SAFESPHERE

About SAFESPHERE

💡 Inspiration

Phishing attacks are becoming increasingly convincing, making it difficult for users to distinguish legitimate websites and emails from malicious ones. We wanted to build a practical security solution that could analyze suspicious URLs and email content and provide users with an understandable risk assessment.

🚀 What We Built

SAFESPHERE is an AI-powered phishing detection platform that analyzes suspicious URLs and emails to identify potential phishing threats.

For URL detection, we combine traditional URL characteristics such as URL length, subdomain depth, special characters, digit patterns, and domain entropy with DNS-based features such as DNS resolution, A records, MX records, NS records, and CNAME information. These features are analyzed using a Random Forest machine-learning model.

The platform also includes an email threat-analysis module using NLP-based machine learning to identify suspicious email content. Users receive a risk score, detection result, confidence level, and recommendation through a web-based dashboard.

🛠️ How We Built It

We developed SAFESPHERE using a modular architecture:

Frontend: React, Tailwind CSS, and Recharts
Backend: Spring Boot microservices
Machine Learning: Python, Flask, Scikit-learn
URL Detection: Random Forest with lexical + DNS features
Email Detection: NLP-based classification
Database: MySQL
Security: JWT-based authentication
Additional Analysis: DNS inspection, URL intelligence, and explainable AI techniques

The system connects the web interface to backend services and the ML service, allowing a submitted URL or email to be analyzed and the result to be displayed in real time.

📚 What We Learned

Building SAFESPHERE helped us understand how a machine-learning model can be integrated into a real-world application rather than being used only as a standalone experiment.

We learned about:

Feature engineering for cybersecurity
DNS and domain analysis
Machine-learning model evaluation
NLP-based threat detection
REST APIs and microservices
Authentication and secure communication
Connecting ML models with production-style applications
Testing models against different types of URLs and potential false positives

⚙️ Challenges We Faced

One of our biggest challenges was improving detection without relying only on URL text patterns. Some legitimate websites can look suspicious based on lexical features alone, while phishing domains can sometimes appear normal.

To address this, we incorporated DNS-derived features alongside traditional URL features. We also tested the model using domain-grouped evaluation to reduce the possibility of data leakage between training and testing samples.

Another challenge was integrating multiple services reliably. We had to troubleshoot communication between the React frontend, Spring Boot services, authentication layer, database, and Python ML service.

🌐 Our Goal

SAFESPHERE is designed to make phishing detection more accessible by turning complex security and machine-learning analysis into a simple result that users can understand and act upon.

Detect smarter. Understand the risk. Stay safe.