PhishShield AI - Real-Time Threat Responder

• 

  PhishShield AI - Real-Time Threat Responder

Inspiration

Traditional threat detection systems are too slow to keep up with today’s rapid cyberattacks. Criminals are now using generative AI to deploy highly customized social engineering campaigns at an industrial scale. We wanted to build a modern defense matrix that fights AI with AI—intercepting and parsing malicious payloads instantly to protect enterprises before a user can even click a link.

What it does

PhishShield AI is an automated, real-time cyber-defense responder. When a user or system inputs a suspicious email, text, or server log, the platform runs sub-second triage. It automatically calculates a definitive threat risk score (0-100%), extracts the active technical attack vectors, and enforces an automated JSON orchestration policy. Instantly, it outputs a human-readable employee warning alert and a machine-readable firewall remediation snippet to block the attacker on the fly.

How we built it

The prototype was forged as a resilient standalone application optimized for rapid security engineering boxes:

• Frontend Dashboard: Built utilizing the lightweight Streamlit framework for real-time telemetry visualization.
• Core Engine: Written entirely in Python 3.11 for swift data processing and manipulation.
• Artificial Intelligence Core: Powered by the new Google GenAI SDK using the low-latency Gemini 2.5 Flash model, configured to enforce hard JSON schemas for downstream SIEM/SOAR system ingestion.

Challenges we ran into

We ran into several rigid environment path blocks on local Windows terminals when handling global packages like pip and streamlit. We overcame this by engineering precise explicit environment pathways to guarantee smooth, self-contained deployment. We also adapted our code to intercept and safely handle remote server API overloads (503 infrastructure spikes), ensuring the platform remains stable even under high concurrent threat telemetry stress.

Accomplishments that we're proud of

We successfully built a working security automation tool under tight time constraints! The application doesn't just display text; it enforces real structured JSON formatting, bridge-gapping the raw intelligence of large language models directly into machine-executable network commands (like defensive firewall rule-mapping).

What we learned

We gained profound insights into standard structured intelligence parsing. We learned how critical strict structural formatting is when designing enterprise-ready AI, ensuring that a security response application can talk directly to automated firewall scripts without human intervention.

What's next for PhishShield AI

We plan to weaponize the platform further by implementing it as an active email gateway webhook. This will completely automate incoming mail telemetry triaging, instantly isolating malicious vectors in high-risk corporate networks before they ever land in an employee's inbox.

Built With

• gemini-api
• json
• powershell
• python
• streamlit