SIH26159/Blockchain & Cybersecurity

AI email cryptography security assessment tool

A software tool that analyzes network traffic files to automatically assess the cryptographic security posture of email communications and generate forensic reports for security analysts.

National Technical Research Organisation (NTRO) · Software

Teams already in: 1/500almost everyone who enters · read 1 hour ago
Buildable in 36 hours: HighOur estimate, from their wording
Hard blockers: NoneNothing you must source first
Submissions close: 15 Sept9 days left

Make this one of our two Compare with others

Signing in saves it for your whole team — everyone on your invite link sees the same two entries. Anything you shortlisted while signed out comes with you.

Submit on sih.gov.in Dataset

Whether this suits your team

Why this fits you

This organisation declared winners on 13 problem statement(s) in SIH 2025 and on 13 in SIH 2024. It has awarded 4 joint winner(s), so it sometimes splits a prize between two teams.

What you would have to build

Decomposed from what the description asks for. Nothing added.

01
PCAP Traffic Ingestion
The system ingests and processes network traffic files containing SMTP, IMAP, and POP3 communications.
02
Protocol and Stream Parser
It reconstructs TCP communication streams, identifies email protocols, and detects STARTTLS negotiations.
03
TLS and Certificate Analyzer
It parses TLS handshakes, extracts and validates X.509 certificates, and checks ciphers and versions.
04
AI Risk Scoring Engine
It uses machine learning to classify cryptographic risks, detect anomalies, and prioritize security findings.
05
Dashboard and Report Generator
It provides an interactive visualization dashboard and exports forensic reports in JSON, PDF, and HTML formats.

What they ask for, and what they leave open

Both columns are read off the brief's own wording. Nothing here is inferred from the ministry's name.

They state

The evaluators will check whether the framework can accurately parse PCAP files, reconstruct TLS handshakes, validate digital certificates, and generate the required JSON, PDF, and HTML reports.

They never say

specific machine learning models or algorithms to use
exact scoring rubric for the cryptographic risk score
sample PCAP datasets for testing

A jury can still ask about these. Decide them deliberately rather than by accident.

What they'll ask you

Generated from the brief's own wording and the competition's published rules — never from a guess about what this ministry prefers.

Specific machine learning models or algorithms to use?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.
Exact scoring rubric for the cryptographic risk score?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.
Sample PCAP datasets for testing?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.

9 more— the ones a panel gets to if there is time

Has any part of this been shown at a previous event, hackathon or college project?
The guidelines are explicit: your solution must not have appeared in any previous event or programme, of any sort. A recycled project is what a team under time pressure reaches for.

The data

What the organisers attached, and what the brief assumes you can get.

Dataset from the organisers: Provided — open it
Does the brief need data?: Yes, and they gave it to you.

Also from National Technical Research Organisation (NTRO)

Same organisation, same year. Reading two of theirs tells you more about what they care about than reading one.

Take this to an AI

Pick what you are about to do and copy the prompt. It carries the organisers' own wording, the constraints they never spell out, and an instruction not to invent requirements they never set.

Who has this problem, what already exists, and what you would have to find out.

# Context: India's Smart India Hackathon 2026

I am on a student team entering SIH 2026. Problem statement SIH26159, set by National Technical Research Organisation (NTRO).
Its official title, word for word: "SecureMailScope: AI-Assisted Cryptographic Security Posture Assessment for Secure Email Communications"
Theme: Blockchain & Cybersecurity. Category: software.

In plain terms: A software tool that analyzes network traffic files to automatically assess the cryptographic security posture of email communications and generate forensic reports for security analysts.

## The organisers' full description, verbatim

• Background Electronic mail remains one of the most critical communication services for governments, enterprises, financial institutions, and academic organizations. Despite the widespread adoption of Transport Layer Security (TLS), many SMTP, IMAP, and POP3 deployments continue to suffer from cryptographic misconfigurations such as obsolete TLS versions, weak cipher suites, insecure STARTTLS implementations, expired or improperly configured certificates, and non-compliance with modern security standards. These weaknesses expose email infrastructures to downgrade attacks, man-in-the-middle attacks, passive interception, and other cryptographic threats. Although existing network analysis tools provide extensive packet-level visibility, they primarily focus on protocol decoding and traffic inspection. They do not automatically evaluate the overall cryptographic security posture of email communications or provide intelligent risk assessment and prioritization for security analysts. • Description Design and develop an AI-assisted passive network forensic framework capable of analyzing captured network traffic (PCAP files) containing SMTP, IMAP, and POP3 communications to automatically assess the cryptographic security posture of enterprise email infrastructures. The proposed solution shall reconstruct complete email communication sessions, identify encryption transitions, analyze TLS negotiations, validate digital certificates, detect cryptographic weaknesses, and leverage Artificial Intelligence/Machine Learning techniques to classify security risks, detect anomalous TLS behavior, and generate actionable security recommendations. The framework should assist Security Operations Centers (SOC), Digital Forensics teams, Incident Response teams, and enterprise administrators in rapidly identifying cryptographic vulnerabilities, prioritizing remediation efforts, and ensuring compliance with modern cryptographic best practices. • Objectives- The proposed system should be capable of: • Passive analysis of encrypted SMTP, IMAP, and POP3 traffic from PCAP files. • Automatic identification of application-layer email protocols. • Detection of STARTTLS negotiation and encrypted session upgrades. • Reconstruction of complete TCP communication streams. • Parsing and reconstruction of TLS handshakes. • Extraction and validation of X.509 digital certificates. • Identification of negotiated TLS versions, cipher suites, and key exchange mechanisms. • Detection of deprecated protocols, weak cipher suites, insecure cryptographic algorithms, and certificate-related vulnerabilities. • Extraction of cryptographic features for intelligent analysis. • Application of AI/ML techniques for: • Cryptographic risk classification. • Detection of anomalous TLS behavior. • Security posture scoring. • Threat prioritization. • Recommendation of mitigation measures. • Generation of comprehensive forensic reports and security dashboards. Expected Solution/Deliverables: The solution should provide the following outputs: • Automatic identification of SMTP, IMAP, and POP3 protocols. • STARTTLS negotiation detection and validation. • Complete TCP stream reconstruction. • TLS handshake reconstruction. • Detection of negotiated TLS versions. • Identification of negotiated cipher suites. • Identification of key exchange mechanisms. • Extraction of X.509 certificates. • Certificate chain validation. • Certificate expiration analysis. • Public key algorithm and key length analysis. • Digital signature algorithm identification. • Detection of weak cryptographic algorithms and deprecated TLS versions. • Identification of insecure protocol configurations. • Forward Secrecy assessment. • AI-based cryptographic risk scoring. • AI-assisted anomaly detection for suspicious TLS sessions. • Prioritized security findings. • Comprehensive cryptographic security posture assessment. • Exportable forensic reports in JSON, PDF, and HTML formats. • Interactive visualization dashboard for security monitoring and analysis.

## What the brief never says

- specific machine learning models or algorithms to use
- exact scoring rubric for the cryptographic risk score
- sample PCAP datasets for testing
## Constraints that are not negotiable

- The judged build is a prototype demonstrated in roughly 36 hours by students, not a product.
- A jury evaluates it against this problem statement's own wording, not against general merit.
- We submit on sih.gov.in; the problem statement number and title above must match exactly.
- Your solution must not have appeared in any previous event or programme, of any sort.
- The organisers attached a dataset, so build against theirs rather than inventing one.

## What I want from you

1. Who actually has this problem in India, and what they do about it today.
2. What already exists — government systems, open-source projects, published research — that we should not rebuild.
3. For each item under 'what the brief never says', what the realistic answer is likely to be and how I could verify it.
4. The two or three things about this domain that a student team would get wrong without local knowledge.
## How to answer

- Everything above between quotation marks is the organisers' own wording. Treat it as the requirement.
- Do NOT invent requirements the brief does not state. If something matters and is not stated, say so and ask me, rather than assuming.
- Where you are inferring rather than reading, mark it as your inference.
- Do not guess what this ministry wants from its name. Its wording above is the only evidence.

---
Problem statement facts assembled by Wynit from National Technical Research Organisation (NTRO)'s published brief for SIH 2026.
The plain-English summary, the list of parts and the evaluator read are our interpretation of that text; the quoted title and the full description are theirs.

The government's original description (499 words)

• Background Electronic mail remains one of the most critical communication services for governments, enterprises, financial institutions, and academic organizations. Despite the widespread adoption of Transport Layer Security (TLS), many SMTP, IMAP, and POP3 deployments continue to suffer from cryptographic misconfigurations such as obsolete TLS versions, weak cipher suites, insecure STARTTLS implementations, expired or improperly configured certificates, and non-compliance with modern security standards. These weaknesses expose email infrastructures to downgrade attacks, man-in-the-middle attacks, passive interception, and other cryptographic threats. Although existing network analysis tools provide extensive packet-level visibility, they primarily focus on protocol decoding and traffic inspection. They do not automatically evaluate the overall cryptographic security posture of email communications or provide intelligent risk assessment and prioritization for security analysts. • Description Design and develop an AI-assisted passive network forensic framework capable of analyzing captured network traffic (PCAP files) containing SMTP, IMAP, and POP3 communications to automatically assess the cryptographic security posture of enterprise email infrastructures. The proposed solution shall reconstruct complete email communication sessions, identify encryption transitions, analyze TLS negotiations, validate digital certificates, detect cryptographic weaknesses, and leverage Artificial Intelligence/Machine Learning techniques to classify security risks, detect anomalous TLS behavior, and generate actionable security recommendations. The framework should assist Security Operations Centers (SOC), Digital Forensics teams, Incident Response teams, and enterprise administrators in rapidly identifying cryptographic vulnerabilities, prioritizing remediation efforts, and ensuring compliance with modern cryptographic best practices. • Objectives- The proposed system should be capable of: • Passive analysis of encrypted SMTP, IMAP, and POP3 traffic from PCAP files. • Automatic identification of application-layer email protocols. • Detection of STARTTLS negotiation and encrypted session upgrades. • Reconstruction of complete TCP communication streams. • Parsing and reconstruction of TLS handshakes. • Extraction and validation of X.509 digital certificates. • Identification of negotiated TLS versions, cipher suites, and key exchange mechanisms. • Detection of deprecated protocols, weak cipher suites, insecure cryptographic algorithms, and certificate-related vulnerabilities. • Extraction of cryptographic features for intelligent analysis. • Application of AI/ML techniques for: • Cryptographic risk classification. • Detection of anomalous TLS behavior. • Security posture scoring. • Threat prioritization. • Recommendation of mitigation measures. • Generation of comprehensive forensic reports and security dashboards. Expected Solution/Deliverables: The solution should provide the following outputs: • Automatic identification of SMTP, IMAP, and POP3 protocols. • STARTTLS negotiation detection and validation. • Complete TCP stream reconstruction. • TLS handshake reconstruction. • Detection of negotiated TLS versions. • Identification of negotiated cipher suites. • Identification of key exchange mechanisms. • Extraction of X.509 certificates. • Certificate chain validation. • Certificate expiration analysis. • Public key algorithm and key length analysis. • Digital signature algorithm identification. • Detection of weak cryptographic algorithms and deprecated TLS versions. • Identification of insecure protocol configurations. • Forward Secrecy assessment. • AI-based cryptographic risk scoring. • AI-assisted anomaly detection for suspicious TLS sessions. • Prioritized security findings. • Comprehensive cryptographic security posture assessment. • Exportable forensic reports in JSON, PDF, and HTML formats. • Interactive visualization dashboard for security monitoring and analysis.