CyberAML Shield by Team AS2

Real-time transaction risk scoring across 24 AML & cyber signals, Neo4j graph-based money mule ring detection, and Gemini AI executive intelligence — all in one platform.

Comment

Financial crime and cybercrime have merged but compliance platforms haven't caught up. Mule networks move money through sanctioned countries via crypto wallets and slip through legacy systems because no single tool connects the dots.

We wanted to build the one that would. CyberAML Shield scores transactions across 24 risk factors — combining AML signals like PEP status and sanctions screening with cyber signals like IP mismatch and device fingerprinting — into a single convergence score. When both signal types hit together, a multiplier ups the score further. It handles single transactions or bulk CSV uploads, pushes results into a Neo4j graph database to detect mule rings in real time, and uses Google Gemini AI to explain every finding in plain English.

Built with Python, Streamlit, Neo4j AuraDB, Google Gemini 1.5 Flash, D3.js and SQLite. Calibrating the model was the hardest part — sensitive enough to catch real threats without drowning analysts in false positives. Getting Neo4j and Streamlit to play nicely together and building a CSV auto-mapper that handles any bank export format without a fixed template were the other big hurdles. The Mule Radar detects real patterns from actual uploaded data, not mock rings. The convergence scoring model is our core innovation, and shipping a fully working deployed platform with graph analytics and AI in hackathon time is something we're proud of.

Graph databases make financial crime detection feel obvious — row-by-row impossible becomes trivial with a few lines of Cypher. Gemini AI also surprised us with how well it turned raw scores into intelligence a compliance officer could actually act on.

A machine learning layer trained on real SAR data to replace hand-tuned weights, and warm-up transaction monitoring — detecting the classic mule onboarding pattern of small legitimate-looking transactions before the spike — to shift the platform from reactive to genuinely predictive.

Built With

Share this project:

Updates