SecureMailScope

Inspiration

Email is still the backbone of business, government, and banking, and we assumed that “TLS enabled” meant “secure”. It doesn’t. Many organizations run old TLS versions, weak ciphers, broken STARTTLS setups, or expired certificates, so attackers can still downgrade or intercept traffic even though encryption is technically on.

Checking this today means an analyst opens a PCAP in Wireshark and inspects it packet by packet, which takes about an hour per capture and is error-prone. With the average data breach in India costing ₹25.5 Cr, we wanted to turn that manual work into something automated, explainable, and provable. That became SecureMailScope.

What it does

You upload a PCAP file. SecureMailScope detects SMTP, IMAP, and POP3 sessions, reconstructs the TLS handshake, and extracts the X.509 certificates. It then flags weaknesses such as outdated protocols, weak ciphers, and insecure STARTTLS. A hybrid of rule-based checks and machine learning produces a risk score, and an AI chatbot explains the findings in plain language. Reports export as PDF, JSON, or HTML, and a blockchain ledger stores report hashes so evidence tampering is easy to detect.

What we learned Protocol internals: how TLS handshakes, STARTTLS upgrades, and certificate chains work for SMTP, IMAP, and POP3, from the RFCs and NIST guidelines. Hybrid detection beats either approach alone: rules catch known misconfigurations reliably, while ML helps rank risk and spot anomalies. Combining them reduced false positives. Chain of custody matters: forensic findings are only useful if they can be trusted, which is why we hash the evidence and register it on-chain. Teamwork: splitting the work across frontend, backend, ML, and security taught us to design modular, stage-by-stage pipelines. How we built it Frontend: React, HTML, and JavaScript for registration, login, PCAP upload, and the analytics dashboard. Backend: Python with Uvicorn, containerized with Docker, and secured with JWT authentication. Analysis pipeline: PCAP validation (SHA-256), parsing with Scapy and tshark, email protocol extraction, TLS and certificate analysis, a security rule engine, threat-intelligence matching, ML scoring, and final risk fusion. AI/ML: scikit-learn, XGBoost, and pandas for feature vectors and risk prediction. Database: PostgreSQL with SQLAlchemy for users, sessions, and PCAP metadata. Blockchain ledger: a smart contract stores the PCAP and report hashes, so anyone can recompute and verify integrity. Testing: pytest and httpx, using known-good and known-vulnerable sample PCAPs.

To generate realistic test data, we built our own certificate pipeline: root CA, intermediate CA, leaf certificate, TLS handshake, then PCAP capture.

Challenges

Non-standard email implementations can break parsing, large PCAPs slow processing, and ML models give false positives without good labeled data. We handled these with battle-tested parsing libraries, a modular architecture, stream-based processing, and a hybrid rule and ML design.