AI Permission Abuse Detector

Real-time browser security powered by AI that detects, analyzes, and stops permission abuse and phishing threats before they compromise your data.

Comment

Inspiration

Modern browsers make it extremely easy for users to grant sensitive permissions such as camera, microphone, location, notifications, and clipboard access. The problem is that users often make these decisions without knowing whether a website genuinely needs the requested permission.

This inspired us to build AI Permission Abuse Detector—a security layer that helps users understand the risk behind browser permission requests before they make a decision. The idea was simple: instead of expecting users to recognize suspicious behaviour themselves, we wanted to provide them with an intelligent security assistant that could analyze the context and explain the risk in plain language.

For example, a video-conferencing website requesting camera access is expected behavior, while an unfamiliar website requesting sensitive clipboard access may deserve additional scrutiny.

What We Built

AI Permission Abuse Detector combines a Chrome Extension with a FastAPI backend and a machine-learning-based risk analysis engine.

When a permission-related event is detected, the system evaluates multiple signals:

  1. Contextual Classification – analyzes information such as the website URL, title, and metadata to determine the site's likely category.
  2. Heuristic Risk Analysis – compares the requested permission with the expected behavior of that website category.
  3. Typosquatting Detection – uses string-distance analysis to identify domains that closely resemble trusted websites.
  4. Community Intelligence – incorporates historical user decisions to identify permission requests that are frequently rejected.
  5. Risk Scoring – combines these signals into an anomaly score between 0 and 1 and maps it to Low, Medium, High, or Critical risk.

For domain similarity, we use Levenshtein distance, where the distance between two strings represents the minimum number of insertions, deletions, or substitutions required to transform one string into another.

The final risk decision can be represented conceptually as:

$$ R = f(A, H, T, C) $$

where (A) represents the AI classification score, (H) represents heuristic analysis, (T) represents typosquatting detection, and (C) represents community feedback.

The Chrome Extension provides the user-facing experience, while the FastAPI backend handles risk analysis, machine-learning inference, and telemetry.

How We Built It

We built the frontend using Vanilla JavaScript and Chrome Manifest V3 to keep the extension lightweight and compatible with modern browser security requirements.

The backend was developed using Python and FastAPI. We used Scikit-learn to build the Random Forest classification component and SQLite for lightweight telemetry storage.

The extension communicates with the backend through REST APIs. Security alerts are presented through an in-browser warning interface, while the extension dashboard provides an overview of recent alerts, risk levels, and the user's privacy health score.

We also designed data-export functionality so that users can export their locally collected telemetry as CSV or JSON, allowing them to audit their browsing-security decisions.

What We Learned

This project helped us understand that browser security is not only about detecting malicious websites—it is also about understanding context and user behavior.

We learned how to:

  • Build a Chrome Extension using Manifest V3.
  • Design communication between a browser extension and a FastAPI REST API.
  • Train and integrate a Random Forest machine-learning model.
  • Apply heuristic security rules alongside machine-learning predictions.
  • Implement Levenshtein distance for domain similarity and typosquatting detection.
  • Store and analyze security telemetry using SQLite.
  • Design risk-scoring systems that combine multiple security signals.
  • Present complex security findings in a way that is understandable to non-security users.

One of the biggest lessons was that machine learning should not be treated as the only security mechanism. Combining ML with deterministic security rules provides a more explainable and controllable detection system.

Challenges We Faced

One of the biggest challenges was determining what browser permissions and APIs can actually be monitored or influenced by a Chrome Extension. Browser security boundaries intentionally prevent extensions from freely controlling every native permission workflow.

This forced us to think carefully about the difference between a prototype security concept and capabilities that are actually supported by browser APIs. Instead of relying entirely on interception, we designed the system around observable browser context, extension-side analysis, backend intelligence, and user-facing risk warnings.

Another challenge was false positives. A permission that looks suspicious in one context can be completely legitimate in another. For example, camera access from a video-conferencing application is expected, while the same permission from an unrelated website may deserve more scrutiny.

We addressed this by combining multiple signals rather than making decisions from a single rule.

Typosquatting detection also presented challenges because legitimate domains can sometimes be similar to trusted domains. We therefore use string similarity as a security signal rather than treating it as the only reason to classify a website as malicious.

Impact

Our goal is not to make security decisions for users. Instead, AI Permission Abuse Detector acts as an additional security layer that gives users context before they trust a website with sensitive browser capabilities.

By combining machine learning, heuristics, domain analysis, and community intelligence, the project demonstrates how security tools can move beyond simple blocklists and provide contextual, explainable warnings.

Ultimately, we want users to stop asking "Should I click Allow?" and start asking "Why does this website need this permission?"

Built With

Share this project:

Updates

Submission history