AI-Powered Email Threat Detection, GeoLocation and Forensic Intelligence Platform
All India Council for Technical Education (AICTE) · Blockchain & Cybersecurity · Software
Build the forensic tracing first and the classifier second, because the header chain is what makes this memorable — and be explicit that you are surfacing infrastructure indicators rather than identifying a person.
What it actually is
Phishing and business email compromise still get through spam filters because attackers use lookalike domains, display-name spoofing and hidden redirects. The ask is a platform that not only flags a fraudulent email but traces where it actually came from. The forensic half — reconstructing the relay path and correlating it with geolocation and domain registration data — is what separates this from an ordinary spam classifier.
What to build
An analysis platform where a raw email or .eml file is uploaded and the system returns two things: a threat verdict with the specific signals behind it — display-name versus envelope-sender mismatch, lookalike domain distance from a known brand, SPF, DKIM and DMARC validation results, suspicious redirect chains in links — and a forensic view reconstructing the SMTP relay path hop by hop from the Received headers, plotting each hop's IP on a map with ASN and hosting provider, pulling WHOIS registration age and registrar for the sending domain, and assembling all of it into an exportable investigation report with an indicator-of-compromise list.
Smallest thing that wins the room
Paste in a real phishing email and watch the platform flag the lookalike domain and failed DMARC, then unfold the relay chain hop by hop across a map to the originating infrastructure, ending with a downloadable forensic report.
How crowded this one gets
A guess, projected from the 2025 statements — the last year where both the submission counts and the winners were published.
Quieter than 76% of the 226 · #55 of 226 by expected field
Few teams are likely to go here. The best odds on the board come from statements like this.
Why: central ministry statements sat below the average.
This is a guess, not a fact
Nobody has published 2026’s numbers yet. This is an analysed estimate from last year’s pattern, so please do not take it as the truth — check the live counter on the SIH portal before you decide anything. The range covers the middle half of likely outcomes, so one statement in two lands outside it. Entry closes at 500 ideas per statement, so no range goes past that — a statement that reaches the cap fills and shuts rather than drawing an unlimited crowd. The model reads only three things a team can see before choosing — software or hardware, the theme, and what kind of body posted it — and those explain about a quarter of the variation in last year’s field sizes (R² 0.25 on held-out statements). Trust the band more than the number, and the ordering more than either. It cannot see how good your idea is, which is the part that actually decides it.
The scores
The number is the shorthand. The line under it is the reason.
Acceptance potential
4/5The forensic tracing genuinely differentiates this from the many phishing-detector submissions a cybersecurity judge will see, the data is all accessible, and it is one of the more substantial AICTE statements rather than the near-empty ones — but you must resist letting it collapse into another classifier.
Feasibility
4/5Every input this needs is accessible — email headers are plain text, SPF, DKIM and DMARC validation has mature libraries, IP-to-ASN and geolocation databases are free at the tier you need, and public phishing corpora like PhishTank and the Nazario collection give you labelled training data.
Innovation scope
3/5Phishing classification itself is a crowded, well-solved task, so your creative room is almost entirely in the forensic correlation layer — how you chain the relay path, weigh conflicting geolocation evidence and present attribution confidence.
Clarity
4/5The description enumerates exactly what must be correlated — headers, SMTP relay paths, SPF/DKIM/DMARC results, IP reputation, geolocation, domain registration intelligence and behavioural patterns — leaving little doubt about the required components.
Effort
HeavyThe classifier, the header forensics chain, the enrichment integrations and the report generation are four connected pieces, though each rests on existing libraries and public data sources.
Demo-ability
EasyFeeding in a genuine phishing email and watching the relay path unfold across a map is immediately legible, and you can source real samples for the demo without any permission.
In its favour
- Green flag: Email headers are structured plain text, so the forensic half needs no model at all and works deterministically from the first hour
- Green flag: Public phishing corpora plus your own spam folder give you real labelled samples with zero data-sourcing risk
- Green flag: The relay-path map is a strong visual that almost no competing phishing project will have, since most stop at a classification score
- Green flag: SPF, DKIM and DMARC results are verifiable ground truth rather than model output, which makes a large part of your verdict unarguable
Against it
- Red flag: IP geolocation of relay hops is genuinely unreliable — attackers route through VPNs, compromised hosts and cloud providers, so a confident pin on a map often points at a data centre in Virginia rather than an actor
- Red flag: The description asks to help identify the actor behind the attack, and attribution is a claim with legal weight that no header analysis can actually support — present infrastructure indicators, not identities
- Red flag: Received headers below the first trusted hop are attacker-controlled and can be forged outright, so a naive chain reconstruction can be led anywhere the sender wants
- Red flag: Phishing detection is a saturated project category, so a submission whose forensic layer is thin will be indistinguishable from a dozen classifiers
What you will be writing
- Python email/mailparser header parsing
- dkimpy + pyspf + DMARC validation
- MaxMind GeoLite2 + ASN lookup
- python-whois / RDAP domain intelligence
- BERT or DistilBERT phishing text classifier
- React + Leaflet relay-path visualisation
- Email security
- Digital forensics
- Threat intelligence
Prior art to read before you start
phishing and BEC detection · email header forensic tracing · threat infrastructure attribution
Analysed by Claude Opus. Every score above is a judgment call with its reasoning attached — kindly cross-check this against the official statement on the SIH portal before your team commits to it.