SENTINEL

A tool to detect online anomalies primarily in social media

Comment

Inspiration

Every day, people receive messages that try to manipulate them into clicking links, revealing passwords, sharing OTPs, or reacting under pressure.

The problem is that these threats do not always look like traditional malware. A message can appear to come from a bank, contain a familiar brand name, create urgency, and ask for sensitive information all at once.

We wanted to build something that could look at the whole interaction, not just search for one suspicious word.

That idea became SENTINEL — a digital security agent designed to turn everyday messages and screenshots into understandable, actionable threat assessments.

Instead of simply saying "This looks suspicious," SENTINEL aims to answer:

  • What indicators were detected?
  • What evidence triggered them?
  • How serious is the threat?
  • Are multiple threat types connected?
  • What should the user do next?

What it does

SENTINEL analyzes potentially dangerous digital interactions from text or screenshots.

For screenshots, SENTINEL first extracts the visible text using OCR. The resulting evidence is then passed through multiple specialized threat detectors.

SENTINEL currently analyzes four major threat categories:

  • Social Engineering — detects urgency, fear, pressure, secrecy, authority impersonation, and emotional manipulation.
  • Phishing — detects suspicious links, fake verification, credential requests, OTP harvesting, fake login prompts, and brand impersonation.
  • Privacy Risk — detects requests or exposure involving sensitive information such as passwords, OTPs, credentials, email addresses, and phone numbers.
  • Abuse / Cyberbullying — detects abusive, threatening, insulting, or humiliating language.

Each detector produces structured results containing:

  • detected threat category
  • confidence
  • severity
  • indicators
  • supporting evidence
  • explanation
  • recommendations

SENTINEL then combines these results through a centralized Risk Engine.

The system can also identify relationships between threats, such as:

Phishing + Social Engineering

or:

Phishing + Sensitive Information Exposure

This allows SENTINEL to describe a message as a connected threat rather than treating every warning as an isolated event.

How we built it

We designed SENTINEL as a modular security-analysis pipeline:

Text / Screenshot
       ↓
Input Processing
       ↓
OCR (for screenshots)
       ↓
Threat Detection
       ↓
Risk Engine
       ↓
Correlations
       ↓
Explanation
       ↓
Recommendations

The project is built in Python with a modular architecture so that individual detectors can be developed, tested, and improved independently.

Core technologies

  • Python
  • Pydantic for structured detection schemas
  • Tesseract OCR / PyTesseract for screenshot text extraction
  • Regex-based threat detection for transparent and explainable indicators
  • Modular Risk Engine for multi-detector aggregation
  • Simplified CVSS-inspired scoring for structured risk assessment

A major design goal was explainability.

Instead of returning only a final label, SENTINEL stores the evidence responsible for each detection, including the matching text and its position in the original message.

For example:

PHISHING
Detected: YES
Indicator: otp_request
Evidence: "Enter your OTP"
Position: 0-14
Severity: CRITICAL

This makes the system easier to understand, debug, and improve.

Challenges we ran into

One of our biggest challenges was dealing with false positives.

A security detector cannot simply assume that mentioning a brand means impersonation, or that mentioning a security team means a scam.

For example:

"The bank security team will contact you tomorrow."

should not automatically be classified as phishing.

We therefore refined our detection logic to distinguish between:

Brand mentioned
        ≠
Brand impersonation

We encountered similar issues with terms such as "security code", where a harmless statement should not automatically become an OTP-phishing alert.

Another challenge was designing a risk engine that could combine multiple detectors without simply adding arbitrary scores together.

We also had to make screenshot analysis reliable enough to feed OCR output into the same detection pipeline as normal text.

Accomplishments that we're proud of

We are proud that SENTINEL evolved beyond a simple keyword checker into a structured, multi-stage security analysis system.

Some of the accomplishments we are especially proud of include:

  • Building four independent threat detectors with a shared schema.
  • Adding screenshot analysis through OCR.
  • Providing evidence-level explanations instead of only final classifications.
  • Building a centralized risk engine that correlates multiple threat categories.
  • Separating confidence from severity, so they represent different concepts.
  • Adding structured recommendations based on the detected threat.
  • Testing false positives and refining detection rules instead of only testing obvious malicious messages.
  • Designing the architecture so additional detectors and investigation capabilities can be added later.

The system is also deliberately modular, allowing future AI-based components to be added without rebuilding the entire architecture.

What we learned

Building SENTINEL taught us that cybersecurity detection is not just about finding suspicious words.

Context matters.

A single word such as:

Microsoft

does not automatically indicate phishing.

A stronger assessment comes from combining multiple signals:

Impersonation
      +
Urgency
      +
Verification request
      +
Credential request
      +
Suspicious link

We also learned that explainability is critical for security tools. A user needs to understand why a warning appeared, not just see a score.

Finally, we learned that building a security system requires continuous testing against both true threats and benign examples. Improving a detector is not simply about catching more attacks; it is also about avoiding unnecessary alarms.

What's next for SENTINEL

SENTINEL is designed as a foundation for a larger digital-threat intelligence platform.

Our next steps include:

  • A dedicated web interface for text and screenshot analysis.
  • A backend API connecting the analysis engine to the interface.
  • More sophisticated URL and domain analysis.
  • Stronger entity and identity analysis for impersonation detection.
  • Improved privacy and PII protection before external AI processing.
  • AI-assisted threat analysis alongside the existing transparent rule-based detectors.
  • Attack-chain visualization showing how multiple indicators combine into a potential attack.
  • A threat-intelligence dashboard for analyzing trends across multiple incidents.
  • More extensive benchmarking and false-positive testing.

Our long-term goal is for SENTINEL to move from simply detecting suspicious content to understanding the broader attack context and helping users make safer decisions before they act.

Technical note: The current system is rule-based with OCR and structured risk analysis, rather than claiming that a machine-learning/LLM model is already powering every detector. This keeps the technical description accurate and defensible while leaving room for the AI components described in What's next.

Built With

Share this project:

Updates

Submission history