DecodeX
Home/Problem Statements/SIH26106
All 226 Statements
SIH26106SoftwareBlockchain & Cybersecurity
₹1,50,000 Prize (₹75k Joint)
•
Deadline: 20 September 2026
•
Submitted Ideas: 0/500

AI-Powered Email Threat Detection, GeoLocation and Forensic Intelligence Platform

Ministry / Organization: All India Council for Technical Education (AICTE)
Department: Cyber Security Cell
SIH Official Portal
Technical Complexity
8/10
Dataset Accessibility
7/10
36h Hackathon Viability
9/10
Step 0 • Zero-Jargon Layman Summary

“This platform acts as a digital detective for emails, automatically spotting fake or malicious messages that look real. It doesn't just block them; it traces the email's journey back to its source, maps where it came from, and provides a detailed report to help investigators catch the attackers.”

The DecodeX PS Decoder™

Deconstructed Problem Blueprint

Step 1

WHAT TO BUILD?

An AI-driven forensic intelligence platform for email threat analysis, path tracing, and attribution.

Step 2

WHO IS IT FOR?

Cybersecurity cells, IT administrators in government/banking, law enforcement agencies, and fraud response units.

Step 3

WHY DOES IT EXIST?

Traditional filters only block content; they fail to provide the 'who, where, and how' behind an attack. Attackers now use sophisticated AI to bypass simple rules, leaving organizations blind to the infrastructure behind the threats.

Step 4

INPUT → PROCESS → OUTPUT ARCHITECTURE PIPELINE

01 • Inputs & Telemetry

Raw EML/MSG files, email headers (SMTP metadata), domain registration data (WHOIS), and threat intelligence feeds.

02 • Processing & AI Core

NLP for social engineering detection, graph-based path reconstruction, IP geolocation mapping, and cross-referencing with threat databases.

03 • Actionable Deliverables

Interactive forensic dashboard, visual trace maps, automated risk-scoring, and downloadable PDF investigation reports.

Step 5

CONSTRAINTS

  • Must maintain privacy/data compliance (GDPR/DPDP Act)
  • Must handle high-volume email traffic in near real-time
  • Must be resilient against obfuscation techniques like open relays and TOR nodes
Step 6

JURY METRICS

  • False Positive Rate (critical for business continuity)
  • Time-to-Detection (latency)
  • Accuracy of attribution (precision in identifying source infrastructure)
  • UI/UX clarity for non-technical investigators
Step 7

CORE BOTTLENECK

The 'Attribution' challenge: accurately identifying the true source of an email when attackers use multi-hop relay chains, VPNs, and compromised legitimate servers to mask their origin.

Why You Should Choose This PS (Pros)

  • High social impact and relevance to national security
  • Clear, modular deliverables (Detection, Tracing, Reporting)
  • Strong potential for integration with existing enterprise mail servers

Challenges & Risks to Watch (Cons)

  • Requires high-quality, diverse datasets of malicious vs. benign emails
  • Complex backend logic required for header parsing and path reconstruction
  • Risk of 'over-promising' on attribution accuracy
Hackathon Blueprint

Recommended Tech Stack & Grand Finale Features

Frontend & Mobile
React.jsTailwind CSSRecharts for visualizationReact Flow for trace mapping
Backend & APIs
FastAPI (Python)Celery for background task processingElasticsearch for log analysis
AI / ML & Models
BERT/RoBERTa for phishing detectionRandom Forest/XGBoost for header anomaly detectionLangChain for forensic report generation
Database & Cloud
PostgreSQLNeo4j (for graph-based relationship mapping)Redis

Killer Features to Impress the SIH Jury

Graph-based visualization of the entire relay chain from sender to recipient
Automated 'Forensic Report' generator that summarizes findings for legal/law enforcement use
Campaign correlation engine that groups disparate emails into a single 'Attack Campaign' based on infrastructure fingerprints
View Official SIH 2026 Portal Raw Text
▼
•Background Email continues to be one of the most widely used communication channels in government, education, banking,and enterprise ecosystems. However, it also remains one of the most exploited attack vectors for phishing,impersonation, business email compromise, financial fraud, credential theft, and malware delivery. Threat actors increasingly use spoofed domains, deceptive sender identities, social engineering techniques, and compromised infrastructure to send highly convincing fraudulent emails that appear legitimate to end users.Traditional email security controls such as spam filters, static blacklists, and rule-based signature mechanisms are often insufficient to detect sophisticated fraudulent emails. Attackers now use AI-generated language,domain lookalikes, display-name spoofing, hidden redirection links, and relay chains to evade standard detection systems. In many cases, even when a suspicious email is identified, organizations lack the technical capability to effectively trace the source path, identify probable sender infrastructure, correlate geolocation clues, and support investigation into the origin of the email.This gap creates major challenges for cybersecurity teams, law enforcement support, fraud response units, and institutional administrators who need not only to detect malicious emails but also to investigate their source and reveal indicators that may help identify the actor or infrastructure behind the attack.
•Problem Statement Current email security ecosystems primarily focus on filtering or blocking suspicious content but provide limited intelligence for deep forensic tracing of fraudulent email origins. Existing tools often do not adequately correlate email headers, SMTP relay paths, SPF/DKIM/DMARC validation results, IP reputation, geolocation indicators, domain registration intelligence, and behavioral patterns to build a complete picture of the sender’s identity or operating location.There is a need for an AI-powered platform capable of detecting phishing, spoofed, impersonated, and fraudulent emails in real time or near real time, analyzing the complete technical structure of an email, tracing its transmission path across mail servers, estimating its origin with location, and generating forensic intelligence and investigative insights that assist in identifying malicious infrastructure, compromised systems, or threat actors behind the attack.The solution should support forensic analysis, fraud prevention, institutional email security, and investigation workflows while maintaining legal, privacy, and evidentiary standards.
•Proposed Solution Develop an AI-Powered Email Threat Detection, GeoLocation and Forensic Intelligence Platform that combines Natural Language Processing (NLP), Machine Learning (ML), email header forensics, IP intelligence, domain analysis, and graph-based correlation to identify suspicious emails,detect advanced email threats, and investigate their probable origin.

The system should ingest raw email content, metadata, and headers; validate sender authentication mechanisms;

extract indicators of compromise; reconstruct relay paths; analyze originating IP addresses and associated geolocation data; and generate a confidence-based assessment of fraud risk and probable sender origin. The platform should provide actionable alerts, visual trace maps, and forensic reports for security analysts,administrators, and investigators.

•Key Components
•Fraudulent Email Detection Engine o NLP-based analysis of email subject lines, body text, urgency cues, impersonation language, and social engineering patterns.

o Detection of phishing indicators such as spoofed sender addresses, deceptive domains, suspicious attachments, malicious links, and obfuscated URLs.

o AI/ML models to classify emails as legitimate, suspicious, impersonated, phishing, or fraud-related.

o Identification of business email compromise patterns such as payment diversion, fake invoice requests, credential harvesting attempts, and executive impersonation.

•Email Header and Protocol Analysis Module o Deep analysis of email headers including Return-Path, Received headers, Message-ID, Reply-To,DKIM signatures, SPF alignment, and DMARC status.

o Detection of anomalies in mail routing, forged sender fields, relay manipulation, and spoofed transmission records.

o Validation of whether the email was sent through authorized infrastructure or suspicious relay paths.

•Origin Traceability and Location Analysis o Extraction of originating IP addresses from header chains and identification of the earliest reliable sending node.

o IP geolocation mapping to estimate the likely country, region, city, ISP, hosting provider, or proxy service associated with the email source.

o Correlation with VPN, TOR, open relay, botnet, or cloud-hosted infrastructure indicators where applicable.

o Domain intelligence analysis using WHOIS data, DNS records, MX records, hosting fingerprints,and registrar details to identify suspicious sender infrastructure.

•Identity Correlation and Attribution Support o Correlation of email indicators with known threat intelligence, blacklists, previous incidents,domain clusters, and repeated fraud campaigns.

o Graph-based relationship analysis between sender domains, IP addresses, aliases, reply chains, and linked infrastructure.

o Confidence-based investigative assessment to assist in revealing probable sender identity, associated infrastructure, or campaign-level attribution patterns.

o Support for flagging whether the email likely originated from a compromised account, spoofed domain, anonymized infrastructure, or direct malicious actor environment.

•Alerting, Dashboard, and Forensic Reporting o Real-time alerts for high-risk emails before user interaction or administrative approval.

o Analyst dashboard showing fraud score, spoofing indicators, sender trace path, geolocation map,and attribution confidence.

o Generation of structured forensic reports for institutional action, legal review, cyber incident response, and support to law enforcement agencies.

o Searchable case management view for grouping related fraudulent emails into campaigns.

•Privacy, Legal, and Compliance Safeguards o Controlled handling of personal data and metadata in accordance with organizational privacy policies.

o Logging, evidence preservation, and chain-of-custody support for investigation purposes.

oConfigurable retention and masking mechanisms for sensitive communication data.

•Expected Outcomes
•Early and accurate detection of fraudulent, spoofed, and phishing-based email attacks.
•Improved ability to trace suspicious email origin paths and identify probable source infrastructure.
•Enhanced fraud investigation capability through geolocation analysis, domain intelligence, and sender attribution support.
•Reduced financial loss, reputational damage, and unauthorized disclosure of confidential information caused by email-based fraud.
•Better institutional readiness for cyber incident response, forensic investigation, and enforcement coordination.