Helios Prime - EXP-005 Sentinel-Ω™ Experiment

// 01

Mission Purpose

Sentinel-Ω was conceived as an experiment to test whether AI could unify fragmented threat ecosystems into a single analytic workflow. The lab wanted to know: could OSINT, structured indicators, sentiment signals, and multi-domain threat classification be fused into one engine, and could that engine meaningfully accelerate homeland security intelligence?

The experiment targeted five gaps documented across DHS I&A and SLTT fusion centers:

→ Fragmented threat data ecosystems → Manual triage overwhelmed by data volume → Siloed structured vs. unstructured intelligence → Slow, non-contextualized SLTT intelligence products → Limited modernization of analytic tools

Sentinel-Ω was not built to solve these gaps, it was built to test whether AI could.

// 02

ΩHorizon™ - OSINT Collection Experiment

ΩHorizon tested whether wide-area OSINT could be collected continuously, normalized automatically, and enriched with metadata without human intervention.

→ Social platforms → Fringe communities → Forums and paste sites → Code repositories → News ecosystems → Geopolitical and extremist domains

ΩHorizon supports REST APIs, RSS/ATOM, STIX/TAXII 2.1, manual uploads, and partner data feeds. Every ingested object is normalized, deduplicated, provenance-tagged, and enriched with geospatial, temporal, linguistic, and entity metadata.

// COLLECTION FINDING

ΩHorizon proved that wide-area OSINT collection was possible, but also revealed how quickly noise could overwhelm signal without downstream fusion.

// 03

ΩCore™ - Threat & Sentiment Fusion Experiment

ΩCore tested whether adversarial-resistant sentiment analysis and multi-domain threat classification could be fused into a single engine tuned for homeland security content.

→ Threat classification across 12+ national security domains → Adversarial text normalization (leet-speak, homoglyphs, padding) → Code-switching & transliteration expansion (Arabizi, Russian, Chinese, Spanish TCO slang) → Synonym & slang expansion across cyber, extremism, CI, WMD, IO → Negation-aware scoring → Irony & sarcasm detection → Amplifier/downtoner modulation → Sentence-level scoring with recency weighting → NER extraction (countries, orgs, malware, CVEs, CBRN agents, IO actors) → Threat-domain stemming → Proximity-based signal boosting

ΩCore was architected with an adapter pattern enabling seamless upgrades to ONNX or transformer-based inference without modifying downstream components, a deliberate experiment in future-proofing.

// FUSION FINDING

ΩCore demonstrated that sentiment could be made threat-aware, but also exposed how fragile models became when adversarial content evolved faster than training data.

// 04

ΩPulse™ - Scoring & Correlation Experiment

ΩPulse tested whether outputs from ΩHorizon and ΩCore could be fused into a single, explainable threat picture.

→ Cross-domain correlation → Severity scoring → Behavioral baselining → Anomaly detection → Mission-specific risk scoring → STIX/TAXII-ready indicator generation

// CORRELATION FINDING

ΩPulse showed that multi-module fusion was possible, but also revealed how easily scoring models could over-weight proximity and under-weight context.

// 05

Analyst Workbench - Interface Experiment

The Analyst Workbench tested whether analysts could work directly with AI-generated intelligence objects in a secure, browser-based environment.

→ Entity-centric investigation → Timeline and propagation analysis → Cross-source correlation → Explainable AI outputs → Analyst annotation and tagging → Export to STIX, PDF, JSON, or partner formats

// WORKBENCH FINDING

The Workbench proved that analysts would use AI-generated objects, but only when the system could explain itself and when outputs were tightly aligned to mission context.

// 06

What Sentinel-Ω Revealed

01. Fragmentation is structural, not incidental.

Threat data ecosystems are inherently fragmented. Fusion engines must assume fragmentation as a design constraint, not a temporary condition.

02. Sentiment must be threat-aware.

Generic sentiment analysis fails in homeland security contexts. Threat-aware sentiment is a distinct discipline, not a parameter tweak.

03. Explainability is non-optional.

Analysts will not trust AI outputs without clear, inspectable rationales. Fusion engines must show their work.

04. SLTT needs contextualized products.

Raw indicators are insufficient. SLTT partners need narrative, context, and clear operational relevance.

05. Fusion is an engineering problem.

Sentinel-Ω showed that fusion is not just analytic, its architectural.

// 07

Failure Logs

// SENTINEL-Ω FAILURE LOG - CYCLE 03 "Noise Wins First"

"ΩHorizon over-collected. Signal drowned in noise. Analysts spent more time filtering than analyzing. Lesson: collection without fusion is a liability."

// SENTINEL-Ω FAILURE LOG - CYCLE 05 "Sarcasm Wins Second"

"ΩCore misclassified sarcasm as endorsement. Threat scores spiked where they should have flattened. Lesson: adversarial content is not a corner case, it is the case."

// SENTINEL-Ω FAILURE LOG - CYCLE 07 "Proximity Overweights"

"ΩPulse over-weighted proximity. Nearby signals were treated as related when they were merely adjacent. Lesson: correlation must be earned, not inferred."

// SENTINEL-Ω FAILURE LOG - CYCLE 09 "The UI That Hurt"

"The Workbench exposed too much at once. Analysts were overwhelmed by options. Lesson: interface design is part of the analytic discipline, not an afterthought."

// 08

Open Questions

Sentinel-Ω answered many questions, and created new ones:

"What level of explainability is necessary for operational trust?"

// Active area of development.

"How can SLTT partners co-author fusion logic without breaking consistency?"

// Partially addressed, not yet well-characterized.

"Where should human judgment override AI scoring, and how is that encoded?"

// Emerging priority.

"What does "enough" fusion look like for a given mission?"