Sentinel: AI Security Scanner

QR and URL Security made easy

Comment

SENTINEL

AI Security Interpreter

Hackathon Track: Coding Track Project Type: Functional Security Prototype

“Sentinel doesn't just tell you whether something is suspicious. It shows you why.”

1. Project Overview

Sentinel is an explainable security analysis tool for suspicious URLs, QR codes, and messages.

It analyzes security indicators, produces a deterministic risk score from 0–100, displays the evidence behind that score, and uses a locally running AI model to translate the technical findings into plain language.

The main design principle is the separation between security assessment and AI explanation. Sentinel's security engine calculates the risk score. The AI does not calculate, modify, or override the assessment. It only explains the evidence already produced by the security engine.

Deployment Disclaimer

The public Vercel deployment of Sentinel does not currently run the Ollama/Llama AI model. Vercel hosts the Sentinel web interface and security analysis backend, while AI-generated explanations fall back to a lightweight local explanation system when Ollama is unavailable.

The full Sentinel environment can be run locally with Docker, where Ollama and Llama 3.2 3B provide the AI explanation layer.

The security risk score is calculated independently by Sentinel's deterministic security engine and is not generated or modified by the AI. This ensures that the AI explanation cannot arbitrarily change the underlying security assessment.

Public Demo: Lightweight deployment with deterministic analysis and fallback explanations. Local: Full deployment with Ollama + Llama 3.2 3B.

2. The Problem

Suspicious links are common in messages, websites, emails, and QR codes.

A URL can contain multiple technical indicators that are difficult for an ordinary user to understand. Many security tools provide a verdict such as “safe” or “dangerous” without clearly explaining the evidence behind that decision.

This can make it difficult for users to understand why a URL received a particular risk assessment.

Sentinel addresses this problem by turning security findings into an explainable report.

3. The Solution

Sentinel provides three main analysis methods:

URL Analysis

Users can submit a URL directly. Sentinel examines characteristics such as:

  • HTTP or HTTPS usage
  • IP addresses
  • Suspicious URL patterns
  • URL length
  • The @ symbol
  • Domain-like text before an @ symbol
  • Multiple subdomains
  • Non-standard ports
  • Reputation information

QR Code Analysis

Sentinel can decode a QR code and extract its destination.

The extracted URL is then passed through the same security analysis engine used for normal URLs.

Message Analysis

Sentinel can analyze a message, extract URLs from it, and send those URLs through the security engine.

This allows suspicious links inside messages to be investigated without manually analysing every URL separately.

4. What Makes Sentinel Different

Sentinel focuses on explainability.

Instead of only displaying a risk level, Sentinel shows the individual findings that contributed to the assessment.

For example, a URL might receive points because it:

  • contains multiple suspicious terms,
  • contains an @ symbol,
  • contains domain-like text before the @ symbol,
  • or uses a non-standard port.

The user can therefore see how the final score was produced.

Another important feature is the controlled use of AI.

The local AI model does not make the security decision. Sentinel's deterministic security engine makes the assessment, while the AI converts the existing evidence into simple language.

5. System Architecture

Sentinel follows this general pipeline:

User Input → Security Engine → Evidence Collection → Risk Engine → Evidence JSON → AI Explainer → Human-readable Risk Report

The backend is implemented using Flask.

URL requests are processed by the URL analyzer, which collects security findings and sends them through the scoring and evidence systems.

QR requests are first decoded using OpenCV. The extracted destination is then passed to the URL analyzer.

Message requests are processed by extracting URLs from the message and passing each URL through the same URL analysis engine.

The frontend displays the results through an interactive dashboard containing the risk score, risk level, evidence findings, matched patterns, explanations, and expandable evidence details.

6. Security Analysis Engine

Sentinel currently uses deterministic security indicators.

Indicator Behaviour
HTTP connection Adds 10 risk points
IP address Adds 20 risk points
Multiple suspicious URL patterns Adds 15 risk points
URL longer than 200 characters Adds 5 risk points
@ symbol Adds 20 risk points
Domain-like text before @ Adds 15 risk points
Many subdomains Adds 10 risk points
Non-standard port Adds 10 risk points
Malicious reputation result Adds 40 risk points
Suspicious reputation result Adds 20 risk points

The suspicious URL pattern detector currently checks terms such as:

login, verify, account, password, secure, update

Two or more matching patterns produce the corresponding finding.

These indicators are treated as evidence rather than automatic proof of malicious intent.

7. Risk Scoring

Sentinel calculates a score between 0 and 100.

Score Risk Level
0–24 LOW
25–49 MODERATE
50–74 HIGH
75–100 CRITICAL

The score is calculated by adding the points associated with the detected findings.

The final score is then limited to the range of 0–100.

The risk level is determined from the final score.

8. AI Explanation Layer

Sentinel uses Ollama with a locally running Llama 3.2 3B model.

The AI receives structured information containing:

  • The final risk score
  • The final risk level
  • Security findings
  • Finding explanations
  • Finding severity
  • Point contributions
  • Additional evidence details

The AI is instructed to explain only the evidence provided by Sentinel.

It is explicitly instructed not to:

  • Calculate the score
  • Change the risk level
  • Invent security findings
  • Discuss security features that were not detected
  • Make unsupported claims
  • Treat missing information as proof of safety

If the local AI service is unavailable, Sentinel has a deterministic mock explanation as a fallback.

9. Reputation Analysis

Sentinel can use the VirusTotal API to obtain domain reputation information.

When configured, the system checks the domain against VirusTotal and uses the returned information as additional evidence.

For example, malicious or suspicious detections can contribute risk points.

API credentials are stored through an environment variable rather than directly inside the source code.

If reputation information is unavailable, Sentinel treats this as an informational condition rather than assuming that the domain is safe.

10. Technology Stack

Component Technology
Backend Python
Web API Flask
Frontend React
Frontend language TypeScript
Build tool Vite
QR decoding OpenCV
Reputation VirusTotal API
Local AI Ollama + Llama 3.2 3B
Testing Python automated tests
Version control Git + GitHub

11. Example Assessment

One demonstration URL used during development was:

https://[email protected]:8080/login/verify/account

Sentinel detects the following indicators:

Finding Points
Multiple suspicious URL indicators: login, verify, account +15
@ symbol +20
Domain-like text before @ +15
Non-standard port 8080 +10
Total 60 / 100 — HIGH

This demonstrates Sentinel's explainability because the final score can be traced directly back to the evidence displayed by the dashboard.

12. Testing

Sentinel includes automated tests covering:

  • Normal HTTPS URLs
  • HTTP URLs
  • IP-address URLs
  • Suspicious URL patterns
  • @ symbol handling
  • Long URLs
  • Multiple subdomains
  • Non-standard ports
  • Invalid URLs
  • Empty input
  • Evidence details
  • IP-address hostname handling

Current test result: 13 tests passed.

13. Current Limitations

Sentinel is a functional prototype and has several limitations.

  • URL heuristics are indicators and are not proof of malicious intent.
  • Reputation analysis depends on the availability of the external reputation service.
  • The current message analyzer primarily focuses on extracting URLs.
  • QR analysis depends on the quality and readability of the supplied image.
  • The system is not intended to replace professional security investigation or enterprise security products.

14. Future Improvements

Future development could include:

  • Redirect-chain analysis
  • Domain-age information
  • Additional reputation sources
  • More advanced message analysis
  • Analysis history
  • Improved mobile optimisation
  • Additional URL security indicators
  • More detailed reputation information
  • Expanded QR analysis capabilities

15. Project Status

Sentinel currently provides a functional prototype containing:

  • URL security analysis
  • QR-code-to-URL analysis
  • Message URL extraction and analysis
  • Deterministic risk scoring
  • Explainable security evidence
  • Interactive evidence display
  • Local AI-generated explanations
  • Automated testing
  • GitHub source code and documentation

16. Core Philosophy

Sentinel is built around one simple principle:

Security decisions should be explainable.

Rather than simply telling users whether something is suspicious, Sentinel shows the evidence behind the assessment and translates that evidence into language that ordinary users can understand.

The security engine makes the assessment.

The AI explains it.

Sentinel doesn't just tell you whether something is suspicious. It shows you why.

Share this project:

Updates

Submission history