NETRA

Inspiration

We got the idea from seeing how phishing mails are becoming more realistic day by day. Just checking the sender name or looking for some common words is not enough anymore. A mail can look completely genuine and still contain a malicious link, attachment or a spoofed sender. So we wanted to build something which not only tells whether a mail is suspicious, but also explains why it is suspicious and gives useful evidence for further investigation. This is how we started with NETRA EMAIL.

What it does

NETRA EMAIL is a phishing detection and email forensics platform. It analyzes different parts of an email like the sender details, authentication results, email content, URLs, attachments, QR codes and other available evidence. We also use NLP/ML based analysis to identify suspicious patterns in the mail. Instead of just giving a final score, NETRA shows the reasons behind the score, so the user can understand what actually made the email risky.

How we built it

We built NETRA EMAIL using a combination of Chrome Extension, FastAPI backend, NLP/ML analysis and forensic analysis modules. The extension is integrated with Gmail, where the user can select an email and click on Analyze Current Email. The email is then sent securely to our backend, where it is parsed and different analysis modules work independently. We analyze SPF, DKIM, DMARC, sender headers, URLs, attachments, QR codes and multilingual text. The findings are then combined by our risk engine and shown through a dashboard with the evidence and limitations.

Challenges we ran into

One of the main challenges was that phishing emails are not always easy to classify using fixed rules. We also had problems with legitimate emails getting flagged as phishing, especially mails containing urgent words or unusual looking links. Another challenge was multilingual detection because the same phishing intention can be written in different Indian languages and even in Romanized text. Handling attachments, QR codes and Gmail's redirect URLs also required lot of testing and improvements. We had to make sure that the system should not simply give a score but should give proper evidence for that score.

Accomplishments We're Proud Of

One thing we are really proud of is that NETRA is not just a simple phishing classifier. It combines detection with explainability and digital forensics. Our URL model achieved 97.35% accuracy on the domain-separated holdout evaluation, with 25,761 test URLs and 13,944 unseen domains. We also tested the complete system using a 25-email functional benchmark where all 25 test cases were correctly classified. We also implemented security features like evidence hashing, protected storage, request limits and access control. Most importantly, we were able to reduce a false positive case from 95/100 to 10/100 by improving the analysis logic.

What We Learn

While building this project, we learned that cybersecurity is not only about building a model and getting high accuracy. The model can still make mistakes and real emails can have many different conditions. We learned how important it is to combine different evidences instead of depending on a single signal. We also learned about email authentication, MIME parsing, URL analysis, digital evidence, security of APIs and multilingual NLP. One important thing we understood is that a low risk score does not always mean that an email is completely safe.

What's next for NETRA EMAIL

Next, we want to improve NETRA with larger real-world and multilingual datasets so that the NLP and ML models can become more reliable. We also plan to improve the Gmail integration so that original MIME data and trusted headers can be available for deeper analysis. Other future improvements include better model calibration, institutional SSO, stronger tenant isolation, analyst feedback based retraining and an optional dynamic malware sandbox for attachments. Our goal is to make NETRA EMAIL more useful not only for detecting phishing, but also for helping security teams understand, investigate and preserve evidence from suspicious emails.