CyberGuard

🔥 Inspiration Cybercrime in India is exploding — millions of fraud complaints pour into law enforcement every year, yet investigators still rely on manual spreadsheets and gut instinct to decide where to act. We saw a gap: no tool existed that could turn raw complaint data into geographic intelligence in real time. We were inspired by the idea that data science could become a weapon for law enforcement — helping officers predict where the next fraud wave will hit before it happens, not after.

🛡️ What It Does CyberGuard is a real-time predictive analytics platform for cybercrime detection and law enforcement response. It:

📍 Maps cybercrime hotspots interactively using clustering algorithms on live complaint data 🤖 Predicts fraud patterns using an XGBoost ML model trained on historical cybercrime records 🚨 Auto-generates prioritized alerts with a criticality score so officers know what to tackle first 📋 Manages investigation cases end-to-end — from complaint intake to resolution tracking 📊 Visualizes trends with real-time charts, risk heatmaps, and geographic breakdowns 📱 Works on mobile so field officers can access intelligence on the go

In short: CyberGuard turns a flood of complaints into actionable intelligence — before fraud spreads.

🛠️ How We Built It We built CyberGuard as a full-stack, microservices architecture: LayerTechFrontendNext.js 14, TypeScript, Tailwind CSS, Leaflet, Chart.jsNode.js BackendExpress.js, JWT Auth, REST APIsML BackendPython Flask, XGBoost, Scikit-learn, Pandas, NumPyData PipelineReal-time CSV data streaming, Joblib model serializationDevOpsDocker, Docker Compose, multi-service orchestration The ML pipeline works in 5 stages:

Ingest→Feature Engineer→Cluster Hotspots→XGBoost Predict→Score & Alert\text{Ingest} \rightarrow \text{Feature Engineer} \rightarrow \text{Cluster Hotspots} \rightarrow \text{XGBoost Predict} \rightarrow \text{Score & Alert}Ingest→Feature Engineer→Cluster Hotspots→XGBoost Predict→Score & Alert We trained the XGBoost withdrawal predictor on geographic and temporal features extracted from cybercrime complaint records, and the hotspot clusterer uses unsupervised learning to identify high-risk zones dynamically as new data streams in.

🧱 Challenges We Ran Into

Real-time data sync between three separate services (Next.js, Express, Flask) without a shared database was tricky — we solved it with a streaming API layer and careful CORS configuration. ML model integration into a live dashboard required careful serialization using Joblib so that predictions stay fast and consistent across environments. Geographic clustering accuracy — making the hotspot detection meaningful (not just noise) took multiple iterations of tuning the clustering parameters against real-world complaint distributions. Docker networking across multiple services in development vs. production environments was a debugging marathon we didn't expect.

🏆 Accomplishments We're Proud Of

✅ A fully working end-to-end ML pipeline from raw data to live dashboard in a hackathon timeframe ✅ XGBoost model successfully trained and serialized for real-time serving ✅ Interactive heatmap + hotspot visualization that genuinely looks like a production law enforcement tool ✅ A Dockerized multi-service architecture that can be deployed with a single command ✅ Responsive design that works for both desktop analysts and mobile field officers

📚 What We Learned

How to architect a polyglot microservices system where Python ML and Node.js APIs co-exist seamlessly The real challenges of real-time data streaming — keeping the UI in sync without overloading the backend How to think like law enforcement: alert prioritization isn't just ranking by severity, it's ranking by actionability That XGBoost + geographic features is a powerful combo for spatial fraud prediction DevOps is not optional — Docker saved us hours of "it works on my machine" pain

🚀 What's Next for CyberGuard

🔗 Live NCRP data integration — connect to India's National Cybercrime Reporting Portal for real complaint feeds 🧠 Deep learning upgrade — replace XGBoost with an LSTM model for time-series fraud forecasting 🔔 Push notifications — SMS and email alerts to field officers when a hotspot crosses a risk threshold 👤 Role-based access — separate dashboards for analysts, investigators, and supervisors 🌐 Multi-city scaling — extend beyond pilot cities to a national-level view 📱 Native mobile app — dedicated iOS/Android app for field operations

Built With

• chart.js
• css
• docker
• express.js
• leaflet.js
• tailwind
• xgboost