CYBERGUARD: Trust Nothing, Explain Everything

• The system should use AI, machine learning, NLP, computer vision, behavioural analytics, anomaly detection or generative AI to analyse multiple sources of digital activity — emails, SMS and messages, URLs, images, audio, video, authentication logs, system logs, network traffic and API logs
• It should not merely generate alerts. Every detection must carry a threat classification, a risk or severity score, an explanation of the detected threat, the evidence or indicators contributing to the decision, and recommended preventive or response actions
• Threat scenarios teams may address: AI-powered phishing detection across emails, SMS, social media messages, QR-code phishing, fraudulent websites and deceptive URLs, identifying indicators such as urgency, impersonation, suspicious domains, credential requests and unusual communication patterns
• Deepfake detection across images, video, voice clips, video calls and AI-generated media, with an authenticity or confidence score and manipulation indicators
• Digital impersonation detection targeting government officials, senior management, university authorities, financial institutions, brands and known contacts, analysing identity, communication style, metadata and behavioural patterns
• Credential theft and account takeover detection through failed login patterns, password spraying, unusual locations, unknown devices and sudden behavioural change
• Malicious URL and website detection covering domain spoofing, look-alike domains, URL manipulation, malicious redirects, suspicious SSL characteristics and fake login pages
• Broader threat detection covering malware indicators, suspicious network traffic, API abuse, data exfiltration, insider threats and abnormal system logs
• Risk scoring and explainability: assign every suspicious event a level such as Safe → Low → Medium → High → Critical, and explain the major factors behind it. Instead of "Phishing Detected", the system should say something like: high risk, because the sender domain closely resembles an authorised organisation, the message demands urgent credential verification, and the embedded URL redirects to an unrelated domain. Deepfake detections should similarly explain the indicators driving the confidence score
• Response recommendations may include: blocking a suspicious URL, quarantining an email, warning the user, requiring additional authentication, revoking an active session, blocking an IP or device, flagging multimedia for manual verification, reporting impersonation, notifying the administrator or SOC, and escalating the incident
• Innovation opportunities: generative-AI-assisted cyber defence, AI-generated phishing detection, multimodal deepfake and voice-cloning detection, email sender authenticity analysis, digital identity verification, behaviour-based fraud detection, explainable AI, graph-based attack analysis, real-time threat intelligence, MITRE ATT&CK mapping, zero-day anomaly detection, privacy-preserving AI, federated learning, autonomous defence agents and automated incident-response playbooks
• Minimum expected prototype: demonstrate at least three different cybersecurity scenarios — preferably one phishing or social engineering case, one digital impersonation, deepfake or identity fraud case, and one technical threat or abnormal behaviour case — running the full chain of detection, classification, risk assessment, explanation, alert and recommended response

For the Grand Finale, your build should include:

• A working prototype demonstrating the threat-detection mechanism across at least three cybersecurity scenarios spanning the required categories
• A risk-scoring mechanism with explainable threat assessment — evidence and contributing indicators shown for every decision
• A cybersecurity command dashboard covering events analysed, threats detected, categories, risk levels, attack timeline, frequently targeted users or services, recommended actions and incident status
• An intelligent response recommendation and mitigation layer tied to the detected threat type
• Technical documentation: system architecture, models and algorithms used, accuracy and performance evaluation on simulated, authorised or publicly available datasets, and the scalability and deployment approach

The Grand Finale is judged on:

• Detection accuracy and breadth across the three required scenario types — 30%
• Quality of risk scoring and explainability of every decision — 25%
• Usefulness of response recommendations and mitigation logic — 20%
• Command dashboard, architecture and scalability of the approach — 15%
• Performance evaluation rigour and demo quality — 10%