Guardian

• 

• 

• 

• 

  G

• 

Inspiration

Guardian started from a simple but frustrating realization: most link protection tools rely on cloud APIs and black-box decisions. When a tool tells you a link is “dangerous,” you rarely know why and your browsing data often leaves your device in the process.

I wanted to build something different.

The inspiration came while seeing obvious phishing domains rank on search results and noticing how easy it is to miss small domain tricks like typos, homoglyphs, or misleading subdomains. It felt wrong that detecting these patterns still required sending URLs to external services. Guardian was created to prove that meaningful threat detection can happen entirely offline and still be explainable.

How It Works

Guardian analyzes URLs locally using deterministic rules instead of probabilistic AI models. The engine inspects:

• Domain structure and subdomain misuse
• Homoglyph and look-alike character substitutions
• Typosquatting patterns against known brands
• URL entropy and obfuscation indicators
• Suspicious path and query behavior

Each factor contributes to a transparent risk score, and Guardian explains exactly which rules were triggered and why a link is marked Safe, Warning, or Dangerous. No internet connection is required, and no URLs are ever transmitted.

What I Learned

Building Guardian taught me a lot about how modern phishing actually works in practice, especially how attackers abuse subdomains and visually similar characters rather than obvious malware links. I also learned how much clarity matters in security tools users trust systems more when they can understand the reasoning behind a verdict.

On the technical side, I gained deeper experience with browser extension architecture, offline-first design, and building deterministic logic that behaves consistently across environments.

Challenges Faced

One of the biggest challenges was balancing strict detection with false positives. Some legitimate domains can look suspicious at first glance, so refining the rules to avoid over-flagging while still catching real threats took careful iteration and testing.

Another challenge was distribution. Chrome Web Store approval takes time, so for this hackathon Guardian uses a downloadable ZIP with clear installation steps. Making that experience simple and trustworthy for users was a challenge on its own.

Why Guardian Matters

Guardian isn’t trying to replace cloud-based threat intelligence it’s proving that privacy-first, offline, explainable security is possible. It’s built for users who want protection without surveillance and clarity instead of blind trust.

This project is the foundation for more advanced offline threat intelligence and future expansion across platforms.

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for Guardian

Built With

• and
• and-browser-extension-behavior-**html5-&-css3**-?-user-interface
• and-permission-handling-**deterministic-rule-engine**-?-custom-built-logic-for-entropy-analysis
• and-visual-design-**chrome-extension-apis**-?-local-url-interception
• domain
• homoglyph-detection
• inspection
• javascript-(es6+)**-?-core-url-analysis-engine
• json
• popup-interface
• responsive-layout
• threat-scoring-logic
• typosquatting