SentriesAI
← SentriesAIOUR AI MODELS
OUR AI MODELS

Inside the
detection engine.

Eight independent layers. A conviction engine that evaluates evidence quality, not point totals. An XGBoost model retrained weekly. Claude LLM for contextual reasoning. Here's every technical detail.

0
Layers
independent
0
Features
engineered
0
F1 macro
3-class model
0
Samples
training data
0
Threats
intel database
SCROLL TO EXPLORE
THE ARCHITECTURE

Eight layers. One verdict.

Hover any layer to see what it analyzes, what it outputs, and where it sits in the pipeline. Data flows from top to bottom. The conviction engine combines every signal into a single explainable verdict.

INPUT →url · email · message · image
SAFE
SUSPICIOUS
SCAM
PHISHING
LAYER INSPECTOR
Hover any layer.
Details appear here — inputs, outputs, latency, and signals each layer produces.
THE ML MODEL

XGBoost, trained weekly.

A gradient boosting classifier with 44 engineered features, trained on real scan data. Each week it retrains automatically on fresh samples and hot-reloads in production.

13FEATURES
Text signals
intent · urgency_score · hasOtp
7FEATURES
URL structural
subdomainDepth · pathDepth · queryParamCount
20FEATURES
HTML / Visual
hasForm · hasExternalFormAction · hasIframe
4FEATURES
Domain context
domainAgeDays · hasSPF · hasDMARC
FEATURE IMPORTANCE
Top 10 of 44 features
0.904 F1 macro
0.968 F1 safe
0.845 F1 suspicious
0.900 F1 phishing
01
intent
0.920
02
hasPassword
0.780
03
hasLogin
0.710
04
hasExternalFormAction
0.640
05
trustedDomain
0.580
06
hasSPF
0.510
07
hasForm
0.440
08
hasOtp
0.370
09
hasIpUrl
0.340
10
hasUrgency
0.290
CONVICTION RULES

Rules, in priority order.

Evaluated top to bottom. The first rule that matches produces the verdict. If none match, the weighted default combines all layer signals.

RULE 0
SSRF Block
URL resolves to private IP or localhost
example →http://192.168.1.1/admin · http://localhost:8080
SUSPICIOUS
RULE 1
Instant Kill
Any single layer reports ≥95% phishing confidence
example →Layer 1 direct threat intel match → no further analysis needed
PHISHING
RULE 2
Trusted Domain
Domain is in Tranco top 500 + no structural threats detected
example →google.com · github.com · stripe.com · paypal.com
SAFE
RULE 2B
Established Domain Guard
Age > 1 year + SPF + DMARC + no structural threats
example →your-bank.ro · company-website.com · verified-service.io
SAFE (≤20)
RULE 3
Strong Phishing with Support
Any layer ≥75% phishing + structural corroboration
example →brd-secure-verify.cc · 97% visual clone + 3-day domain + login form
PHISHING
RULE 4
Multi-Layer Suspicion
≥2 layers at ≥35% suspicious confidence
example →get-crypto-free.xyz · ML 62% + LLM detects scam pattern + high-risk TLD
SUSPICIOUS / SCAM
RULE 5
Weighted Default
Fallback when no specific rule matches
example →Weighted combination of all layer signals with domain trust modifiers
VARIABLE
WEEKLY TRAINING PIPELINE

Every Sunday, 03:00 UTC.

Fresh data in. Smarter model out. No manual intervention. No downtime.

STEP 01
Export

Fresh scan data exported from PostgreSQL to JSONL format. Includes user feedback from the past week.

STEP 02
Rebalance

Smart relabeling — safe pages with 2+ risk signals get promoted to suspicious for harder training.

STEP 03
Train

XGBoost retrains with 44 features across 3 classes. Cross-validation reports F1 macro and per-class scores.

STEP 04
Hot reload

New model version loaded into production via POST /reload endpoint. Zero downtime, old requests complete on old model.

TECHNICAL QUESTIONS

Deeper questions.

Ready to try it?

The whole pipeline, one verdict, two seconds. Free plan includes 10 URL scans per day.

Start freeUser-facing overview →