frontend validation checks

Checklist

• Tested locally end-to-end
• No new console errors or unhandled Python exceptions introduced
• Added or updated tests where applicable
• requirements.txt / package.json updated if new dependencies added
• New model files (.pkl, .pt, etc.) are gitignored, not committed
• New ML model falls back gracefully when model file is absent (Not applicable)

---

Anything reviewers should focus on

• Attack path correlation logic
• Risk score calculation
• Graph visualization behavior
• Evidence Pack artifact generation
• Frontend interaction and node detail views
• API response structure and backward compatibility

Screenshots (if UI changed)

Attack Paths Graph

• Interactive attack chain visualization
• Highest-risk path highlighting
• Node detail inspection

Empty State

• Graceful handling when no attack paths are available

Error State

• Proper error handling and recovery UI

[github-actions]

⚠️ Automated Check: This PR does not strictly follow the required template. Please ensure you have not deleted any checkboxes or mandatory headings, and that you have written explanations under What this PR does and How did you test this?.

Correct PR Template

Please copy and paste the raw template below into your PR description and fill it out:

> **Before opening:** make sure there is an issue tracking this work, and link it below. PRs without a linked issue may be closed without review.

## Linked issue

Closes #

## What this PR does



## Type of change

- [ ] Bug fix
- [ ] New feature
- [ ] ML model / training pipeline
- [ ] Refactor (no behaviour change)
- [ ] Documentation
- [ ] Tests only

## ML tier (if applicable)

- [ ] Tier 1 — Triage
- [ ] Tier 2 — Predictive
- [ ] Tier 3 — Autonomous
- [ ] Not ML-related

## Stack affected

- [ ] Backend
- [ ] Frontend
- [ ] Both

---

## Changes

### Backend



-

### Frontend



-

### New dependencies



-

### Database / schema changes



-

---

## Testing

**How did you test this?**



**Checklist**

- [ ] Tested locally end-to-end (upload ZIP or GitHub URL → scan → findings returned correctly)
- [ ] New ML model falls back gracefully when model file is absent
- [ ] No new `console.error` or unhandled Python exceptions introduced
- [ ] Added or updated tests where applicable
- [ ] `requirements.txt` / `package.json` updated if new dependencies added
- [ ] New model files (`.pkl`, `.pt`, etc.) are gitignored, not committed

---

## Anything reviewers should focus on



## Screenshots (if UI changed)

[KolaSailaja]

Hi @ionfwsrijan,

I’ve completed the implementation for Issue #145 (Attack Path Correlation & Visualization).

Completed

• Attack path correlation engine
• Attack graph generation
• Risk score calculation
• Interactive attack path visualization
• Attack path API integration
• Evidence pack artifacts
• Frontend Attack Paths page
• Node details and risk highlighting
• Loading, error, and empty states
• Backend tests and validation

Verification

• Backend tests passing
• Frontend build passing
• Lint checks passing
• No security issues detected by GitGuardian/Gitleaks

I’ve pushed the changes and opened a PR for review.

Looking forward to your feedback. Thank you!

[ionfwsrijan]

@KolaSailaja Fix failing checks

[KolaSailaja]

Ok I will verify and confirm you proper execution without failing checks