Threat Trace AI

"ThreatTrace AI stops evasive phishing in under 100ms inside Gmail, traces attacker servers live, and exports blockchain-sealed, court-admissible forensic evidence for police cyber cells."

Comment

Inspiration

Every single day in India, over 5,000 cyber fraud complaints are logged on the National Citizen Helpline (1930), and according to IBM's 2025 Cost of a Data Breach Report, phishing remains the primary attack vector in 18% of Indian enterprise breaches, driving average losses to an unprecedented ₹19.5 Crores.

Yet, looking at how phishing is handled on the ground revealed a broken pipeline:

The Solo IT Admin’s Burden: Small-to-midsize startups and university tech centers rarely have the ₹5 Lakh/year budget required for legacy enterprise Secure Email Gateways (SEGs). Solo IT administrators are inundated with forwarded "suspicious email" queries and forced into 15-minute manual swivel-chair investigations across VirusTotal, MXToolbox, and WHOIS. Existing filters offer nothing more than an unexplainable "95% Spam" black-box score with zero forensic justification. The Courtroom Evidentiary Chasm: When victims report cyber fraud to district police cyber cells, they usually bring printed A4 paper screenshots or forwarded messages. In doing so, the raw RFC 822 MIME transport headers, originating MTA IP hops, and DKIM signatures are stripped. Consequently, over 80% of digital email evidence collapses in court under Section 63/65B of the Bharatiya Sakshya Adhiniyam (BSA), 2023 due to a broken cryptographic chain of custody.

I was inspired to build ThreatTrace AI to eliminate this divide: a platform that operates directly inside the Gmail browser DOM to protect users in sub-100ms, while simultaneously arming Indian law enforcement with cryptographically sealed, court-admissible forensic dossiers in a single click.

What it does

ThreatTrace AI is an AI-powered email threat forensics, real-time adversarial unmasking, and statutory digital evidence platform. It bridges in-box employee security with judicial cybercrime prosecution:

In-Box Gmail DOM Inspector (Manifest V3): Injects a native Shadow DOM security shield directly into the Gmail reading pane without requiring MX record rerouting or corporate mail server downtime. Deterministic 4-Vector Risk Engine: Replaces black-box percentages with a transparent 100-point scoring model evaluating content intent, reverse hop latency, Shannon entropy, and cryptographic email authentication. Anti-Evasion & Zero-Width Unmasking: Intercepts and neutralizes evasion techniques—such as hidden zero-width unicode spaces (U+200B), Punycode IDN homoglyphs, and base64 payloads—displaying side-by-side visual diffs. Live Reverse Network Attribution: Executes non-intrusive asynchronous TCP socket probes on ports 80, 443, and 22 in under 115ms to verify active Command & Control (C2) servers, alongside BGP Autonomous System (ASN) prefix mapping and Leaflet-based geolocation. Cryptographic Provenance & Blockchain Registry: Computes canonical RFC SHA-256 digests and ECDSA SECP256R1 digital signatures, anchoring evidence hashes to the Polygon Amoy blockchain. Statutory Law Enforcement Bridge: Programmatically exports court-admissible electronic evidence certificates under Section 63 of Bharatiya Sakshya Adhiniyam, 2023 and Section 91 CrPC ISP notice dossiers, slashing investigation and subpoena drafting time from 7 days to 5 seconds.

How we built it

+--------------------------------------------------------------------------------------------------------+ | THREATTRACE AI SYSTEM BLUEPRINT | +--------------------------------------------------------------------------------------------------------+ | [ Gmail DOM (Manifest V3) ] ──▶ [ FastAPI Analysis Gateway ] ──▶ [ Polygon Amoy Smart Contract ] | | │ │ │ | | Zero-Width Strip 4-Vector Engine Immutable Timestamp | | Punycode Decode Live Socket Attribution Canonical SHA-256 Digest | | <100ms DOM Badge Leaflet Geolocation Map Sec 63 BSA PDF Dossier | +--------------------------------------------------------------------------------------------------------+

  1. The 4-Vector Additive Scoring Engine

Rather than relying on opaque probabilistic black boxes, I designed a deterministic rubric bounded on [ 0 , 100 ] [0,100]:

𝑅

total

𝑉 NLP + 𝑉 Hop + 𝑉 Entropy + 𝑉 Auth ∈ [ 0 , 100 ] R total ​

=V NLP ​

+V Hop ​

+V Entropy ​

+V Auth ​

∈[0,100]

Where:

𝑉 NLP ∈ [ 0 , 30 ] V NLP ​

∈0,30: Measures cognitive urgency triggers, credential harvesting indicators, and financial fraud vocabulary: 𝑉

NLP

min ⁡ ( 30 , ∑ 𝑘 𝑤 𝑘 ⋅ 𝐼 ( token 𝑘 ∈ 𝐷 lures ) ) V NLP ​

=min(30, k ∑ ​

w k ​

⋅I(token k ​

∈D lures ​

)) 𝑉 Hop ∈ [ 0 , 25 ] V Hop ​

∈0,25: Evaluates reverse MTA hops extracted from Received: headers. If latency between sender MTA 𝑡 0 t 0 ​

and receiver MX 𝑡 1 t 1 ​

is anomalous or traverses unauthenticated relays: 𝑉

Hop

clamp ⁡ ( 25 , 𝛼 ⋅ Δ 𝑡 relay + 𝛽 ⋅ Score ASN_Reputation ) V Hop ​

=clamp(25,α⋅Δt relay ​

+β⋅Score ASN_Reputation ​

) 𝑉 Entropy ∈ [ 0 , 25 ] V Entropy ​

∈0,25: Measures the randomness and obfuscation of link tokens: 𝐻 ( 𝑋

)

− ∑

𝑖

1 𝑛 𝑃 ( 𝑥 𝑖 ) log ⁡ 2 𝑃 ( 𝑥 𝑖 ) H(X)=− i=1 ∑ n ​

P(x i ​

)log 2 ​

P(x i ​

) Excess entropy ( 𝐻 ( 𝑋 )

4.5 H(X)>4.5) combined with Punycode IDN homoglyphs triggers max risk. 𝑉 Auth ∈ [ 0 , 20 ] V Auth ​

∈0,20: Evaluates DNS security records: 𝑉

Auth

8 ⋅ 𝐼 (

SPF

Fail ) + 7 ⋅ 𝐼 (

DKIM

Fail ) + 5 ⋅ 𝐼 (

DMARC

Reject ) V Auth ​

=8⋅I(SPF=Fail)+7⋅I(DKIM=Fail)+5⋅I(DMARC=Reject)

  1. Cryptographic Chain of Custody & Statutory Proof

To satisfy Section 63(4) of the Bharatiya Sakshya Adhiniyam 2023, the evidence must be verifiable without revealing private email contents on-chain:

𝐷

evidence

SHA-256 ( Canonicalize ( Headers ∥ Body ∥ IOCs ) ) D evidence ​

=SHA-256(Canonicalize(Headers∥Body∥IOCs))

𝜎

Sign SECP256R1 ( 𝐷 evidence , 𝐾 private ) σ=Sign SECP256R1 ​

(D evidence ​

,K private ​

)

The canonical 32-byte hash 𝐷 evidence D evidence ​

is anchored into the Solidity smart contract ThreatTraceRegistry.sol on Polygon Amoy (Chain ID: 80002):

solidity function notarizeEvidence(bytes32 evidenceHash, string memory caseId) external onlyOfficer { records[evidenceHash] = EvidenceRecord(caseId, block.timestamp, msg.sender); emit EvidenceNotarized(evidenceHash, caseId, block.timestamp); }

Challenges we ran into

The Cost and Latency of LLM APIs: In my first prototype, I routed raw email bodies to third-party commercial LLM endpoints for intent classification. This failed immediately in real-world testing: each scan took 3 to 4 seconds, cost approximately $0.03 (making a free tier impossible), and enterprise testers objected to transmitting confidential company emails to external cloud models. Solution: I eliminated external LLM dependencies entirely and engineered an in-house deterministic 4-vector scoring engine and lightweight regex normalization pipelines that execute in under 95 milliseconds at ₹0.002 compute cost, keeping all message processing within the local client perimeter.

Adversarial Zero-Width Unicode Evasion (U+200B): Attackers insert invisible non-rendering characters like zero-width spaces (\u200B) and zero-width joiners (\u200D) in the middle of words (e.g., p\u200Ba\u200By\u200Bp\u200Ba\u200Bl). This broke traditional pattern matching and spam regex while rendering seamlessly to the user. Solution: I wrote a client-side DOM sanitizer that strips all invisible characters, resolves Punycode internationalized domains back to ASCII, and built an interactive AntiEvasionDiffViewer component in React that displays the hidden payload side-by-side with the rendered lure.

Complying with India's DPDP Act on an Immutable Ledger: Public blockchains are permanent and append-only. Writing raw victim email addresses or message excerpts to an on-chain ledger would directly violate the "Right to Erasure" under India's Digital Personal Data Protection (DPDP) Act, 2023. Solution: I implemented a zero-knowledge evidence architecture. Zero personal data or message text ever touches the smart contract. Only the 32-byte cryptographic SHA-256 digest is anchored on-chain. The actual email and full forensic metadata are sealed locally using AES-256-GCM encryption with PBKDF2 key derivation.

DOM Injection in Chrome Manifest V3: Injected extension scripts often conflict with Gmail’s dynamic single-page web architecture, where messages load asynchronously without page refreshes. Solution: Built an asynchronous MutationObserver in content.js with exponential backoff and Shadow DOM isolation, ensuring the ThreatTrace Shield mounts cleanly into the Gmail action toolbar without altering Gmail's layout or leaking CSS styles.

Accomplishments that we're proud of

Solo Development: As the sole developer, I engineered the entire ecosystem end-to-end: the Manifest V3 browser extension, the FastAPI backend, the React Cockpit, the Leaflet IP geolocation map, the Solidity smart contracts, and the automated PDF legal dossier generation engine. Published Browser Extension: Successfully published and distributed the extension on the Microsoft Edge Add-on Store (Store ID: 0RDCKH3690TK, Extension ID: ffbmoglonkpaakkobfkkfappameldfab). Benchmark Performance: Validated the engine across a curated corpus of 1,000 email samples (combining Nazario, Enron, and synthetic evasion lures), achieving 97.2% Accuracy, 96.8% Precision, 1.1% False Alarm Rate, and <150ms execution latency. Bridging the Cybercell Gap: Created a functional, deployed cybercrime portal (threattrace-cybercrime.vercel.app) capable of exporting automated Section 63 BSA certificates that satisfy Indian judicial standards for digital evidence.

What we learned

Indian Digital Evidence Jurisprudence: Gained a deep understanding of Section 63/65B of the Bharatiya Sakshya Adhiniyam 2023 and Section 91 of the Code of Criminal Procedure (CrPC), learning what magistrates and forensic examiners require to accept electronic records. Adversarial Network Forensics: Mastered MTA mail hop reconstruction, parsing Received: header timing deltas to uncover spoofed relays and forging tactics. Lean Architecture Optimization: Learned that deterministic, lightweight algorithms often outperform heavy deep-learning LLMs in high-throughput production environments where milliseconds matter.

What's next for Threat Trace AI

Microsoft Outlook Desktop & M365 Add-in: Expanding beyond webmail into corporate Outlook environments via Office JavaScript APIs. Cloud Neo4j Aura Graph Clustering: Scaling from local graph similarity clustering into a multi-tenant cloud graph database to correlate coordinated phishing campaigns across multiple enterprise domains. Direct CCTNS & NCRP Integration: Partnering with state cyber crime directorates to feed structured Section 91 CrPC ISP notice packets directly into police investigation workflows.

Built With

Share this project:

Updates

Submission history