SentinelRisk AI

An AI-powered payment risk intelligence platform that detects suspicious transactions, explains fraud signals, and autonomously assists investigators with evidence-driven case analysis.

Comment

SentinelRisk AI

🚨 The Problem

Modern payment fraud is becoming increasingly difficult to detect using simple rule-based systems. A suspicious transaction may involve multiple signals such as unusual transaction amounts, Tor networks, VPN/proxy usage, headless browsers, emulators, rooted devices, and abnormal behavior.

The problem is not only detecting a risky transaction — investigators also need to understand why it is risky, what evidence supports the decision, and what action should be taken.

SentinelRisk AI addresses this by combining deterministic payment-risk detection with AI-assisted investigation and an auditable case-management workflow.

💡 What is SentinelRisk AI?

SentinelRisk AI is an AI-powered payment risk and fraud investigation platform designed for security and financial-risk teams.

It provides an end-to-end workflow:

Payment → Risk Detection → Evidence → AI Investigation → Case Creation → Audit Trail

The platform evaluates transactions, identifies suspicious signals, calculates a risk score, generates an investigation summary, and allows investigators to create persistent cases with an audit history.

🎯 Key Features

1. Real-Time Risk Scoring

SentinelRisk AI evaluates payment transactions using multiple risk signals and produces:

  • Risk score
  • Risk level
  • Detected signals
  • Decision rationale
  • Recommended action

The system supports LOW, MEDIUM, HIGH, and CRITICAL risk levels.

2. Multi-Signal Fraud Detection

The risk engine can identify signals including:

  • Tor network usage
  • VPN/proxy usage
  • Headless browser activity
  • Emulator usage
  • Rooted device indicators
  • Transaction anomalies
  • Behavioral and velocity-related indicators

Multiple signals can be combined to produce a higher-confidence risk decision.

3. AI Investigation

When a transaction requires investigation, SentinelRisk AI builds an evidence-based investigation.

The AI investigation layer can use Google Gemini when a Gemini API key is configured.

When Gemini is unavailable, the system automatically falls back to a deterministic investigation engine rather than fabricating an AI response.

This ensures the application remains functional even without an external AI API.

4. Explainable Decisions

Instead of simply saying that a payment is fraudulent, the system provides an explanation of the signals and evidence contributing to the risk decision.

This makes the platform useful for investigators who need to understand and review automated decisions.

5. Investigation Case Management

High-risk transactions can be converted into investigation cases.

Cases include:

  • Investigation ID
  • Transaction information
  • Risk score
  • Risk level
  • Investigation findings
  • Status
  • Decision rationale
  • Recommended action

Case status can be tracked through the investigation workflow.

6. Persistent Audit Trail

Important investigation actions are recorded in an append-only audit trail.

Examples include:

  • Case creation
  • Investigation completion
  • Case status changes

This provides traceability for security and compliance workflows.

7. Test Payment Demo

The application includes a dedicated Test Payment Demo that allows judges to demonstrate the complete workflow without processing real money.

Available scenarios include:

  • Clean UPI Payment
  • High-Value Card Payment
  • Tor Exit Node Payment
  • Headless Browser Attack
  • Velocity Burst
  • Combined Attack

The Combined Attack scenario combines multiple suspicious signals and can generate a CRITICAL risk score.

All test payments are explicitly marked as simulated/test transactions.

🧠 AI Architecture

SentinelRisk AI uses a layered architecture rather than relying entirely on an LLM.

Layer 1 — Deterministic Risk Engine

The risk engine evaluates structured transaction and device signals.

It produces a reproducible risk score and identified risk signals.

Layer 2 — Evidence Collection

Relevant transaction and risk information is collected into structured investigation evidence.

Layer 3 — AI Investigation

Google Gemini can analyze the structured evidence and produce an investigation summary, key findings, financial exposure assessment, decision rationale, limitations, and confidence.

The AI is used as an investigation assistant rather than the sole source of truth.

Layer 4 — Case Management

Investigations can be converted into persistent cases stored using SQLite.

Layer 5 — Auditability

Important actions are recorded in the audit repository so investigators can trace what happened.

🔐 Security

Security was treated as a core part of the project.

The application includes:

  • Environment-variable based secret management
  • Backend-only Gemini and payment-provider secrets
  • HMAC-SHA256 webhook verification
  • Timing-safe signature comparison
  • Parameterized SQLite queries
  • API input validation
  • Production-safe error responses
  • No sensitive secrets in frontend code
  • No sensitive secrets in logs
  • Append-only audit events
  • Simulated payment mode for demonstrations

The project also includes dedicated security tests covering webhook validation, secret exposure, SQL injection protection, API validation, Gemini security, error handling, and audit integrity.

🛠️ Technology Stack

Frontend

  • React
  • TypeScript
  • Vite
  • CSS

Backend

  • Node.js
  • TypeScript
  • Express

AI

  • Google Gemini
  • Deterministic investigation fallback

Database

  • SQLite

Testing

  • Vitest
  • Automated risk evaluation
  • Security tests
  • Integration tests
  • Persistence tests

📊 Validation

The project includes an automated evaluation benchmark for the risk engine.

The final implementation achieved:

  • 100% benchmark accuracy
  • 148 total tests in the full security-hardened version
  • Successful SQLite persistence testing
  • Successful end-to-end test payment workflow
  • Successful investigation and case creation
  • Successful audit event recording

The Test Payment Demo was also verified using multiple simulated fraud scenarios.

🏗️ Challenges We Faced

One major challenge was designing the system so that the AI layer would not become a single point of failure.

Instead of assuming Gemini would always be available, we implemented a deterministic fallback investigation engine. This allows the platform to continue producing structured investigation results when the Gemini API key is unavailable.

Another challenge was connecting the frontend demo to the complete backend workflow.

The Test Payment Demo initially exposed a response-shape mismatch that caused the interface to become blank after submitting a transaction. We traced the issue to the API response typing and corrected the frontend/backend contract.

We also encountered SQLite test isolation issues. Tests were initially sharing the same database singleton as the running backend, which could cause locking and timing problems. We introduced an isolated database override mechanism for persistence tests.

Finally, we performed a dedicated security audit and removed raw internal error messages from production API responses while keeping detailed errors available during development.

🚀 What We Learned

Through this project, we learned that a useful AI security system needs more than an LLM.

Reliable fraud investigation requires:

  1. Deterministic detection
  2. Structured evidence
  3. Explainable decisions
  4. AI-assisted reasoning
  5. Persistent case management
  6. Strong security controls
  7. Auditability

The result is a system where AI assists investigators while deterministic controls provide reliability and traceability.

🔮 Future Improvements

Future versions could include:

  • Real-time payment-provider webhook ingestion
  • Production payment gateway integration
  • Streaming transaction monitoring
  • Historical behavioral modeling
  • Graph-based fraud detection
  • Investigator collaboration
  • Role-based access control
  • Advanced anomaly detection
  • Model evaluation and monitoring
  • Human-in-the-loop approval workflows

🎬 Demonstration

The demo showcases a simulated suspicious payment moving through the complete workflow:

Submit Payment → Detect Risk → Investigate → Create Case → Review Audit Trail

No real payment is processed during the demonstration.

Built With

Share this project:

Updates