The Model Pipeline
VPN-Sentinel uses a branched, multi-stage architecture. Five models work together depending on the traffic source: three Random Forest classifiers and two SHAP explainers.
Click on any card below to see exactly how that specific model works.
Traffic Ingestion Engine
Routes traffic to Flow or Browser models based on telemetry source.
Flow Stage 1 Model
Detects VPN vs Clean on raw network packets.
Browser Stage 1 Model
Detects VPN vs Clean using WebRTC & Geo-IP context.
Flow Stage 2 Model
Fingerprints exact VPN Protocols (OpenVPN, WireGuard).
Flow SHAP Explainer
Explains exactly why the network flow was flagged.
Browser SHAP Explainer
Explains the web telemetry signals that triggered the flag.