Sentinel AI

Explainable AI for Counter-Strike 2 Match Intelligence

Analyze CS2 demos, reconstruct player behavior, generate explainable evidence and detect statistical anomalies using modern behavioral analytics.

---

Overview

Sentinel AI is an open-source behavioral analysis platform for Counter-Strike 2.

Unlike traditional anti-cheat systems, Sentinel never injects into the game, never reads process memory and never interferes with gameplay.

Instead it reconstructs an entire match from a demo file and performs explainable statistical analysis of player behavior.

The result is a transparent report describing why specific actions appear unusual instead of producing an opaque "cheater / not cheater" verdict.

---

Philosophy

Sentinel is not another anti-cheat.

It is a behavioral intelligence platform.

CS2 Demo
      │
      ▼
World Reconstruction
      │
      ▼
Feature Extraction
      │
      ▼
Behavior Analysis
      │
      ▼
Evidence Engine
      │
      ▼
Explainable Report

---

Features

Source 2 Demo Support

• Source 2 parsing
• zstd compressed demos
• entity tracking
• round reconstruction
• event extraction

---

World Reconstruction

Sentinel rebuilds the entire match state.

✔ Players

✔ Teams

✔ Weapons

✔ Tick timeline

✔ Round information

✔ Event graph

---

Feature Extraction

Current implementation computes dozens of behavioral metrics including:

• Aim Velocity
• Hidden Tracking
• Rotation Justification
• Information Availability
• Solo Playstyle Index
• Team Proximity
• Trade Participation
• Utility Support
• Decision Timing
• Movement Statistics

Feature vectors are generated for every player across the entire match.

---

Explainable AI

Instead of:

Player is cheating

Sentinel produces:

Round 18

Hidden Tracking

Visibility:
No

Audio:
No

Radar:
No

Tracking Duration:
1.42 seconds

Confidence:
92%

Every anomaly is backed by evidence.

---

Quick Start

The simplest way to run Sentinel. One helper script builds the binary on first use and then runs any command — no need to remember cargo.

Linux / macOS

./run.sh analyze match.dem        # анализ (использует память, если есть)
./run.sh learn   match.dem        # анализ + обучение памяти
./run.sh memory                  # показать, чему научилось
./run.sh memory reset            # очистить память
./run.sh build                   # пересобрать

Windows

run.bat analyze match.dem
run.bat learn   match.dem
run.bat memory
run.bat memory reset

On first run the script builds the optimized binary (target/release/sentinel) automatically; afterwards every command launches instantly.

Want the raw CLI instead? See CLI below.

---

Pipeline

Source2 Demo
      │
      ▼
Demo Parser
      │
      ▼
Entity Tracking
      │
      ▼
Event Extraction
      │
      ▼
World Reconstruction
      │
      ▼
Feature Extraction
      │
      ▼
Bayesian Analysis
      │
      ▼
Evidence Engine
      │
      ▼
HTML / JSON Report

---

Self-Learning & Memory

Sentinel keeps a persistent memory in sentinel_memory.json (next to the binary) so every analyzed match makes future analysis more accurate.

How it works:

Demo
  |
  v
Feature Extraction
  |
  v
Score (using learned baselines + player history)   <--- Memory (read)
  |
  v
Report
  |
  v
Observe match -> update baselines & player profile  <--- Memory (write, `learn`)

• Learned baselines replace the hardcoded defaults once enough samples have been seen. This gives Sentinel an empirical notion of "normal" play rather than fixed thresholds.
• Per-player profiles track each SteamID across matches. A player who consistently deviates from the learned baselines builds up a recidivism signal that raises their score over time. This is what surfaces marginal cheaters who stay just under single-match thresholds.
• Everything is a single JSON file. No database, no server — sentinel learn just appends to it.

Quick start:

# 1. Build
cargo build --release

# 2. Teach Sentinel from a few legit + suspicious demos
sentinel learn demo1.dem
sentinel learn demo2.dem

# 3. Analyze normally — it now uses everything it learned
sentinel analyze match.dem

# 4. Inspect what it has learned
sentinel memory

---

Current Capabilities

✔ Source2 demo parsing

✔ Event extraction

✔ World reconstruction

✔ Feature engine

✔ Bayesian scoring

✔ Evidence generation

✔ HTML reports

✔ JSON reports

✔ CLI

✔ Dataset calibration

✔ Golden testing

✔ Statistical models

✔ Ensemble models

✔ Self-learning baselines

✔ Persistent memory

✔ Recidivism-based marginal cheater detection

---

Analysis Example

Match

Duration:
40 minutes

Ticks:
156,422

Players:
10

Events:
5,354

Feature vectors:
87,990

Evidence:
329/player

---

Player example

SV4RiC

Aim
0.119

Movement
0.192

Wall
0.369

Overall
0.225

---

Report

Sentinel generates

• HTML Report
• JSON Report

The HTML report includes

• score visualization
• category breakdown
• evidence
• player comparison
• anomaly summaries

---

Repository Structure

sentinel/

crates/

    sentinel-core

    sentinel-demo

    sentinel-events

    sentinel-world

    sentinel-map

    sentinel-visibility

    sentinel-features

    sentinel-analysis

    sentinel-memory       <- self-learning & persistent memory

    sentinel-evidence

    sentinel-report

    sentinel-datasets

    sentinel-cli

    sentinel-source2

    sentinel-validation

run.sh / run.bat          <- one-command launcher

datasets/

docs/

examples/

tris/                    <- map geometry

assets/

---

Installation

Clone

git clone https://github.com/beatzip/sentinel.git
cd sentinel

Build (or just run ./run.sh / run.bat — it builds for you on first use)

cargo build --release

The binary is target/release/sentinel. Memory is stored automatically in sentinel_memory.json next to the binary — no setup needed.

---

CLI

Analyze (uses learned baselines automatically when memory exists)

sentinel analyze match.dem

Analyze and train memory from a demo (self-learning)

sentinel learn match.dem

Show / reset persistent memory

sentinel memory
sentinel memory reset

Calibration

sentinel calibrate calibration.json

Statistics

sentinel stats vectors.json

Verification

sentinel verify

All commands work the same on Windows (sentinel.exe) and Linux (sentinel).

---

Output

reports/

match.html

match.json

---

Design Principles

Sentinel follows six core principles.

Deterministic

Same input.

Same output.

Always.

---

Explainable

Every score must have evidence.

---

Modular

Every subsystem is an independent Rust crate.

---

Testable

Golden tests

Regression tests

Calibration datasets

---

Reproducible

Results can be reproduced across machines.

---

Research Friendly

Designed for experimentation and statistical validation.

---

Performance

Typical Premier Match

Ticks

156,000+

Players

10

Events

5,000+

Feature vectors

80,000+

Analysis

<10 seconds

(depending on hardware)

---

Roadmap

Phase 1

Core Architecture

✅

---

Phase 2

Source2 Integration

✅

---

Phase 3

Behavior Analysis

✅

---

Phase 4

Evidence Engine

✅

---

Phase 5

Calibration

✅

---

Phase 6

Visibility Engine

🚧

---

Phase 7

Interactive Replay Viewer

🚧

---

Phase 8

Self-Learning & Machine Learning

✅ (self-learning baselines, persistent memory, recidivism scoring)

🚧 (XGBoost, temporal transformers)

---

Why Sentinel?

Traditional anti-cheats answer:

Is there a cheat running?

Sentinel asks:

Does this player's behavior statistically deviate from legitimate gameplay?

That distinction enables transparent, reproducible, and explainable analysis.

---

Disclaimer

Sentinel is a research and analytics platform.

It does not:

• inject into Counter-Strike 2
• modify gameplay
• bypass Valve Anti-Cheat
• inspect process memory

Anomaly scores are statistical indicators intended to assist analysis. They are not definitive proof of cheating.

---

Contributing

Contributions are welcome.

Please read

• CONTRIBUTING.md
• CODE_OF_CONDUCT.md

before opening a Pull Request.

---

License

MIT License

---

Acknowledgements

Valve

Rust Community

Open Source Contributors

Counter-Strike Community

---

Built with Rust.

Designed for explainable behavioral intelligence.