CyberNetX

Detect. Trace. Neutralize. AI that auto-blocks phishing links and fake APKs on your device, then traces scam money back to the kingpins behind mule networks, before funds disappear.

Comment

Inspiration

Indians lost ₹52,976 crore to cyber fraud in six years, including ₹19,813 crore across 21.8 lakh complaints in 2025 (I4C). The people hit hardest are students, seniors and first-time UPI users, who act within seconds of a message. Existing tools are manual (paste a link into a checker), block only already-known URLs, and freeze accounts through black-box alerts. Investigations catch the last account in the chain, never the kingpin. We built CyberNetX to close that gap.

What it does

Detect. Trace. Neutralize. CyberNetX connects the victim's device to the bank's response in one loop.

  • ShieldNetX (Detect): A Chrome extension and an Android Accessibility Service intercept links and fake APKs automatically. Behaviour-first detection uses crowd signals (click velocity, dwell time, geo-velocity, sender trust). Suspicious items go to an isolated Ghost Sandbox for HTML/JS analysis, CLIP brand-impersonation checks, phishing-kit DOM and favicon hashing, and TLS/JARM fingerprinting. Fake APKs get static analysis, dynamic sandboxing and Gemini-powered reasoning.
  • TraceNetX (Trace & Neutralize): Graph analytics and an ML ensemble (XGBoost, LightGBM, Random Forest, Isolation Forest, LSTM, with SHAP explanations) trace money flows backward to the dealer first, then expose the middle layer. Every flag comes with evidence.
  • The bridge: Payee details extracted by the sandbox (UPI ID, phone, domain, IP) automatically seed TraceNetX investigations. Flagged accounts can be pushed to banks for pre-transfer warnings or holds.

How we built it

  • Frontend and clients: React dashboards, a Manifest V3 Chrome extension, and a Flutter app with a Kotlin bridge.
  • Backend: FastAPI services, Neo4j for the money-flow graph, Redis for the shared blocklist, and D3 for the Spider Map.
  • AI: An ML ensemble for account risk, CLIP for visual brand impersonation, and the Gemini API for APK reasoning and explanations.
  • Dynamic analysis: A Frida-instrumented sandbox hooks SMS, network and overlay APIs.

Challenges we ran into

Our biggest lesson was label leakage. Early mule-detection scores looked near-perfect (AUC 0.9999) because a post-investigation field leaked the answer. We caught it, removed the leaking features, and re-validated with stratified 5-fold cross-validation, with scaling and SMOTE fit only on training folds. The honest result was AUC 0.9958. We also had to make a block require agreement from 2+ independent signal families, so no single noisy signal can flag a legitimate user.

Responsible by design

  • It is consent-first and never collects message bodies, contacts, keystrokes, PINs or OTPs.
  • A human analyst approves every hold or freeze.
  • AI outputs are advisory. Deterministic detectors and human approval make the final call.

Accomplishments we're proud of

  • Working prototypes of both layers: extension, Android app, detection backend, and a graph/ML platform that rebuilds its maps, dashboard and analytics when a new dataset is uploaded.
  • A closed loop from victim device to bank-side intervention, which existing point tools don't offer.
  • An ML pipeline validated honestly, with leakage found and fixed.

What we learned

Accuracy numbers mean little without leakage checks, explainability earns analyst trust, and fraud defence has to be automatic because people won't run manual checks.

What's next

  • Deploy on Google Cloud (Cloud Run, GKE-isolated sandbox, Pub/Sub, Memorystore) with regional data residency.
  • Add Gemma for private on-device message pre-screening.
  • Add Indian-language scam detection.
  • Run a campus pilot, then a bank partner, then a bank consortium with federated anomaly scoring.
  • Build an ESP32 router appliance for network-wide protection.

Built by Team OMEGA 404.

Built With

Share this project:

Updates

Submission history