A network intrusion detection system that classifies every flow, flags attacks it has never seen before, and quarantines the source automatically.
Sentinel is a machine-learning intrusion detection system. It watches network traffic in real time, recognises known cyber-attacks, spots brand-new threats it has never seen before, and quarantines the source automatically - while a live dashboard shows an analyst everything as it happens.
Detect
Classifies every network flow against 15 known attack families.
Discover
Flags novel, never-before-seen attacks as anomalies.
Respond
Automatically quarantines repeat offenders, then releases them.
Signatures only catch yesterday's attacks.
Traditional intrusion detection matches known patterns. The moment an attacker changes their tooling — or invents something new — the alarm stays silent.
The old way
- Blind to zero-day attacks with no existing signature
- Rule sets rot — constant manual tuning to stay useful
- Alert fatigue from thousands of low-value notifications
- Detection stops at an alert — no automatic response
The Sentinel way
- Two detectors in parallel — one for known, one for unknown
- Learns what normal looks like, so novel attacks stand out
- One tuned threshold turns noise into ranked, actionable alerts
- Repeat offenders are quarantined automatically, then released
Three tiers, one protocol
Capture, decide, observe — cleanly separated so sensors scale out and any client that speaks the protocol can drive the detector.
Sensors capture flows
Live packet capture or dataset replay turns raw traffic into 78 statistical flow features and streams them as JSON over a WebSocket.
Hybrid engine decides
XGBoost names known attacks while an Isolation Forest — trained only on benign traffic — flags anything abnormal. A response engine acts on repeat offenders.
Console shows everything
Every verdict is pushed to a live operator console — threat feed, alerts, quarantine countdowns and analytics — updating in real time.
A complete detection loop
Not just a classifier — a full pipeline from capture to automated mitigation, with a human analyst kept firmly in control.
We deleted an attack from training. It still caught it.
To prove it handles threats it has never seen, we removed the DDoS-LOIC-UDP attack from the training set completely, then tested on it — a true zero-day simulation.
All 346 attack flows were labelled Benign. A model only recognises what it has already seen.
The Isolation Forest never needed to know the attack existed. Because it models normal, the unknown stood out instantly.
Honest limit: rate-based floods that look normal per-flow remain the supervised layer's job — two failure modes, two complementary defences.
Measured, not marketed
Trained and evaluated on the CSE-CIC-IDS2018 benchmark. Here is the honest per-class picture — including the classes that are genuinely hard.
Per-class F1 · XGBoost
test setWe show Infiltration at 43% on purpose. On this data it overlaps benign traffic — anything higher would be a data-leakage red flag, not a win.
A focused, production-minded stack
Every layer chosen for a reason — tree ensembles for tabular flow data, a framework-free websocket core, and a component-driven console.
Machine learning
- XGBoost
- scikit-learn
- Isolation Forest
- SMOTE
- SHAP
Real-time core
- Python websockets
- Async server
- JSON protocol
- Single port
Operator console
- Next.js
- React
- TypeScript
- Tailwind CSS
- Recharts
Data & response
- CICFlowMeter
- Scapy capture
- SQLite triage
- Auto-quarantine