Inspiration
A ransomware attack encrypts thousands of production files while your security team is still reading the alert notification. The industry-average incident response time sits at roughly 4 hours—a massive window where every single second costs enterprises financial loss, data exposure, and customer trust. I engineered Sentinel Edge to collapse that manual, delayed threat mitigation 4-hour window, into an instantaneous, safe, and intelligent response pipeline, all under 20 seconds.
As a non-developer, I also wanted to prove a broader point: with the right foundational AI partner, anyone with vision, logic, and imagination can build enterprise-grade, resilient security infrastructure. Sentinel Edge is the proof of that concept.
What It Does
Sentinel Edge is a live-deployed, autonomous cybersecurity incident response platform. When a high-severity threat occurs, such as a critical ransomware attack targeting a core finance database server, the system intercepts it instantly; it ingests raw network logs and handles end-to-end orchestration through a comprehensive 9-step response pipeline, powered natively by a 4-step Qwen AI agentic reasoning core:
Alert Ingestion: Automatically parses raw infrastructure alerts and extracts high-value indicators of compromise (IOCs).
Threat Classification: Powered by Qwen AI to classify the threat vector and map exact severity (e.g., Critical Ransomware).
Tool Selection: Powered by Qwen AI to dynamically match the incoming attack signature with specialized defensive tooling (e.g., Fail2Ban, GitGuardian, Trufflehog).
Threat Intel: Executes an asynchronous lookup via our live AbuseIPDB Model Context Protocol (MCP) integration for real-time IP reputation profiling.
Action Plan Generation: Powered by Qwen AI to synthesize granular, actionable containment playbooks.
Confidence Validation: Powered by Qwen AI to run an internal mathematical self-checking evaluation loop to validate its mitigation logic.
Campaign Correlation: Feeds processed alerts into an advanced persistent threat (APT) engine to group isolated events into unified kill chains.
Human Approval Gate: Freezes the action modules behind a strict, token-locked authorization wall until a human supervisor explicitly verifies the payload.
Containment Execution: Fires the authorized playbooks, logging every operation with deterministic timestamps for complete compliance auditing.
The Human-in-the-Loop (HITL) gate is the platform's most vital safety feature. Sentinel Edge never executes destructive mitigation rules on critical endpoints autonomously; it presents its complete, observable reasoning chain and holds, enforcing strict operational accountability.
How I Built It
AI Orchestration: Powered completely by the flagship qwen-max model via Alibaba Cloud DashScope, managing 4 sequential reasoning steps per telemetry analysis.
Threat Intelligence Network: Live AbuseIPDB API hooks executing via a custom Model Context Protocol (MCP) tool design.
Backend State Machine: Built using Python Flask and a production Gunicorn profile running a high-concurrency architecture (5 workers × 4 threads = 20 concurrent execution capacity).
Database & Analysis Engine: SQLite architecture managing persistent incident histories and driving the cross-incident APT campaign correlation engine.
Web Server Layer: Nginx reverse proxy wrapped in secure TLS/SSL transport encryption via Let's Encrypt certificates.
Cloud Infrastructure: Live-deployed on an Alibaba Cloud ECS instance (Ubuntu 22.04, hosted in the US Silicon Valley region).
Process Governance: Managed under a custom Linux systemd daemon with automated self-healing crash recovery, preserving over 430+ continuous uptime hours.
User Interface: Clean, performant Vanilla HTML/CSS/JS frontend paired with a Chart.js real-time analytics security dashboard.
Every single log entry on the production site is backed by a real Qwen API call—with over 110+ proven analyses with full reasoning chain evidence viewable live on the platform.
Challenges I Faced
The single greatest obstacle of this build was hardware access. After my laptop suffered a critical hardware failure right before the hackathon, I had to program, configure, and deploy this entire cloud security platform exclusively using Termux on an Android phone. Navigating intricate server orchestration, writing complex codebase logic, and debugging live web routing via a mobile terminal interface was highly intense, forcing me to master absolute engineering precision.
Key technical milestones achieved through this process included:
API Credentials Hardening: I accidentally exposed active API keys during an early public Git commit. I immediately executed a clean sweep, rotated both the Qwen and AbuseIPDB master keys, pruned the repository history, and instituted strict .gitignore environments.
Mobile SSL Orchestration: Running interactive certbot routines over unstable cellular data caused frequent SSH connection timeouts. I bypassed this by migrating to acme.sh and orchestrating the DuckDNS DNS-01 verification challenge to issue certificates completely headlessly.
Frontend State Desynchronization: The Human Approval Gate initially suffered from a critical UI state bug where visual success checkmarks rendered prematurely before a human clicked approve. I entirely restructured the frontend state management to lock the Action Modules strictly until a valid authentication token is returned by the server.
Correlation Self-Flagging: The campaign clustering logic initially misidentified our own application's public Alibaba Cloud server IP address as an external adversary. I engineered an explicit IP safelisting framework across all backend correlation filters to guarantee clean data telemetry.
Accomplishments I'm Proud Of
110+ Production Qwen AI Analyses: Every single security incident on the platform represents a live, structured API execution, entirely free of mocked data.
Hardened Cloud Deployment: Launching a fully secured, reverse-proxied production dashboard at sentineledge.duckdns.org maintaining 430+ hours of continuous uptime on Alibaba Cloud ECS.
Deterministic APT Clustering: Building an engine that successfully clusters isolated network vectors into clear, multi-stage cyber kill chains.
Impenetrable Safety Guardrails: Creating a functional, secure token-verified Human-in-the-Loop gate that completely mitigates the risk of catastrophic AI automated false-positives.
A 100% Mobile-Built Cloud Solution: Proving that with clear logic, strong design thinking, and imagination, true production-grade cloud infrastructure can be built and launched entirely from an Android terminal.
What I Learned
Qwen AI possesses remarkable domain-specific reasoning depth; the quality and structural output of its 4-step chain easily matches the analytical output of intermediate or senior SOC analysts.
Human oversight is an architecture's strength, not a latency weakness. Integrating an ironclad human gate is what transitions an AI prototype into a trustworthy tool viable for conservative enterprise environments.
Production engineering is far more complex than application prototyping. Hardening reverse proxies, managing environment variables, and establishing continuous systemd services require deliberate structural patience.
Live threat telemetry transforms an assistant's value. Watching an AI agent combine real-world indicators like an AbuseIPDB score on an active Tor exit node provides immediate, actionable defensive context.
What's Next for Sentinel Edge
Multi-Tenant Enterprise SaaS: Implementing strict user authentication layers and isolated data tenancy pathways for multi-organization routing.
Instant Incident Alerting Channels: Integrating outbound Webhook modules for immediate, automated Slack payloads and SMS paging when critical threats trigger.
Native SIEM Connectors: Developing standardized integration pipelines for legacy enterprise data lakes including Splunk and Microsoft Sentinel.
Secure Mobile Operator Portal: Building a lightweight, progressive web app (PWA) so authorized mobile analysts can review Qwen reasoning paths and securely pass containment keys from anywhere.
Adding support for distributed container orchestrators like Kubernetes, expanding the threat hunting dataset for custom enterprise log layouts, and integrating deeper automated backup recovery workflows for ransomware recovery.
Log in or sign up for Devpost to join the conversation.