PhishGuard

PhishGuard's Architecture: End-to-End Pipeline from Ingestion to User Action.

Inspiration

Phishing and online fraud have become increasingly common, with frequent reports of individuals losing money, devices being compromised by malware, or false information spreading rapidly through forwarded messages. As students, we have also experienced a surge in fraudulent internship offers arriving in our institutional email accounts. These incidents highlight a critical need for proactive solutions that can detect and prevent malicious or deceptive content before it reaches the user. We came up with PhishGuard to address exactly this challenge.

What it does

PhishGuard is designed to serve as a multi-channel security companion. It analyzes incoming PDFs, documents, and links shared via SMS or WhatsApp, and flags potentially harmful content. The system combines traditional static analysis methods—such as hash lookups, structural anomaly detection, and YARA rule matching—with a machine learning classifier for contextual evaluation. Based on these checks, it provides users with a clear classification: Safe, Suspicious, or Malicious.

How we built it

At this stage, we have developed a comprehensive end-to-end workflow, represented through detailed flowcharts. The workflow spans ingestion, preprocessing, Granite LLM–powered contextual analysis, and a decision engine with user-facing outputs. The next phase involves deploying the system locally on mobile devices, which presents unique challenges due to permission restrictions within Android and third-party messaging applications. Nevertheless, this staged approach ensures that the design is robust and technically feasible.

Challenges we ran into

Building PhishGuard required overcoming two key challenges. First, because the system is agentic in nature, it requires access to device-level services such as SMS listeners, notification readers, and file scanners—areas where permissions are tightly restricted. Second, adapting IBM Granite models and the Agent Development Kit (ADK) for this specialized security use case demanded significant research, as there are limited reference implementations for such workflows.

Accomplishments that we're proud of

We are particularly proud of the rigor of our design and research process. By carefully studying both academic and industry approaches, we were able to design a pipeline that reflects best practices in digital security while leveraging IBM’s AI technologies effectively. Even at the design stage, the workflow demonstrates a high degree of completeness and readiness for practical deployment.

What we learned

Through this project, we gained hands-on experience in integrating IBM Granite models and ADK into an agentic AI pipeline, moving beyond their common use cases. We also deepened our understanding of the importance of pre-processing and multi-stage analysis in building secure, reliable AI systems.

What's next for PhishGuard

Our immediate next step is to implement and deploy PhishGuard locally on mobile devices, ensuring seamless integration with SMS and WhatsApp. Looking further ahead, we envision PhishGuard evolving into a unified cross-platform security assistant capable of mitigating not only phishing attempts but also misinformation, fraudulent offers, and other digital threats across communication channels.