~/sabarish.dev
← all posts

~/posts/ai-kavach-cyber-defense-system

AI-Kavach: real-time cyber defense with a browser extension

Sabarish R2 min read
  • security
  • chrome-extension
  • python
  • flask
  • ai-ml

Most phishing happens in the browser, and most defenses happen somewhere else — an email filter, a gateway, a SOC you never see. AI-Kavach brings the defense to where the user is: a Chrome extension watches the tabs you actually open, a backend scores the URLs, and a malicious page gets closed before you interact with it.

Co-developed with my team and presented live at PECTEAM 2K25 (Panimalar Engineering College × IEEE), it's the project that put my phishing research into a product people could watch being demoed — the demo clips show a malicious URL getting flagged and the tab auto-closing in real time.

Repo: github.com/SabarishR08/web-threat-monitoring-system

The three layers

1. The extension (MV3 Chrome extension)

  • Watches tab activity (tabs, scripting, notifications permissions)
  • Checks every URL the user visits against the backend
  • Auto-closes malicious URLs, shows notifications, and plays an alert
  • Popup UI showing the verdict for the current tab

2. The backend (Flask)

  • URL threat lookup via VirusTotal API (v3) — verdicts and score sources
  • ML-assisted phishing detection on top of the API signal
  • SQLite threat database (threats.db) recording every check
  • Brevo API email alerts — instant notification with client IP, URL, status, and severity when a threat fires
  • Rate limiting (10 req/s on stats endpoints) and auto-blocking of malicious IPs, including a CINS Army-list import for known-bad ranges
  • Cleanup routines that prune stale logs

3. The dashboard (Flask-served frontend)

  • Live threat statistics — total / malicious / safe / suspicious counts, plus severity distribution
  • Threat trends over time, full log views, and a sound-alert endpoint so operators hear threats as they land
  • A health endpoint that checks each component (database, VirusTotal API, email) so the platform's own status is visible

The security details that matter

  • Defense in depth — the extension is the enforcement point, but the backend enforces the same policy, so a bypassed extension doesn't mean an unprotected user
  • Fast failure — the extension is worthless if it slows browsing; the checks are fire-and-forget lookups with notifications, not blocking round-trips on every click
  • Alerting with context — email alerts carry IP, URL, status, and severity, not just "something bad happened"

The lineage

AI-Kavach is the direct ancestor of my AI Threat Detection & Security Operations platform (the Shentinelix Round-2 build): same DNA of URL/email/QR/log analysis, risk scoring, and SOC dashboards, with the extension as the client-side enforcement layer that the later platform kept in spirit. The QRishing research feeds the same lineage — decode, verify, act.

Status

Presented and demoed at IEEE PECTEAM 2K25. The extension is enterprise-flavored (v2.0, MV3, service-worker background) and the backend is a solid Flask + SQLite monolith — the obvious next steps are moving the threat DB to something concurrent (the SIH platform's ML ensemble is a good template) and shipping the extension to the Chrome Web Store.