Slide 1:Welcome. This is Review 1 of our capstone project, NetSentry AI: an intelligent network anomaly detection and agentic investigation system.
Slide 2:Introduce the five team members.
Slide 3:Quick roadmap of what we will cover.
Slide 4:Modern networks generate more telemetry than analysts can inspect. Existing tools raise alerts but rarely explain why an event matters. NetSentry AI bridges the gap between detection and investigation.
Slide 5:Core research question and six grouped objectives. Secondary objectives are listed at the bottom.
Slide 6:The central idea is a separation of responsibilities. ML is the detector. The LLM is used for investigation planning, synthesis and explanation, and only over tool-retrieved evidence.
Slide 7:Eight stages. Data flows left to right along the top row, then right to left along the bottom row. Each layer can be built and tested independently.
Slide 8:Flow-level records are preferred over raw payloads: smaller, more private, and aligned with behavioural features. Rolling windows per source or host reveal scanning and burst behaviour.
Slide 9:Development path: statistical baseline, Isolation Forest, One-Class SVM, optional autoencoder, XGBoost as supervised benchmark where labels exist. Compare on quality, false-positive behaviour, latency and simplicity.
Slide 10:Each anomaly triggers a graph that selects evidence, calls read-only tools, validates results, correlates with history, assesses risk, drafts the report and hands over to a human. The agent loops until evidence is sufficient. It is never given unrestricted autonomy.
Slide 11:SQLite for the prototype, PostgreSQL for expanded deployment. FastAPI exposes health, flows, anomalies, investigations, evidence, reports and prediction.
Slide 12:Live monitoring, investigation drill-down and model evaluation.
Slide 13:Each expected challenge has a concrete mitigation built into the design.
Slide 14:Ten deliverables are grouped into eight outcomes. Future enhancements extend the MVP after it is validated.
Slide 15:Summarize: ML gives a measurable first-stage signal, the event manager gates investigation, LangGraph orchestrates, tools supply facts, the LLM explains, and a human reviews. Then invite questions.
