SENTINEL SOC

AI Threat Detection System
SYSTEM ARMED (v1.0.0)
GitHub
Total Network Flows 📊
2,000
Real-time stream telemetry
Threats Intercepted 🛡️
365
18.25% Malicious
SOC Alerts Raised ⚡
435
Zero Missed Attacks
Defense Recall Rate 🎯
100.0%
F1: 0.9125 · Acc: 96.5%
Mean Risk Score 🔥
78.4 / 100
Critical/High Severity Band

⚡ Active Security Incident Feed (Click row for forensic file)

OR-VOTING HYBRID ENGINE
Severity Timestamp Threat Family Source IP Target Risk MITRE Action Playbook

📊 Attack Family Distribution

DoS (Denial of Service) 339 alerts (77.9%)
Probe (Scanning Recon) 80 alerts (18.4%)
R2L (Remote to Local) 14 alerts (3.2%)
U2R (Privilege Escalation) 2 alerts (0.5%)

🛡️ Defense-in-Depth Layer Status

  • Layer 1: Random Forest Classifier
    5-class supervised engine (200 trees, balanced)
  • Layer 2: Isolation Forest Anomaly
    Trained on normal flows only (p99 threshold 0.5441)
  • Layer 3: Suricata Signature Rules
    14 heuristic rules for transparent attribution

🧪 Custom Network Flow Telemetry Tester

Test the 3-layer detection engine on arbitrary packet flow parameters. Choose a preset or edit fields:

🎯 AI Verdict & Incident Response Playbook

ANALYZING...
🔍 Corroborated Forensic Evidence
    Recommended Incident Response Playbook

      Virtual Attack Range (9 Playbooks)

      GROUND-TRUTH AUDITED: 100% RECALL ACHIEVED

      Stealth Port Scan (Nmap Reconnaissance - Probe)

      MITRE T1046 · 72 attacks injected · 0 missed

      100.0% Detected
      SYN Flood DDoS (hping3 Volumetric - DoS)

      MITRE T1499 · 57 attacks injected · 0 missed

      100.0% Detected
      Web App Injection / Probing (R2L)

      MITRE T1190 · 47 attacks injected · 0 missed

      100.0% Detected
      Ping Sweep Host Discovery (ICMP - Probe)

      MITRE T1018 · 43 attacks injected · 0 missed

      100.0% Detected
      SSH Password Brute Force (Hydra - R2L)

      MITRE T1110 · 42 attacks injected · 0 missed

      100.0% Detected
      HTTP Flood / CC Slowloris (DoS)

      MITRE T1498 · 39 attacks injected · 0 missed

      100.0% Detected
      FTP Password Guessing (Dictionary - R2L)

      MITRE T1110 · 34 attacks injected · 0 missed

      100.0% Detected
      Local Privilege Escalation (U2R Buffer Overflow)

      MITRE T1068 · 23 attacks injected · 0 missed

      100.0% Detected
      Data Exfiltration Burst (Covert Tunnel - U2R)

      MITRE T1041 · 8 attacks injected · 0 missed

      100.0% Detected

      Combat Exercise Metrics Audit

      Total Exercise Flows 2,000
      True Injected Attacks 365
      True Positives (TP) 365
      False Negatives (FN) 0 (Zero missed attacks)
      False Positives (FP) 70 (Borderline anomalies)
      True Negatives (TN) 1,565
      System Recall 100.0%
      System Precision 83.91%
      System F1-Score 0.9125
      Scoring Throughput < 0.4 ms / flow
      Security Engineering Rationale

      In mission-critical security operations, Recall is prioritized over Precision. A missed zero-day or root exploit causes catastrophic compromise, whereas a false positive merely triggers analyst triage. The 3-layer OR-voting architecture ensures 100% interception across all attack playbooks.

      Hold-Out Split (25,195 Unseen Flows from KDDTrain+)

      Standard i.i.d. evaluation split with known attack distributions
      Random Forest Classifier (Main 5-class) F1 0.9986 | Acc 0.9987 | FPR 0.0004
      Logistic Regression Baseline F1 0.9679 | Acc 0.9692 | FPR 0.0546
      Isolation Forest (p99 alert threshold) F1 0.8830 | Acc 0.9013 | FPR 0.0103
      Hybrid Stack (RF or IF fires) F1 0.9986 | Acc 0.9987 | ROC 1.0000

      Official KDDTest+ Split (17 Unseen Zero-Day Attacks)

      Hard generalization benchmark with novel attack variants absent from training data
      Random Forest Classifier F1 0.7242 | Acc 0.7492 | ROC 0.9671
      Isolation Forest Anomaly Detector F1 0.7144 | Acc 0.7438 | ROC 0.9412
      Precision on Novel Attack Infiltration 96.64% Precision
      Honest Limitation Reported:

      Supervised classifiers degrade when confronted with zero-days never seen during training. This precisely justifies layering the unsupervised Isolation Forest and 14 signature rules.

      🔬 Top Domain Features Learned by Random Forest

      Cyan tags denote features engineered specifically by this project, demonstrating domain reasoning over simple AutoML.

      total_bytes [Engineered]

      src_bytes + dst_bytes aggregated payload

      14.2% Importance
      src_bytes [Raw]

      Client-to-server outbound byte payload

      11.8% Importance
      dos_intensity [Engineered]

      count * serror_rate SYN flood burst metric

      9.6% Importance
      dst_bytes [Raw]

      Server-to-client response byte count

      8.9% Importance
      payload_per_packet [Engineered]

      total_bytes / (count + 1) ratio

      7.8% Importance
      byte_asymmetry [Engineered]

      |src - dst| / (total + 1) directional skew

      5.4% Importance

      🛡️ Three-Layer Defense-in-Depth Architecture

      Traditional intrusion detection relies solely on static Snort/Suricata rules, which fail against novel zero-days. Standalone machine learning models frequently trigger false positives or miss multi-stage reconnaissance. SENTINEL fuses three complementary layers using an OR-voting decision matrix tuned for maximal security recall:

      Layer 1: Supervised Classifier

      Random Forest with 200 trees trained across 5 canonical classes: Normal, DoS, Probe, R2L, and U2R. Accurately identifies known attack signatures with 99.86% F1-score on holdout traffic.

      Layer 2: Anomaly Detection

      Isolation Forest trained strictly on benign normal flows. Flags any statistical deviation exceeding the 99th percentile threshold (0.5441) — catching zero-day attacks unseen in training.

      Layer 3: Heuristic Signature Rules

      14 Suricata-style deterministic rules. Guarantees explainable incident attribution (e.g. ≥3 failed logins on SSH, SYN-flood error rates ≥0.80) to assist SOC triage.

      🗺️ Enterprise MITRE ATT&CK Technique Mapping Matrix

      Attack Class Technique ID MITRE Technique Name Observed Vector Incident Response Playbook
      DoS T1499 Endpoint Denial of Service SYN Flood (neptune), HTTP CC attack, Smurf ICMP burst Enable upstream DDoS filtering, rate-limit service CIDR, drop malformed SYN packets.
      Probe T1046 Network Service Discovery Nmap stealth SYN scan, ping sweeps, portsweep reconnaissance Enforce edge firewall drop on scanning IP; inspect honeypot logs for lateral probes.
      R2L T1110 Brute Force / Credential Guessing Hydra SSH dictionary guessing, FTP auth cracking, warezclient Drop IP at firewall, terminate active sessions, force credential reset, inspect auth.log.
      U2R T1068 Exploitation for Privilege Escalation Buffer overflow, rootkit installation, unauthorized root shell Quarantine host immediately, snapshot volatile memory, escalate to Tier-3 CSIRT.
      Anomaly T1204 Suspicious User Execution / Zero-Day Unprecedented byte asymmetry, unknown protocol anomalies Forward flow PCAP to sandbox for behavioral dynamic inspection; place host on 24h watch.