🛡️ Sentinel V2

Intelligent Threat Analysis for Suspicious URLs and Messages

Sentinel V2 is an evidence-driven cybersecurity intelligence application that analyzes suspicious URLs and messages to identify phishing indicators, brand impersonation patterns, social-engineering signals, and changing threat levels.

Rather than returning only a simple “safe” or “unsafe” verdict, Sentinel V2 breaks an assessment into explainable signals so users can understand why something may be risky.

---

✨ Features

🔗 URL Threat Analysis

Analyze suspicious URLs using multiple risk signals, including:

• HTTPS availability
• Suspicious top-level domains
• Sensitive phishing-related keywords
• URL structure indicators
• IP-address based URLs
• Risk scoring and severity classification

🏢 Brand Impersonation Detection

Detect potential attempts to imitate well-known brands through suspicious domain patterns.

Sentinel V2 can provide:

• Possible impersonated brand
• Similarity score
• Detection reasoning
• Brand-related risk contribution

🧠 Message Threat Analysis

Analyze suspicious messages for common social-engineering techniques such as:

• Urgency and pressure tactics
• Account or security threats
• Credential or password requests
• OTP-related requests
• Suspicious external links
• Excessive pressure punctuation

📊 Explainable Threat Intelligence

Every analysis includes:

• Threat score
• Risk level
• Number of detected signals
• Individual signal explanations
• Severity levels
• Risk contribution points

🕘 Local Scan History

Sentinel V2 stores recent scans locally so users can revisit previous analyses and review historical threat patterns.

⚔️ Scan Comparison

Compare two previous scans to identify:

• Risk score changes
• Risk-level changes
• Increasing or decreasing risk
• New threat signals
• Removed threat signals
• Generated comparison summary

---

🖥️ Interface

Sentinel V2 features a clean cybersecurity intelligence dashboard with:

• Threat Scanner
• URL analysis
• Message analysis
• Scan History
• Compare Scans
• Live local scan count
• Risk-focused result cards
• Evidence and signal breakdowns

The interface is designed around a simple principle:

Detect. Explain. Compare.

---

🧬 Project Architecture

Sentinel-V2/
│
├── app.py
├── requirements.txt
│
├── assets/
│
├── core/
│   ├── __init__.py
│   ├── url_analyzer.py
│   ├── brand_detector.py
│   ├── message_analyzer.py
│   ├── comparison_engine.py
│   └── history_manager.py
│
└── data/

Core Components

url_analyzer.py

Extracts URL characteristics and generates an evidence-based risk assessment.

brand_detector.py

Looks for suspicious domain patterns that may indicate brand impersonation.

message_analyzer.py

Detects social-engineering, credential-request, urgency, and phishing-related language.

comparison_engine.py

Compares two scans and identifies meaningful changes in risk and signals.

history_manager.py

Stores and retrieves local scan history.

---

⚙️ Installation

1. Clone the repository

git clone https://github.com/palashgoyalatwork/Sentinel-V2.git
cd Sentinel-V2

2. Create a virtual environment

python -m venv .venv

3. Activate the environment

Windows

.venv\Scripts\activate

macOS / Linux

source .venv/bin/activate

4. Install dependencies

pip install -r requirements.txt

5. Run Sentinel V2

streamlit run app.py

---

🧪 Example Analysis

Suspicious URL

http://amaz0n-secure-login.xyz/verify?account=test

Sentinel V2 can identify signals such as:

• Missing HTTPS
• Suspicious top-level domain
• Phishing-related keywords
• Possible brand impersonation

Suspicious Message

URGENT! Your account has been suspended. Verify your account immediately and enter your password within 24 hours. http://fake-login.xyz

Potential signals include:

• Urgency tactics
• Account threats
• Credential requests
• External links
• Excessive punctuation

---

📈 Threat Intelligence Philosophy

Sentinel V2 does not treat threat detection as a black box.

Each assessment is built from visible evidence:

Input
  ↓
Signal Detection
  ↓
Risk Scoring
  ↓
Evidence Explanation
  ↓
Historical Storage
  ↓
Threat Comparison

This makes the system easier to inspect, understand, and extend.

---

🛠️ Tech Stack

• Python
• Streamlit
• URL parsing and analysis
• Pattern-based threat detection
• Local JSON-based data storage

---

🚧 Current Scope

Sentinel V2 is designed as a local threat-intelligence and phishing-analysis project.

The current version focuses on explainable, signal-based analysis and does not claim to provide enterprise-grade malware detection or real-time internet reputation intelligence.

Future versions could explore:

• Threat-intelligence APIs
• Domain reputation data
• Machine-learning based classification
• Real-time phishing feeds
• Browser extension integration
• Cloud-based scan synchronization
• Advanced brand similarity analysis

---

🎯 Why Sentinel V2?

Many basic phishing checkers provide only a verdict.

Sentinel V2 focuses on the reasoning behind the verdict.

It helps answer questions such as:

• What exactly looks suspicious?
• Which signals contributed to the score?
• Is a domain potentially impersonating a known brand?
• How does the current threat compare with a previous scan?

The goal is to turn raw threat detection into explainable security intelligence.

---

👨‍💻 Author

Palash Goyal

• GitHub: @palashgoyalatwork

---

⭐ Support

If you found Sentinel V2 interesting, consider giving the repository a ⭐.

It helps the project reach more developers and security enthusiasts.

---

Sentinel V2 — Detect. Explain. Compare.