DecodeX
Home/Problem Statements/SIH26145
All 226 Statements
SIH26145SoftwareBlockchain & Cybersecurity
₹1,50,000 Prize (₹75k Joint)
•
Deadline: 20 September 2026
•
Submitted Ideas: 0/500

AI-Based Detection of Cyber Threats in Unidirectional IP Traffic

Ministry / Organization: National Technical Research Organisation (NTRO)
SIH Official PortalDataset Repository
Technical Complexity
8/10
Dataset Accessibility
7/10
36h Hackathon Viability
9/10
Step 0 • Zero-Jargon Layman Summary

“We are building a digital 'security camera' for network traffic that watches data flowing in one direction without being able to touch or stop it. It uses AI to spot suspicious patterns like hackers trying to break in, steal data, or hide malicious commands, and alerts security teams instantly.”

The DecodeX PS Decoder™

Deconstructed Problem Blueprint

Step 1

WHAT TO BUILD?

A high-speed, passive network traffic analysis platform that performs real-time threat detection on unidirectional data streams using ML-based metadata analysis.

Step 2

WHO IS IT FOR?

National Technical Research Organisation (NTRO) and critical infrastructure operators (power grids, defense networks, government data centers).

Step 3

WHY DOES IT EXIST?

Critical networks use 'data diodes' to physically prevent any return path for security. Current systems struggle to detect sophisticated threats without two-way communication, creating a blind spot that this solution aims to eliminate.

Step 4

INPUT → PROCESS → OUTPUT ARCHITECTURE PIPELINE

01 • Inputs & Telemetry

Live PCAP streams, NetFlow/IPFIX/sFlow records, and raw packet metadata.

02 • Processing & AI Core

Feature engineering (entropy, periodicity, fan-out), ML inference (Random Forest/XGBoost for classification, LSTM/Transformers for time-series beaconing), and statistical anomaly detection.

03 • Actionable Deliverables

Real-time dashboard showing threat alerts, confidence scores, evidence logs, and visual flow-pattern graphs.

Step 5

CONSTRAINTS

  • Strictly read-only (no return path/handshakes)
  • Zero payload decryption (metadata-only analysis)
  • Streaming-first architecture (no batch processing)
  • High-throughput performance requirements
Step 6

JURY METRICS

  • Inference latency (ms per flow)
  • False Positive Rate (FPR) / False Negative Rate (FNR)
  • Throughput capacity (Mbps/Gbps sustained)
  • Detection accuracy across the 6 specified threat categories
Step 7

CORE BOTTLENECK

The 'Cold Start' problem of detecting threats in encrypted traffic without decryption, combined with the requirement to maintain high throughput without any feedback loop to the source.

Why You Should Choose This PS (Pros)

  • High strategic value for national security
  • Clear, well-defined technical requirements
  • Excellent opportunity to showcase advanced ML/Cybersecurity expertise

Challenges & Risks to Watch (Cons)

  • Requires deep understanding of network protocols (TCP/IP, TLS, DNS)
  • High performance demands on the software architecture
  • Complex testing environment (needs realistic traffic generation)
Hackathon Blueprint

Recommended Tech Stack & Grand Finale Features

Frontend & Mobile
React.jsRecharts for flow visualizationTailwind CSS
Backend & APIs
FastAPIGo (for high-performance packet parsing)Apache Kafka for stream processing
AI / ML & Models
XGBoost/LightGBM for tabular flow dataIsolation Forests for anomaly detectionLSTM for beaconing periodicity
Database & Cloud
ClickHouse (for time-series logs)Redis (for real-time state tracking)

Killer Features to Impress the SIH Jury

Explainable AI (XAI) module that highlights exactly which packet feature triggered the alert
Automated 'Threat Playbook' generation for incident responders
Multi-vector correlation engine that links separate alerts to a single campaign
View Official SIH 2026 Portal Raw Text
▼
•Background Critical-infrastructure operators observe their gateway and peering links using passive mirroring or hardware data diodes that copy traffic into a monitoring enclave in one direction only. The enclave can see everything crossing the link, but it has no physical or protocol-level path back into the production network. This is deliberate as it removes an entire class of attack in which a compromised monitoring or analytics system becomes a pivot into the core network, and it preserves a clean chain of custody for forensic use. The trade-off is that any intelligence layer sitting in that enclave must work purely from what it can passively observe such as packet captures, exported flow records (NetFlow/IPFIX/sFlow), and derived metadata with no ability to send probes, complete handshakes with the traffic source, or push a mitigation command back.
•Description The objective is to design and build an AI/ML pipeline that ingests a one-directional stream of IP traffic from a simulated IP data and detects, classifies, and scores cyber-security threats in near real time, using only passively collected data. The pipeline must assume it can never re-contact the traffic's source or destination, cannot rely on completing any handshake itself, and cannot issue any action back across the ingest path. Its output is intelligence as labelled alerts, confidence scores, and supporting evidence displayed on visualisation dashboard. The system is designed to detect the following types of threat:
a.Volumetric / protocol DDoS: SYN floods, UDP reflection/amplification, and spoofed-source floods identified from flow-level rate and source-IP entropy statistics.
b.Botnet C2 beaconing: Periodicity and inter-arrival analysis on flows that repeat at regular intervals toward a small set of destinations.
c.DGA domains and DNS tunnelling: Entropy/n-gram analysis of DNS query names, plus query-length and record-type anomalies.
d.Malware inside encrypted sessions: Detection from TLS/QUIC metadata alone (JA3/JA3S or JA4 fingerprints, packet-size and timing sequences), without decrypting payload.
e.Reconnaissance and port scanning: Fan-out patterns from a single source across many destination ports or hosts.
f.Data exfiltration: Asymmetric flow-volume anomalies and unusual outbound-to-inbound byte ratios.

Expected Solution The system must be delivered as working prototype (source repository) implementing ingest, feature extraction, model inference, and alert output. Accompanying documentation of the model(s) used, features engineered, and the training/validation approach. The prototype must also include a simple dashboard of live or replayed detections with severity and confidence adhering to the following architectural constraints:

a.Read-only ingest: Treat the input as strictly read-only. Any design that assumes a return path, a live query to the source, or an inline block is out of scope.
b.No payload decryption: TLS/QUIC sessions must be analysed from metadata only, never from decrypted content.
c.Streaming, not batch: The pipeline must process traffic incrementally and raise alerts with bounded latency, not just produce an end-of-run report.
d.Defined throughput target: Solutions must state and demonstrate the traffic rate they were tested against (e.g., flows/sec or Mbps sustained).
e.Standardized alert schema: Alerts must be structured records for instance timestamp, flow identifier, threat class, confidence score, and supporting evidence feature.