An AI-based cyber threat detection framework
SENTRA is a research-oriented framework that combines network intrusion detection and malware classification behind a shared analyst interface, designed so the detection service can evolve independently of the UI.
Problem statement
Signature-based defences fail against polymorphic malware and novel intrusion patterns, while raw model output from ML pipelines is rarely usable by analysts. Teams end up with detections they cannot prioritise and evidence they cannot read.
SENTRA addresses the second half of that gap: turning batch model output into ranked, explained findings with confidence and risk attached to every record.
Objectives
- 01Detect and classify network intrusions from flow-level telemetry.
- 02Identify malware families from extracted static and behavioural features.
- 03Attach calibrated confidence and risk levels to every prediction.
- 04Present batch results in a form an analyst can triage in minutes.
- 05Keep the interface fully decoupled from the inference backend.
Stack
Frontend
React 19, TypeScript, TanStack Router, Tailwind CSS, Recharts.
Backend (external)
FastAPI service exposing REST endpoints for batch inference.
Data tooling
Pandas and Scikit-learn for feature engineering and preprocessing.
Detection approaches
Random Forest / XGBoost
Tabular baselines for flow-level intrusion classification.
1D CNN
Sequence model over packet and byte-level representations.
LSTM
Temporal modelling of session behaviour for evasive attacks.
Multiclass classifier
Malware family attribution over extracted feature vectors.
Future scope
Real-time streaming
Move from batch CSV uploads to live flow ingestion with websocket updates.
Explainability
Surface SHAP-style feature attributions alongside each prediction.
SOC integration
Push findings into ticketing and SIEM pipelines with analyst feedback loops.