SentinelSphere: Integrating AI-Powered Real-Time Threat Detection with Cybersecurity Awareness Training
Authors: Nikolaos D. Tantaroudas, Ilias Karachalios, Andrew J. McCracken
Organizations: Institute of Communications and Computer Systems (ICCS), National Technical University of Athens, Iroon Polytechneiou 9, 15773 Zografou, Athens, Greece · National Technical University of Athens, Leof. Alimou, Katechaki, Zografou, 15772 Athens, Greece · DASKALOS-APPS, 183 Rue de l’Abbé Griffon, 01960 Péronnas, France
The field of cybersecurity is confronted with two interrelated challenges: a worldwide deficit of qualified practitioners and ongoing human-factor weaknesses that account for the bulk of security incidents. To tackle these issues, we present SentinelSphere, a platform driven by artificial intelligence that unifies machine learning-based threat identification with security training powered by a Large Language Model (LLM). The detection module uses an Enhanced Deep Neural Network (DNN) trained on the CIC-IDS2017 and CIC-DDoS2019 benchmark datasets, enriched with novel HTTP-layer feature engineering that captures application level attack signatures. For the educational component, we deploy a quantised variant of Phi-4 model (Q4_K_M), fine-tuned for the cybersecurity domain, enabling deployment on commodity hardware requiring only 16 GB of RAM without dedicated GPU resources. Experimental results show that the Enhanced DNN attains high detection accuracy while substantially lowering false positives relative to baseline models, and maintains strong recall across critical attack categories such as DDoS, brute force, and web-based exploits. Validation workshops involving industry professionals and university students confirmed that the Traffic Light visualisation system and conversational AI assistant are both intuitive and effective for users without technical backgrounds. SentinelSphere illustrates that coupling intelligent threat detection with adaptive, LLM-driven security education can meaningfully address both technical and human-factor cybersecurity vulnerabilities within a single, cohesive framework.
Figures & tables
Figure 1: High-level system architecture illustrating SentinelSphere integration with the ResilMesh stack.
Figure 2: Data flow architecture showing SentinelSphere and ResilMesh integration paths.
Figure 3: SentinelSphere Dashboard displaying the Traffic Light Assessment and Event Trends & Reports chart.
Figure 4: Traffic Light Threat Calculation equation showing the mathematical formula for computing the final threat score.
Parameter
Description
Base_Score
Initial severity based on the anomaly detection confidence score
Frequency_Multiplier
Scaling factor reflecting event frequency within a time window
Cluster_Factor
Adjustment for correlated events from related sources
IP_Factor
Weight based on source IP reputation and historical behaviour
Diversity_Factor
Modifier accounting for the variety of attack types observed
Table 1: Parameter definitions of the Traffic Light System.
Figure 5: Cybersecurity Conversation Agent, Phi-4 Model performance summary.
Figure 6: SentinelSphere Dashboard homepage with the integrated chatbot interaction panel.
Figure 7: Demonstration of the Phi-4 cybersecurity domain-specific LLM providing guidance on staying safe from cyber threats.
Figure 8: SentinelSphere Dashboard Cybersecurity Knowledge Base section.
Metric
Python
Rust
Speedup
Steady-state latency (ms/event)
12.4
2.2
5.6 ×
Batch processing (1K events, s)
14.3
3.3
4.3 ×
Batch processing (100K events, s)
1,421.0
4.36
326 ×
Memory usage (MB)
245
18
13.6 ×
Table 2: Performance comparison between Python and Rust implementations.
Component
CPU (%)
Memory (MB)
Startup (s)
Dashboard
15
512
3
Phi-4 Chatbot
45
8,192
15
Anomaly Detector (Rust)
8
18
< 1
Threat Calculator
5
64
< 1
NATS Broker
3
32
< 1
Table 3: System resource utilisation across Docker containers.
Figure 9: SentinelSphere scalability testing, processing nearly 11 million requests in approximately 30 minutes.
Metric
Baseline
Enhanced DNN
Improvement
F1 Score
0.87
0.94
+8.0%
Precision
0.85
0.95
+11.8%
Recall
0.89
0.93
+4.5%
False Positives
59
18
− 69.5%
False Negatives
12
9
− 25.0%
Table 4: Enhanced DNN model performance metrics.
Benchmark
Result
Total events processed
10,900,927
Processing duration
∼ 30 minutes
Sustained throughput
> 6,000 events/s
Concurrent connections
> 1,000 without degradation
Dashboard responsiveness under load
< 3 s update latency
Table 5: Scalability benchmarks.
Metric
Result
Pre-workshop participants
39
Post-workshop participants
36
Chatbot engagement rate
91.7%
TLS comprehension rate
91.7%
Presentation clarity (positive)
94.4%
Platform usefulness rating
88.9%
Table 6: University of Western Macedonia Educational Workshop results summary.
Information Science, University of North Texas, Denton, TX, USA · Mechanical Engineering, Bangladesh University of Eng. and Tech., BUET, Dhaka, Bangladesh
SSH Communications Security, Helsinki, Finland · Aalto University, Espoo, Finland · Networked Systems Security (NSS) Group, KTH Royal Institute of Technology, Stockholm, Sweden