Sentinel-ai

Sentinel AI

SOC analysts drown in thousands of daily alerts — and while they chase noise, real attackers escalate and exfiltrate data undetected. That's alert fatigue, and it's a data problem.

Sentinel AI, built on the UNSW-NB15 intrusion dataset, tackles it in three steps: deduplicates noisy alerts, correlates related events into unified incidents using weighted multi-factor similarity, and explains every decision — no black box. Result: raw alert floods (e.g., 3,000) collapse into a handful of actionable incidents (e.g., 12), cutting analyst response time from hours to seconds.

Not a replacement for analysts — a force multiplier that lets them focus on the threats that actually matter.

What I learned

What I learned from this project

Working with the UNSW-NB15 dataset taught me that the hard part of security isn't detecting threats — it's separating signal from noise at scale. I learned how to design similarity-based correlation logic (weighing multiple factors like source, timing, and behavior) instead of relying on simple rule-matching, and why explainability matters as much as accuracy — a model that flags threats without justifying why won't be trusted by real analysts.

Beyond the technical side, it reframed how I think about AI's role: not as a replacement for human judgment, but as a filter that protects human attention for the decisions that actually need it.

Consultant Acknowledgment

Special thanks to Mr. Jujare Anirudh Karthik for his guidance as a consultant. He helped us navigate the AI development process, use AI tools efficiently, and refine our approach to building this cybersecurity prototype.

Thank you for your valuable support and insights.