Spectus - AI Cyber Forensics Platform

Real-time AI cyber-forensics platform that detects scams using a 4-engine ensemble: ML classifier, semantic search, LLM reasoning, and behavioral fingerprinting.

Comment

Inspiration

India loses billions every year to digital scams - UPI fraud, digital arrest threats, KYC phishing, fake job offers. Most detection tools are simple keyword filters that scammers bypass with a single word change. We wanted to build something that thinks like a forensic investigator, not a spam filter.

What it does

Spectus is a real-time AI cyber-forensics platform that analyzes SMS messages, emails, URLs, UPI handles, and call transcripts for scam signals. Every input runs through a 4-engine ensemble that functions like a digital jury:

  • ML Classifier: TF-IDF + Logistic Regression for fast, deterministic pattern detection
  • Semantic Vector Search: ChromaDB + Sentence Transformers matched against MHA, RBI & SEBI advisories
  • LLM Reasoning: Llama 3.1 via Groq for deep psychological and contextual analysis
  • Behavioral Fingerprinting: Detects brand impersonation, leet-speak obfuscation, and credential harvesting

Beyond detection, Spectus also includes a Cross-Channel Nexus Correlator (links SMS → URL → UPI into one threat graph), a Mutation Diff Engine (tracks how scams evolve over time), a Psychological Profiler (identifies which cognitive biases a scam exploits), and a Golden Hour Emergency Toolkit for immediate incident response.

How I built it

  • Backend: FastAPI on Render, with lazy-loaded SentenceTransformer to stay within free-tier RAM limits
  • Vector DB: ChromaDB seeded with scam patterns from MHA, RBI, and SEBI advisories
  • LLM: Llama 3.1 via Groq API for structured JSON reasoning
  • Frontend: Single-file vanilla JS + custom CSS dashboard deployed on Vercel
  • Graph analysis: NetworkX for cross-channel threat correlation

Challenges faced

Getting all four engines to initialize without crashing Render's free-tier container was the hardest part. SentenceTransformer was loading at startup and eating RAM before the server could pass its health check. We solved this with lazy initialization, the embedding model only loads on the first actual request, not at boot.

Balancing the ensemble weights was also non-trivial. When Groq is unavailable, the system gracefully degrades to ML + semantic signals without breaking the verdict pipeline.

Accomplishments

  • A fully working 4-signal ensemble that degrades gracefully when any engine is unavailable
  • Real scam pattern corpus sourced from actual Indian government advisories
  • The Mutation Diff Engine - most scam detectors don't track how scams evolve; ours does
  • Shipped a complete forensics platform as a single index.html with zero frontend dependencies

What I learned

Lazy initialization matters enormously on constrained infrastructure. Ensemble design is as much about failure modes as it is about accuracy. And India-specific scam patterns (digital arrest, Aadhaar fraud, UPI manipulation) need a dedicated corpus - generic English scam datasets miss them entirely.

What's next

  • WhatsApp and Telegram scam monitoring
  • OCR-based screenshot analysis
  • Browser extension for real-time phishing detection
  • Multi-language support (Hindi, Tamil, Telugu)
  • SIEM integration for enterprise SOC dashboards

Built With

Share this project:

Updates