DecodeX
Home/Problem Statements/SIH26159
All 226 Statements
SIH26159SoftwareBlockchain & Cybersecurity
₹1,50,000 Prize (₹75k Joint)
•
Deadline: 20 September 2026
•
Submitted Ideas: 0/500

SecureMailScope: AI-Assisted Cryptographic Security Posture Assessment for Secure Email Communications

Ministry / Organization: National Technical Research Organisation (NTRO)
SIH Official PortalDataset Repository
Technical Complexity
8/10
Dataset Accessibility
9/10
36h Hackathon Viability
9/10
Step 0 • Zero-Jargon Layman Summary

“Organizations rely heavily on email communication, but hidden security misconfigurations often leave them vulnerable to cyber attacks. This software takes captured network traffic files (PCAPs), automatically analyzes how encryption and security certificates are negotiated, and uses AI to find risks and provide a clear security score.”

The DecodeX PS Decoder™

Deconstructed Problem Blueprint

Step 1

WHAT TO BUILD?

An AI-assisted passive network forensic and cryptographic security assessment framework specifically designed for email protocols (SMTP, IMAP, POP3).

Step 2

WHO IS IT FOR?

Security Operations Centers (SOC), Digital Forensics and Incident Response (DFIR) teams, and enterprise/government administrators protecting national communication infrastructure.

Step 3

WHY DOES IT EXIST?

Existing network analysis tools focus purely on packet decoding and traffic inspection without evaluating the deeper cryptographic security posture or prioritizing risks using AI, leaving email servers prone to downgrade and man-in-the-middle attacks.

Step 4

INPUT → PROCESS → OUTPUT ARCHITECTURE PIPELINE

01 • Inputs & Telemetry

PCAP (Packet Capture) network traffic files containing SMTP, IMAP, or POP3 communication sessions.

02 • Processing & AI Core

TCP stream reassembly, TLS handshake parsing, X.509 certificate validation, feature extraction (cipher suites, key lengths, TLS versions), and AI/ML risk scoring and anomaly detection.

03 • Actionable Deliverables

Actionable security posture score, prioritized vulnerability list, threat alerts, interactive monitoring dashboard, and exportable forensic reports in JSON, PDF, and HTML formats.

Step 5

CONSTRAINTS

  • Must accurately handle incomplete or fragmented TCP streams from raw PCAP files.
  • Needs to support both legacy and modern TLS versions (TLS 1.0 to TLS 1.3).
  • Must operate entirely passively without interfering with live enterprise network traffic.
  • Parsing performance must scale smoothly with large multi-gigabyte PCAP files.
Step 6

JURY METRICS

  • Accuracy of TLS handshake and cipher suite extraction compared to standard baselines.
  • Precision and recall of AI-based cryptographic risk classification and anomaly detection.
  • Parsing speed (megabytes/gigabytes per second) of PCAP stream reconstruction.
  • Clarity, completeness, and export fidelity of the forensic reports and dashboard UX.
Step 7

CORE BOTTLENECK

Reconstructing messy TCP streams and STARTTLS protocol upgrades cleanly from raw packet captures to reliably extract deep cryptographic metadata before feeding it into the AI models.

Why You Should Choose This PS (Pros)

  • Extremely relevant to national security and critical infrastructure protection (NTRO domain).
  • Clear, structured deliverables with defined inputs and outputs.
  • Strong potential for a high 'wow-factor' interactive dashboard and polished AI-driven risk scoring.
  • Can be easily demonstrated using custom-generated synthetic PCAP capture files.

Challenges & Risks to Watch (Cons)

  • Requires solid foundational networking knowledge (TCP/IP stacks, TLS handshake structures).
  • Parsing raw PCAP files accurately requires robust custom parsing logic or careful wrapper implementation over libraries like Scapy or PyShark.
  • Crowded category if teams fail to implement truly novel AI analytics beyond basic rule-checking.
Hackathon Blueprint

Recommended Tech Stack & Grand Finale Features

Frontend & Mobile
React.jsTailwind CSSChart.js / Recharts for security analytics visualization
Backend & APIs
PythonFastAPIScapy / PyShark for PCAP parsingCryptography library for X.509 parsing
AI / ML & Models
Scikit-learn (Isolation Forest for TLS anomaly detection)Rule-based expert systems for cryptographic risk scoring matrices
Database & Cloud
SQLite / PostgreSQL for session metadataLocal file storage for uploaded PCAP files and generated reports

Killer Features to Impress the SIH Jury

One-click Synthetic PCAP Generator inside the app that lets judges instantly generate insecure vs secure email traffic to test the engine.
Automated Certificate Chain Visualizer displaying trust path issues, expiration countdowns, and weak public key algorithms graphically.
AI-Powered Remediation Assistant that suggests exact configuration lines (e.g., Nginx/Postfix config snippets) to fix detected cipher weaknesses.
Forward Secrecy Compliance Auditor that flags ephemeral key exchange gaps instantly.
View Official SIH 2026 Portal Raw Text
▼
•Background Electronic mail remains one of the most critical communication services for governments, enterprises, financial institutions, and academic organizations. Despite the widespread adoption of Transport Layer Security (TLS), many SMTP, IMAP, and POP3 deployments continue to suffer from cryptographic misconfigurations such as obsolete TLS versions, weak cipher suites, insecure STARTTLS implementations, expired or improperly configured certificates, and non-compliance with modern security standards. These weaknesses expose email infrastructures to downgrade attacks, man-in-the-middle attacks, passive interception, and other cryptographic threats.

Although existing network analysis tools provide extensive packet-level visibility, they primarily focus on protocol decoding and traffic inspection. They do not automatically evaluate the overall cryptographic security posture of email communications or provide intelligent risk assessment and prioritization for security analysts.

•Description Design and develop an AI-assisted passive network forensic framework capable of analyzing captured network traffic (PCAP files) containing SMTP, IMAP, and POP3 communications to automatically assess the cryptographic security posture of enterprise email infrastructures.

The proposed solution shall reconstruct complete email communication sessions, identify encryption transitions, analyze TLS negotiations, validate digital certificates, detect cryptographic weaknesses, and leverage Artificial Intelligence/Machine Learning techniques to classify security risks, detect anomalous TLS behavior, and generate actionable security recommendations.

The framework should assist Security Operations Centers (SOC), Digital Forensics teams, Incident Response teams, and enterprise administrators in rapidly identifying cryptographic vulnerabilities, prioritizing remediation efforts, and ensuring compliance with modern cryptographic best practices.

•Objectives- The proposed system should be capable of:
•Passive analysis of encrypted SMTP, IMAP, and POP3 traffic from PCAP files.
•Automatic identification of application-layer email protocols.
•Detection of STARTTLS negotiation and encrypted session upgrades.
•Reconstruction of complete TCP communication streams.
•Parsing and reconstruction of TLS handshakes.
•Extraction and validation of X.509 digital certificates.
•Identification of negotiated TLS versions, cipher suites, and key exchange mechanisms.
•Detection of deprecated protocols, weak cipher suites, insecure cryptographic algorithms, and certificate-related vulnerabilities.
•Extraction of cryptographic features for intelligent analysis.
•Application of AI/ML techniques for:
•Cryptographic risk classification.
•Detection of anomalous TLS behavior.
•Security posture scoring.
•Threat prioritization.
•Recommendation of mitigation measures.
•Generation of comprehensive forensic reports and security dashboards.

Expected Solution/Deliverables:

The solution should provide the following outputs:

•Automatic identification of SMTP, IMAP, and POP3 protocols.
•STARTTLS negotiation detection and validation.
•Complete TCP stream reconstruction.
•TLS handshake reconstruction.
•Detection of negotiated TLS versions.
•Identification of negotiated cipher suites.
•Identification of key exchange mechanisms.
•Extraction of X.509 certificates.
•Certificate chain validation.
•Certificate expiration analysis.
•Public key algorithm and key length analysis.
•Digital signature algorithm identification.
•Detection of weak cryptographic algorithms and deprecated TLS versions.
•Identification of insecure protocol configurations.
•Forward Secrecy assessment.
•AI-based cryptographic risk scoring.
•AI-assisted anomaly detection for suspicious TLS sessions.
•Prioritized security findings.
•Comprehensive cryptographic security posture assessment.
•Exportable forensic reports in JSON, PDF, and HTML formats.
•Interactive visualization dashboard for security monitoring and analysis.