Cybersecurity Projects in Bangalore

A machine learning-based intrusion detection system is trained on the NSL-KDD dataset containing 125,973 training records across five traffic classes: normal, DoS, probe, R2L, and U2R. Features are engineered from raw network flow statistics including packet counts, byte counts, connection duration, and protocol flags. A Random Forest classifier achieves 99.1% accuracy and 98.7% F1 on the test set. A real-time detection module built with Scapy captures live network packets, extracts features, and classifies each flow. Detected intrusions are logged to a SQLite database and displayed on a Flask dashboard with attack type distribution charts.

An automated web application vulnerability scanner is built in Python to detect OWASP Top 10 vulnerabilities including SQL injection, XSS, CSRF, insecure direct object references, and security misconfiguration. The scanner uses Requests and BeautifulSoup to crawl target web applications, injects payloads from a curated wordlist, and analyses responses for vulnerability indicators. A deliberately vulnerable test application (DVWA) is used for validation. The scanner generates a structured HTML report with vulnerability descriptions, severity ratings (CVSS scores), and remediation recommendations. All testing is performed only on authorised targets in an isolated lab environment.

A malware detection system analyses Windows PE files using both static features (byte n-grams, import table, section entropy) and dynamic features (API call sequences from Cuckoo Sandbox reports). A gradient-boosted classifier trained on 10,000 malware and 5,000 benign samples from the VirusShare dataset achieves 97.4% accuracy and 0.3% false-positive rate. The static analysis pipeline processes a file in 50 ms; dynamic analysis requires sandbox execution. A Flask API accepts file uploads and returns a malware probability score with the top contributing features highlighted.

A phishing detection classifier is trained on 11,055 URLs from the UCI Phishing Websites dataset. Features are extracted from URL structure (length, special character count, subdomain depth, HTTPS usage), domain registration data (WHOIS age, registrar), and page content (form count, external link ratio). An XGBoost classifier achieves 97.1% accuracy and 96.8% F1 on the test set. A Chrome browser extension integrates the model via a FastAPI backend, displaying a real-time phishing risk score for the current page URL with a colour-coded indicator in the browser toolbar.

A secure file sharing web application implements end-to-end encryption using the Web Crypto API. Files are encrypted in the browser with AES-256-GCM before upload; the encryption key is derived from a user password using PBKDF2 with 100,000 iterations. Encrypted files are stored on a Node.js backend with MongoDB metadata storage. File sharing links include a key fragment in the URL hash (never sent to the server). The system is evaluated against a threat model covering server compromise, man-in-the-middle attacks, and brute-force key recovery. A security audit using OWASP ZAP identifies and remediates three medium-severity findings.

A Python-based digital forensics tool automates the collection and analysis of Windows forensic artefacts from a disk image: registry hives (recently accessed files, USB device history), browser history (Chrome, Firefox), event logs (login events, process creation), and prefetch files. The tool parses each artefact type using specialised libraries (python-registry, sqlite3, python-evtx) and generates a timeline of user activity in CSV and HTML formats. A simulated insider threat scenario is investigated using the tool, demonstrating recovery of deleted files, identification of data exfiltration events, and reconstruction of the attacker's activity timeline.

A password security application combines a strength analyser with a secure local password manager. The strength analyser evaluates passwords against entropy, dictionary attack resistance (using the zxcvbn library), and common pattern detection, providing a score and specific improvement suggestions. The password manager stores credentials encrypted with AES-256 in a local SQLite database, with the master key derived from a master password using Argon2id. A React frontend with a browser extension allows users to generate strong passwords, store credentials, and auto-fill login forms. The project includes a security analysis comparing Argon2id, bcrypt, and PBKDF2 for master key derivation.

A low-interaction honeypot is deployed on a cloud VM to capture and analyse real-world attack traffic. The honeypot simulates SSH, HTTP, and FTP services using Cowrie and Dionaea. Over a 30-day collection period, 14,237 connection attempts are logged, including 892 successful SSH login attempts using credential stuffing. Attack data is parsed, geolocated using MaxMind GeoIP, and visualised on a world map showing attack origin distribution. A threat intelligence report identifies the top 10 attacking IP ranges, most common credential pairs, and malware samples dropped by attackers, with MITRE ATT&CK technique mappings.