SIH26159: SecureMailScope: AI-Assisted Cryptographic Security Posture Assessment for Secur — SIH 2026 | Wynit

SIH26159: SecureMailScope: AI-Assisted Cryptographic Security Posture Assessment for Secur — SIH 2026 | Wynit

What they'll ask you

12

Generated from the brief's own wording and the competition's published rules, never from a guess about what this ministry prefers.

Specific machine learning models or algorithms to use?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.
Exact scoring rubric for the cryptographic risk score?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.
Sample PCAP datasets for testing?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.

9 morethe ones a panel gets to if there is time

Has any part of this been shown at a previous event, hackathon or college project?
The guidelines are explicit: your solution must not have appeared in any previous event or programme, of any sort. A recycled project is what a team under time pressure reaches for.
The brief asks for pcap traffic ingestion. How would you build that?
Decoded from SIH26159 itself: The system ingests and processes network traffic files containing SMTP, IMAP, and POP3 communications. The brief asks for it by name.
The brief asks for protocol and stream parser. How would you build that?
Decoded from SIH26159 itself: It reconstructs TCP communication streams, identifies email protocols, and detects STARTTLS negotiations. The brief asks for it by name.
The brief asks for tls and certificate analyzer. How would you build that?
Decoded from SIH26159 itself: It parses TLS handshakes, extracts and validates X.509 certificates, and checks ciphers and versions. The brief asks for it by name.
The brief asks for ai risk scoring engine. How would you build that?
Decoded from SIH26159 itself: It uses machine learning to classify cryptographic risks, detect anomalies, and prioritize security findings. The brief asks for it by name.
The brief asks for dashboard and report generator. How would you build that?
Decoded from SIH26159 itself: It provides an interactive visualization dashboard and exports forensic reports in JSON, PDF, and HTML formats. The brief asks for it by name.
Why not use what already exists? Name the closest thing to this that is already running.
A team that has not named the alternative themselves is answering this for the first time in the room.
Which single thing will you demonstrate end to end, start to finish, with nothing skipped?
Ours, not a rule: a narrow thing that fully works survives questioning better than a broad thing that half works. If nobody on the team can name it, that is the finding.
Show me this working: the evaluators will check whether the framework can accurately parse PCAP files, reconstruct TLS handshakes, validate digital certificates, and generate the required JSON, PDF, and HTML reports.
This is the evaluator read for your problem statement, decoded from the brief's own wording.

The government's original description (499 words)

• Background Electronic mail remains one of the most critical communication services for governments, enterprises, financial institutions, and academic organizations. Despite the widespread adoption of Transport Layer Security (TLS), many SMTP, IMAP, and POP3 deployments continue to suffer from cryptographic misconfigurations such as obsolete TLS versions, weak cipher suites, insecure STARTTLS implementations, expired or improperly configured certificates, and non-compliance with modern security standards. These weaknesses expose email infrastructures to downgrade attacks, man-in-the-middle attacks, passive interception, and other cryptographic threats. Although existing network analysis tools provide extensive packet-level visibility, they primarily focus on protocol decoding and traffic inspection. They do not automatically evaluate the overall cryptographic security posture of email communications or provide intelligent risk assessment and prioritization for security analysts. • Description Design and develop an AI-assisted passive network forensic framework capable of analyzing captured network traffic (PCAP files) containing SMTP, IMAP, and POP3 communications to automatically assess the cryptographic security posture of enterprise email infrastructures. The proposed solution shall reconstruct complete email communication sessions, identify encryption transitions, analyze TLS negotiations, validate digital certificates, detect cryptographic weaknesses, and leverage Artificial Intelligence/Machine Learning techniques to classify security risks, detect anomalous TLS behavior, and generate actionable security recommendations. The framework should assist Security Operations Centers (SOC), Digital Forensics teams, Incident Response teams, and enterprise administrators in rapidly identifying cryptographic vulnerabilities, prioritizing remediation efforts, and ensuring compliance with modern cryptographic best practices. • Objectives- The proposed system should be capable of: • Passive analysis of encrypted SMTP, IMAP, and POP3 traffic from PCAP files. • Automatic identification of application-layer email protocols. • Detection of STARTTLS negotiation and encrypted session upgrades. • Reconstruction of complete TCP communication streams. • Parsing and reconstruction of TLS handshakes. • Extraction and validation of X.509 digital certificates. • Identification of negotiated TLS versions, cipher suites, and key exchange mechanisms. • Detection of deprecated protocols, weak cipher suites, insecure cryptographic algorithms, and certificate-related vulnerabilities. • Extraction of cryptographic features for intelligent analysis. • Application of AI/ML techniques for: • Cryptographic risk classification. • Detection of anomalous TLS behavior. • Security posture scoring. • Threat prioritization. • Recommendation of mitigation measures. • Generation of comprehensive forensic reports and security dashboards. Expected Solution/Deliverables: The solution should provide the following outputs: • Automatic identification of SMTP, IMAP, and POP3 protocols. • STARTTLS negotiation detection and validation. • Complete TCP stream reconstruction. • TLS handshake reconstruction. • Detection of negotiated TLS versions. • Identification of negotiated cipher suites. • Identification of key exchange mechanisms. • Extraction of X.509 certificates. • Certificate chain validation. • Certificate expiration analysis. • Public key algorithm and key length analysis. • Digital signature algorithm identification. • Detection of weak cryptographic algorithms and deprecated TLS versions. • Identification of insecure protocol configurations. • Forward Secrecy assessment. • AI-based cryptographic risk scoring. • AI-assisted anomaly detection for suspicious TLS sessions. • Prioritized security findings. • Comprehensive cryptographic security posture assessment. • Exportable forensic reports in JSON, PDF, and HTML formats. • Interactive visualization dashboard for security monitoring and analysis.