Update README.md

README.md

@@ -27,28 +27,29 @@ The core motivation: labeled malicious samples are scarce for supervised learnin
 
 ## Repository Structure
 
+```
 graduation-project/
-├── models/ # Training notebooks and architecture-comparison experiments
-│ ├── data_preprocessing.ipynb # Preprocessing of CESNET-TLS22 and TrickBot data
-│ ├── CNN_AE.ipynb # Baseline CNN AutoEncoder
-│ ├── CNN_Conditioned.ipynb # CNN + packet-count conditioning
-│ ├── CNN_FlagCond.ipynb # CNN + TCP flag conditioning
-│ ├── DensePPI_AE.ipynb # Dense AutoEncoder (Kim & Kim baseline)
-│ ├── FlowAE.ipynb # Model based on aggregated flow-level features
-│ ├── StackedLSTM_AE.ipynb # Champion model — Stacked LSTM AutoEncoder
-│ └── fine-tuning.ipynb # Fine-tuning of the final model (L=8) on CTU-Normal-20
+├── models/                     
+│   ├── data_preprocessing.ipynb
+│   ├── CNN_AE.ipynb        
+│   ├── CNN_Conditioned.ipynb        
+│   ├── CNN_FlagCond.ipynb          
+│   ├── DensePPI_AE.ipynb           
+│   ├── FlowAE.ipynb                 
+│   ├── StackedLSTM_AE.ipynb         
+│   └── fine-tuning.ipynb            
 │
 ├── nids-system-code-final/
-│ ├── capture-service/ # Live sniffer + flow aggregator + inference engine
-│ │ └── tests/ # unit_test.py, load_test_synthetic.py
-│ ├── api-service/ # FastAPI middleware over the detections database
-│ ├── dashboard/ # Real-time monitoring dashboard (Streamlit)
-│ ├── victim/ # Nginx HTTPS server (traffic generation target)
-│ ├── tests/ # integration_test.py, security_test.py
-│ └── docker-compose.yml
+│   ├── capture-service/             
+│   │   └── tests/                  
+│   ├── api-service/                 
+│   ├── dashboard/                  
+│   ├── victim/                    
+│   ├── tests/                    
+│   └── docker-compose.yml
 │
-└── report.docx # Full graduation project report (Arabic)
-
+└── report.docx                      
+```
 
 ## Live System Architecture