Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{196682,
        author = {MADHAVA SAI PRAVEEN MANTINA and NAVEEN MANTRI and RAKESH NAIDU MEESALA and SAI KOWSHIK PUSARLA},
        title = {SENTRY-DOC: A Real-Time File Activity Monitoring and Machine Learning-Based Anomaly Detection Framework for Endpoint Security},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {12},
        number = {11},
        pages = {4631-4642},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=196682},
        abstract = {With the rapid growth of digital systems and organizational data usage, protecting sensitive information from unauthorized access and malicious manipulation has become a critical challenge. Traditional security mechanisms primarily focus on network-level protection, while activities occurring within local file systems often remain insufficiently monitored. This limitation creates opportunities for insider threats, unauthorized file modifications, and data exfiltration that may go undetected for extended periods. To address this issue, this paper presents SENTRY-DOC, a real-time file activity monitoring and anomaly detection framework designed to enhance endpoint security through intelligent behavioral analysis.
The proposed system continuously observes file system activities such as file creation, deletion, modification, and access events within monitored directories. These events are captured in real time and processed through a monitoring engine that records detailed activity logs. A machine learning–based anomaly detection component is then applied to analyze behavioral patterns and identify deviations from normal system activity. Anomaly detection techniques enable the system to automatically learn typical usage patterns and flag unusual behavior that may indicate potential security threats. 
In addition to anomaly detection, the framework incorporates a risk-scoring mechanism that categorizes detected events based on their potential threat level. Suspicious activities are instantly reported through a real-time dashboard that provides administrators with visual insights into system behavior, security alerts, and activity trends. Experimental observations demonstrate that the proposed framework can effectively identify abnormal file system behaviors while maintaining low system overhead. By combining continuous monitoring with machine learning–based analysis, SENTRY-DOC provides an intelligent and scalable approach for detecting insider threats and unauthorized file activities in endpoint environments.The proposed system contributes toward improving organizational data protection by providing a proactive monitoring mechanism capable of identifying suspicious behaviors before they escalate into significant security incidents.},
        keywords = {File System Monitoring; Insider Threat Detection, Anomaly Detection, Endpoint Security, Real-Time Security Monitoring, Machine Learning–Based Threat Analysis, Cybersecurity Analytics, File Activity Tracking, Risk Scoring System, Security Event Monitoring.},
        month = {April},
        }