SentinelFlow is a lightweight, behavior-based network traffic monitoring and anomaly detection system built with Python, FastAPI, and Scapy.
The project simulates enterprise-style network monitoring by collecting live traffic metrics, analyzing packet behavior, detecting suspicious activity patterns, and generating real-time risk alerts through a centralized dashboard.
- Real-time network traffic collection
- System bandwidth and packet statistics
- Continuous monitoring of active network behavior
- TCP SYN packet detection
- Unique destination port tracking
- Basic port-scan behavior analysis
- Traffic spike detection
- Idle-to-noisy behavior monitoring
- SYN flood–like activity alerts
- Risk scoring engine using sliding-window analysis
- Live monitoring dashboard
- Color-coded risk scoring
- Agent hostname and activity tracking
- Last alert and status visualization
- Python 3
- FastAPI
- Scapy
- psutil
- Uvicorn
- JSON / REST APIs
SentinelFlow consists of two core components:
The Python-based agent runs on a monitored node and collects:
- Network usage metrics
- Packet-level traffic signals
- System activity statistics
The FastAPI server:
- Receives telemetry data from agents
- Computes behavioral risk scores
- Detects anomalies and suspicious activity
- Displays results in a live dashboard
Current detection logic includes:
- Traffic spike analysis
- SYN flood–style behavior detection
- Port scan pattern recognition
- Baseline deviation monitoring
- Real-time anomaly scoring
# Clone repository
git clone https://github.com/SelimAtambaev/sentineflow.git
# Enter project directory
cd sentineflow
# Create virtual environment
python3 -m venv venv
# Activate environment
source venv/bin/activate
# Install dependencies
pip install -r requirements.txt
# Start FastAPI server
uvicorn server.main:app --reload- Docker container deployment
- WebSocket live updates
- Email / Discord alert integration
- Machine learning anomaly detection
- Multi-agent enterprise scaling
- Threat intelligence feeds
This project was developed to strengthen practical skills in:
- Cybersecurity monitoring
- Network traffic analysis
- System administration
- Threat detection concepts
- Backend API development
Selim Atambaev
Computing & Security Technology Student
Drexel University