Home About Projects My Toolkit Experience Achievements Education Contact
← Back to Projects
AutoCTI - Automated Cyber Threat Detection Using AutoML

🛡️ AutoCTI

Automated Cyber Threat Detection using AutoML

FastAPI React AutoML Chrome Extension Manifest V3

A real-time cybersecurity system that detects and blocks threats from platforms like WhatsApp, Gmail, and browsers using AutoML algorithms and a background Chrome Extension.

Project Team

AutoCTI was designed and developed by: Preetham bhandary, Sanjana A Padukone, Sakshi V Moger, and Sreedevi P.

Key Highlights

Real-time Detection: Instantaneous analysis of clicked URLs.
🧠 AutoML Core: Auto-model selection (H2O.ai / Auto-sklearn).
🧩 Chrome Extension: Seamless background browser blocking.

Overview

With attackers increasingly leveraging chat apps like WhatsApp, email systems like Gmail, and web applications to distribute malicious links, traditional security methods fall short.

AutoCTI acts as an active shield. It monitors network requests in the background, intercepting link clicks from any web source. Instead of relying on signature-based static rule databases (which fail against new domains), AutoCTI uses machine learning pipelines to detect anomalies dynamically.

Monitored Attack Vectors

  • 🎣 Phishing URLs: Deceptive sites mimicking real banking or utility services.
  • 🔗 Suspicious Links: Obfuscated, heavily redirected, or short domains.
  • 🔓 Brute-Force: Multiple repeated API logs and credential-stuffing logs.
  • 🦠 Malware Payloads: Binary structures analyzed via behavior heuristics (in progress).

The Solution: AutoCTI vs Antivirus

Traditional firewalls and antivirus packages struggle with URL-based social engineering and zero-day malicious domains. AutoCTI uses Automated Machine Learning to adapt to new threat behaviors without waiting for manual library updates.

Feature 🛡️ Traditional Antivirus 🧠 AutoCTI Solution
Primary Approach Static / Signature-based library checks Dynamic / Machine Learning anomaly detection
Zero-Day Threats ❌ Cannot detect unknown threats ✅ Identifies new anomalies autonomously
Adaptability ❌ Relies on manual, scheduled database updates ✅ Adapts on-the-fly via AutoML retraining
Focus Area 💻 Offline File system & executable binaries 🌐 Web links, chat app traffic, and live URLs

Core Capabilities

Real-time Detection

Instantaneous analysis of clicked links from WhatsApp Web, Gmail, or standard web browsers.

AutoML Core

Utilizes H2O.ai & Auto-sklearn to automatically run and select high-precision models.

Chrome Extension

Manifest V3 extension monitors browser activities silently in the background.

Interactive Dashboard

A comprehensive React dashboard to visualize active logs, threats, and severity metrics.

Automated Blocking

Neutralizes threats immediately on the client side before the user's browser loads the page.

Severity Levels

Triages threat vectors into Low (🟢), Medium (🟡), and Critical (🔴) classification pools.

System Architecture

AutoCTI integrates a Chrome Extension client with a FastAPI server to run real-time AutoML classification.

User Agent Clicks URL Chrome Extension Captures URL (MV3) Background Script FastAPI Backend Triggers ML Analysis REST / WebSockets AutoML Engine Classifies Domain H2O.ai / sklearn Blocks threat requests & updates React dashboard metrics

Tech Stack

Backend & Core Logic

  • FastAPI (Asynchronous Python)
  • REST APIs & WebSocket protocols
  • Uvicorn development server
  • Pydantic schemas for logs

Machine Learning Engine

  • AutoML (H2O.ai / Auto-sklearn)
  • Dynamic model selection pipelines
  • Hyperparameter tuning optimization
  • Scikit-learn classification models

Frontend & Client

  • React.js Threat Dashboard UI
  • Chrome Extension (Background Service)
  • JavaScript & Manifest V3 API Hooks
  • Active page DOM blocking handlers

Getting Started

1️⃣ Backend Setup (FastAPI)

# Navigate to the backend directory cd backend # Install required dependencies pip install -r requirements.txt # Start the FastAPI development server uvicorn main:app --reload

2️⃣ Frontend Setup (React)

# Navigate to the frontend directory cd frontend # Install Node modules npm install # Start the React development server npm start

3️⃣ Chrome Extension Installation

Open Google Chrome and navigate to chrome://extensions/. Toggle **Developer Mode** ON, click **Load unpacked**, and select the backend/autocti_chrome_ext directory.

Roadmap & Phases

Phase 1

Core Integration

Phishing detection models training and background Chrome Extension (Manifest V3) integration.

Phase 2

Analytics Console

Real-time React dashboard console displaying logs, metrics, and threat tracking indexes.

Phase 3

Malware Analysis

Behavior-based script sandboxing and file payload classification using AutoML (In progress).

Phase 4

Cloud & Packaging

Dockerizing system components and provisioning AWS/GCP pipelines for cloud hosting.

Phase 5

Explainable AI

Integrating XAI tools to explain specific model decisions for blocked URLs to operators.

Phase 6

Retraining Loop

Continuous model retraining feeds to automatically ingest new threat feeds without shutdowns.

Interested in AutoCTI?

Check out the full open-source codebase on GitHub or reach out to discuss machine learning integrations.