Sentinel-JIT

Autonomous Just-In-Time Deception Security System

Sentinel-JIT is a cybersecurity prototype that studies attackers instead of immediately blocking them.

Traditional systems block threats instantly, which prevents defenders from understanding attacker intent. Sentinel-JIT deploys a controlled decoy environment when suspicious activity is detected, allowing the attacker to continue interacting while their behavior is logged and analyzed.

The system then generates structured intelligence reports describing the attacker’s activity and objectives.

How It Works ?

The system simulates a modern cyber-defense workflow.

1. System monitoring detects suspicious activity.
2. A risk scoring engine evaluates the severity of the behavior.
3. If the behavior is highly suspicious, a decoy system is launched.
4. The suspicious actor is redirected into the decoy.
5. The system immediately sends an alert to security personnel.
6. The attacker interacts with the decoy system.
7. All actions are recorded and analyzed.
8. A security intelligence report is generated.
9. The decoy environment is destroyed.

This approach prioritizes threat intelligence collection rather than immediate blocking.

Project Structure

File	Description
app.py	Main entry point for the Sentinel-JIT system.
risk_engine.py	Calculates risk scores for suspicious events.
alert_engine.py	Sends alerts when high-risk activity is detected.
ai_analysis.py	AI-based analysis of attacker commands and logs.
attack_simulator.py	Simulates attacker behavior for testing.
live_sim.py	Runs live interaction between attacker simulation and system.
run_demo.py	Demonstrates the full attack detection workflow.
run_dashboard.sh	Starts the monitoring dashboard.
UNDERSTANDING.md	Documentation explaining system architecture.

Dashboard Features

The Streamlit dashboard provides:

• Threat Overview Displays source IP, failed login count, command activity, risk score, and decoy trigger status.

• Command Timeline Interactive table showing attacker commands and classified attack stages.

• AI Attack Analysis Narrative report describing attacker behavior.

• Incident Report Export Downloadable report summarizing the attack session.

Output Demonstration

Sentinel-JIT continuously monitors suspicious activity, calculates a risk score, and automatically deploys a decoy environment when the risk threshold is exceeded.
The following screenshots demonstrate the system behavior during different stages of an attack.

---

1. Normal Monitoring State

System Status Attacker IP detected Failed login attempts tracked Risk score calculated Risk level classification Decoy environment status When the risk score is below the threshold, the system remains in monitoring mode and no decoy is deployed.

---

2. Decoy Deployment Trigger

Automated Response When suspicious activity increases: Risk level escalates to HIGH System automatically deploys a decoy environment Attacker is silently redirected All commands are captured and logged Security team receives alerts

---

3. Attack Intelligence & Incident Report

Threat Intelligence Generated The system analyzes attacker behavior and produces: Command execution timeline Attack stages detected AI-generated analyst report Malware activity detection Recommended incident response actions Attack stages identified may include: Reconnaissance Discovery Credential Access Malware Deployment Privilege Escalation

Future Improvements

Possible directions for extending the system:

1. Real SSH or web-server log ingestion
2. Real-time monitoring dashboard
3. Geo-IP attacker location mapping
4. Multi-attacker session tracking
5. Automated PDF incident reports

Conclusion

Sentinel-JIT demonstrates how deception-based cybersecurity can provide valuable threat intelligence instead of immediately blocking attackers. By combining risk scoring, behavioral monitoring, and AI-assisted analysis, the system observes attacker activity inside a controlled decoy environment and generates meaningful incident reports. This prototype highlights the potential of integrating automated analysis and interactive dashboards to better understand attacker strategies and improve defensive decision-making.

---