% Pcap → packet stream → 9-d feature token extraction visual.
% Compile:  pdflatex pcap_extraction.tex
\documentclass[border=8pt]{standalone}
\usepackage{tikz}
\usetikzlibrary{arrows.meta, positioning, calc, shapes.misc, decorations.pathreplacing}
\usepackage{amsmath, amssymb}

\definecolor{myorange}{RGB}{230, 126, 34}
\definecolor{myblue}{RGB}{52, 110, 180}
\definecolor{mygreen}{RGB}{46, 139, 87}
\definecolor{mypurple}{RGB}{142, 68, 173}
\definecolor{mygray}{RGB}{170, 170, 170}

\begin{document}
\begin{tikzpicture}[font=\small, >={Stealth[length=2.5mm]}]

% ============ 1. PCAP FILE ICON ============
\begin{scope}[shift={(0,0)}]
  % file body with folded corner (drawn as polygon)
  \fill[myblue!12] (0,0) -- (0,3.0) -- (1.4,3.0) -- (1.9,2.5) -- (1.9,0) -- cycle;
  \draw[myblue!80, line width=0.7pt]
        (0,0) -- (0,3.0) -- (1.4,3.0) -- (1.9,2.5) -- (1.9,0) -- cycle;
  % the folded triangle on top-right corner
  \fill[myblue!30] (1.4,3.0) -- (1.4,2.5) -- (1.9,2.5) -- cycle;
  \draw[myblue!80, line width=0.5pt] (1.4,3.0) -- (1.4,2.5) -- (1.9,2.5);
  % file title
  \node[font=\bfseries\footnotesize, text=myblue!90!black] at (0.95, 2.1) {flow.pcap};
  % decorative "byte" lines (deterministic widths)
  \foreach \y/\rl in {1.65/1.30, 1.40/1.05, 1.15/1.40, 0.90/0.85, 0.65/1.20, 0.40/0.75} {
    \draw[myblue!45, line width=0.35pt] (0.18, \y) -- (0.18+\rl, \y);
  }
  \node[font=\scriptsize, anchor=north] at (0.95, -0.1) {raw bytes};
\end{scope}

% Arrow 1: parse
\draw[->, thick, black!60]
      (2.05, 1.5) -- (3.20, 1.5)
      node[midway, above, font=\scriptsize\itshape, text=black!70] {dpkt parse};

% ============ 2. DECODED PACKET STREAM ============
\begin{scope}[shift={(3.4, 0)}]
  % four packets along time axis
  \foreach \j in {0,...,3} {
    \pgfmathsetmacro{\xx}{\j * 1.45}
    % packet frame
    \draw[fill=white, draw=black!55, line width=0.5pt, rounded corners=1pt]
          (\xx, 0.5) rectangle (\xx+1.25, 3.05);
    % size field (myblue)
    \draw[fill=myblue!35, draw=myblue, line width=0.4pt]
          (\xx+0.08, 2.78) rectangle (\xx+0.42, 2.93);
    \node[font=\tiny, anchor=west] at (\xx+0.45, 2.86) {size};
    % IAT field (mygreen)
    \draw[fill=mygreen!35, draw=mygreen, line width=0.4pt]
          (\xx+0.08, 2.55) rectangle (\xx+0.42, 2.70);
    \node[font=\tiny, anchor=west] at (\xx+0.45, 2.63) {IAT};
    % direction (mypurple)
    \draw[fill=mypurple!35, draw=mypurple, line width=0.4pt]
          (\xx+0.08, 2.32) rectangle (\xx+0.22, 2.47);
    \node[font=\tiny, anchor=west] at (\xx+0.25, 2.40) {dir};
    % flag bits row — show a real TCP 3-way handshake + data:
    %   pkt0: SYN          (client SYN)
    %   pkt1: SYN+ACK       (server SYN-ACK)
    %   pkt2: ACK           (client ACK, handshake done)
    %   pkt3: PSH+ACK       (data segment)
    \ifcase\j
      \def\flagS{1}\def\flagF{0}\def\flagR{0}\def\flagP{0}\def\flagA{0}\or
      \def\flagS{1}\def\flagF{0}\def\flagR{0}\def\flagP{0}\def\flagA{1}\or
      \def\flagS{0}\def\flagF{0}\def\flagR{0}\def\flagP{0}\def\flagA{1}\or
      \def\flagS{0}\def\flagF{0}\def\flagR{0}\def\flagP{1}\def\flagA{1}\fi
    \foreach \fname/\fval/\k in {S/\flagS/0, F/\flagF/1, R/\flagR/2, P/\flagP/3, A/\flagA/4} {
      \pgfmathsetmacro{\fx}{\xx + 0.08 + \k*0.22}
      \ifnum\fval=1
        \draw[fill=myorange!70, draw=myorange, line width=0.4pt]
              (\fx, 2.05) rectangle (\fx+0.18, 2.22);
        \node[font=\tiny, white] at (\fx+0.09, 2.135) {\fname};
      \else
        \draw[fill=white, draw=myorange!60, line width=0.4pt]
              (\fx, 2.05) rectangle (\fx+0.18, 2.22);
        \node[font=\tiny, text=myorange!80!black] at (\fx+0.09, 2.135) {\fname};
      \fi
    }
    % win
    \draw[fill=myblue!20, draw=myblue!60, line width=0.4pt]
          (\xx+0.08, 1.78) rectangle (\xx+0.42, 1.93);
    \node[font=\tiny, anchor=west] at (\xx+0.45, 1.86) {win};
    % decorative "payload" content
    \draw[black!30, line width=0.4pt] (\xx+0.08, 1.45) -- (\xx+1.17, 1.45);
    \draw[black!30, line width=0.4pt] (\xx+0.08, 1.25) -- (\xx+0.95, 1.25);
    \draw[black!30, line width=0.4pt] (\xx+0.08, 1.05) -- (\xx+1.10, 1.05);
    \draw[black!30, line width=0.4pt] (\xx+0.08, 0.85) -- (\xx+0.75, 0.85);
    % packet label below
    \node[font=\scriptsize, text=black!70] at (\xx+0.625, 0.32) {pkt$_\j$};
  }
  % time axis arrow
  \draw[->, line width=0.4pt, black!60] (-0.05, 0.05) -- (6.0, 0.05);
  \node[font=\tiny, anchor=west, text=black!60] at (6.05, 0.05) {time};
\end{scope}

% Arrow 2: extract
\draw[->, thick, black!60]
      (9.5, 1.7) -- (10.7, 1.7)
      node[midway, above, font=\scriptsize\itshape, text=black!70] {extract};

% ============ 3. 9-D FEATURE TOKEN ============
\begin{scope}[shift={(10.85, -0.5)}]
  % 9 channels stacked vertically with type-grouped coloring
  % 0 = continuous (z-scored), 1 = discrete (DFM bit)
  \foreach \name/\g/\i in {%
      log\_size/0/0,
      log\_dt/0/1,
      direction/1/2,
      SYN/1/3,
      FIN/1/4,
      RST/1/5,
      PSH/1/6,
      ACK/1/7,
      log\_win/0/8} {
    \pgfmathsetmacro{\yp}{3.5 - \i*0.36}
    \ifnum\g=0
      \draw[fill=myblue!25, draw=myblue, line width=0.5pt]
            (0, \yp) rectangle (1.35, \yp+0.32);
    \else
      \draw[fill=myorange!30, draw=myorange, line width=0.5pt]
            (0, \yp) rectangle (1.35, \yp+0.32);
    \fi
    \node[font=\scriptsize] at (0.675, \yp+0.16) {\name};
  }
  % brace + label
  \draw[decorate, decoration={brace, amplitude=4pt}, line width=0.5pt, black!60]
        (1.45, 3.82) -- (1.45, 0.62)
        node[midway, right=4pt, font=\scriptsize, align=left, text=black!70]
        {9-d packet token\\[1pt] {[}cont (3) + disc (6){]}};
\end{scope}

% Bottom legend
\node[draw=black!30, rounded corners=2pt, fill=white, inner sep=4pt, font=\scriptsize,
      align=left, anchor=north]
  at (7.5, -1.1) {%
    \tikz\fill[myblue!25, draw=myblue, line width=0.4pt] (0,0) rectangle (0.25,0.18);
    \ continuous (z-scored) \quad
    \tikz\fill[myorange!30, draw=myorange, line width=0.4pt] (0,0) rectangle (0.25,0.18);
    \ discrete (kept as bits, fed to DFM head)};

\end{tikzpicture}
\end{document}
