Developer Documentation
The 6 AI Models
VPN-Sentinel utilizes a branched, multi-stage architecture. We've trained 6 distinct models (4 Random Forest classifiers and 2 SHAP explainers) that work together seamlessly depending on the traffic source.
👆 Click on any card below to see exactly how that specific model works!
Traffic Ingestion Engine
Routes traffic to Flow or Browser models based on telemetry source.
Flow Stage 1 Model
Detects VPN vs Clean on raw network packets.
Browser Stage 1 Model
Detects VPN vs Clean using WebRTC & Geo-IP context.
Flow Stage 2 Model
Fingerprints exact VPN Protocols (OpenVPN, WireGuard).
Browser Stage 2 Model
Fingerprints VPN Protocols in browser environments.
Flow SHAP Explainer
Explains exactly why the network flow was flagged.
Browser SHAP Explainer
Explains the web telemetry signals that triggered the flag.