CyberShield AI

An AI-powered cybersecurity assistant that detects phishing emails, analyzes suspicious URLs, evaluates password strength, and improves digital safety.

Comment

CyberShield AI

Inspiration

Cybersecurity threats have become part of everyday digital life. Phishing emails, malicious URLs, weak passwords, social engineering attacks, and online scams affect millions of users every day. Unfortunately, many people lack the technical knowledge needed to identify these threats before becoming victims.

Most cybersecurity tools are either designed for security professionals or require external services, subscriptions, or threat-intelligence feeds. We wanted to build a system that makes cybersecurity accessible, understandable, and available to everyone.

CyberShield AI was created as an intelligent cybersecurity assistant that helps users evaluate digital threats, understand security risks, and improve their online safety through explainable analysis.

What it does

CyberShield AI is an AI-powered cybersecurity dashboard that combines multiple security analysis engines into a single platform.

The system currently provides:

  • Password strength analysis
  • URL phishing and risk analysis
  • Email phishing detection
  • Session-based threat monitoring
  • Security scoring and risk visualization
  • Exportable security reports

Rather than simply classifying inputs as "safe" or "unsafe," the system explains why a threat was detected and provides actionable feedback to the user.

Password Strength Analyzer

The password analyzer evaluates passwords using both structural analysis and information theory.

The system measures:

  • Uppercase characters
  • Lowercase characters
  • Numbers
  • Special characters
  • Password length

Shannon entropy is calculated using:

$$ E = L \times \log_2(R) $$

where:

  • (L) is password length.
  • (R) is the available character pool.

This allows the analyzer to measure not only complexity but also the theoretical resistance of a password to brute-force attacks.

Passwords are classified as Weak, Medium, or Strong only when both entropy and structural criteria are satisfied.

URL Risk Analyzer

The URL analyzer uses a zero-trust lexical analysis engine that performs real-time phishing analysis without any external APIs.

The analyzer evaluates:

  • HTTP vs HTTPS
  • Raw IP addresses
  • Punycode domains
  • Typosquatting attacks
  • High-risk TLDs
  • URL shorteners
  • Credential-harvesting keywords
  • Open redirects
  • Excessive subdomains
  • Shannon entropy
  • URL length anomalies

A custom Levenshtein-distance implementation with leet-speak normalization allows the system to detect domains such as:

  • micr0soft.com
  • paypa1-login.xyz

Multiple threat signals are combined through a multi-vector convergence model, allowing the system to escalate risk when several independent indicators appear simultaneously.

Phishing Email Detector

The phishing detector combines heuristic analysis with machine learning.

The detection pipeline contains four independent layers:

1. Informational Safe-Pass Filter

Legitimate transactional emails are identified before analysis to reduce false positives.

2. URL Structural Analysis

Embedded URLs are examined for phishing indicators.

3. Context-Aware Heuristics

The engine detects:

  • Credential harvesting
  • Billing scams
  • Payroll fraud
  • CEO impersonation
  • Gift-card scams
  • Cryptocurrency fraud
  • Fake job offers
  • Social engineering pressure

4. Machine Learning Classifier

The ML component uses:

  • Word-level TF-IDF features
  • Character n-gram TF-IDF features
  • Logistic Regression

Character-level vectorization enables detection of obfuscated text such as:

  • p@ssw0rd
  • l0gin
  • s3cure

The final verdict is generated through a hybrid confidence model that combines heuristic evidence and ML probability.

Dashboard and User Experience

CyberShield AI was built as a fully interactive Streamlit dashboard.

The application includes:

  • Live threat-level badges
  • Session-based security monitoring
  • Threat counters
  • Security index calculations
  • Scan history logs
  • Exportable reports
  • Real-time advisory messages

The system maintains a rolling event log that tracks user interactions and provides a dynamic security score based on detected threats during the session.

A custom cybersecurity-inspired user interface was developed using CSS, featuring:

  • Threat escalation badges
  • Animated critical alerts
  • Security metric cards
  • Color-coded advisory chips
  • Terminal-style event logs

How I built it

Technologies used:

  • Python
  • Streamlit
  • Scikit-learn
  • NumPy
  • Pandas
  • Plotly
  • Joblib

The project intentionally avoids external APIs, subscriptions, or cloud services.

All threat analysis, entropy calculations, heuristics, machine learning, and scoring systems run locally.

This provides:

  • Zero network latency
  • Zero API costs
  • Complete privacy
  • Offline operation

Challenges I ran into

One of the biggest challenges was balancing detection accuracy with false-positive reduction.

Security systems that flag everything as dangerous quickly become unusable. Considerable effort went into:

  • Safe-pass filtering for legitimate emails
  • Brand-aware URL analysis
  • Multi-vector risk scoring
  • Context-aware heuristics

Another challenge was presenting technical cybersecurity concepts in a way that non-technical users could understand.

The dashboard was designed to explain risks rather than simply display alerts.

Accomplishments that we're proud of

  • Built three independent security analysis engines.
  • Developed a multi-layer phishing detection pipeline.
  • Implemented custom typosquatting detection.
  • Added entropy-based password analysis.
  • Designed a real-time cybersecurity dashboard.
  • Achieved fully local threat analysis without external APIs.
  • Created explainable security feedback instead of black-box predictions.

What I learned

Through this project, I learned:

  • Practical applications of machine learning in cybersecurity.
  • TF-IDF and text classification techniques.
  • Information theory and password entropy.
  • Lexical URL analysis.
  • False-positive reduction strategies.
  • User experience design for security applications.
  • Building explainable AI systems.

What's next for CyberShield AI

Future improvements include:

  • Live threat-intelligence feeds.
  • Browser extension support.
  • Larger phishing training datasets.
  • Common-password database checks.
  • Continuous model retraining.
  • Cloud deployment.
  • User accounts and security profiles.
  • Personalized cybersecurity recommendations.

CyberShield AI aims to make digital security accessible, explainable, and available to everyone.

Built With

Share this project:

Updates

Submission history