Background

Land is a finite and strategic resource that underpins economic development, environmental sustainability, food security, urban expansion, and social equity. Effective land governance is therefore critical to achieving sustainable development goals and supporting India's rapidly evolving socio-economic landscape. However, the land administration ecosystem in India remains largely implementation-oriented, with limited institutional focus on applied research, policy experimentation, and evidence-based innovation.

Description

Develop a comprehensive National Digital Platform for Research and Policy Innovation that promotes applied research, policy experimentation, knowledge sharing, and evidence-based decision-making in land governance. The platform should function as a centralized repository and collaborative ecosystem that integrates datasets, research publications, policy documents, geospatial information, analytical tools, and case studies from various government departments, academic institutions, and research organizations.

Scope Of The Study

There is a pressing need for a dedicated digital platform that serves as a national knowledge ecosystem for researchers, policymakers, government agencies, academic institutions, and industry experts to collaborate, conduct research, evaluate policies, and develop innovative solutions for strengthening land governance across the country.

Problems

Emerging challenges such as climate change, rapid urbanization, urban-rural land transitions, increasing land disputes, sustainable land use planning, geospatial governance, and digital transformation require continuous research and innovative policy interventions. Despite the availability of vast datasets generated through land records, cadastral surveys, satellite imagery, GIS platforms, and government programmes, these resources remain underutilized for generating actionable insights and supporting informed policymaking.

Expected Solution

The proposed solution should be a secure, scalable, AI-enabled National Research and Policy Innovation Platform that strengthens evidence-based land governance through collaborative research, advanced analytics, and digital knowledge management. The platform should provide:

The platform should establish a sustainable national ecosystem for applied research and policy innovation, enabling evidence-based decision-making, fostering interdisciplinary collaboration, accelerating technological adoption, and supporting resilient, transparent, and future-ready land governance in India.

Background

Jharkhand is lndia's leading mineral-producing state, with coal mines, steel plants, and mica processing units employing hundreds of thousands of workers many of them young tribal recruits with no prior industrial exposure. Classroom-based safety training using static manuals has documented retention rates below 20% after one week. Live drills are operationally disruptive, and VR headset simulators are inaccessible to small-scale mines and contract workers.. The DGMS, Dhanbad, recorded 48 fatal mine accidents in Jharkhand in 2022-23, a large share involving workers with under 30 days of orientation. The Factories Act, 1948 and Mines Act, 1952 mandate periodic safety certification, yet no standardised digital training platform exists in regional languages, and physical certificates have no mechanism to verify comprehension.

Description

Design and develop a mobile AR-based vocational training and safety certification platform running on mid-range Android smartphones (Android 10+, no external headset required), accessible to workers across Jharkhand's mining, steel, and mica sectors. The platform must deliver interactive AR training modules covering five industrial safety domains: (l) Fire & Explosion Response-exit identification, extinguisher use, and evacuation sequencing overlaid on real surroundings via phone camera; (2) Gas Leak & Confined Space Protocol-hazard zone recognition, PPE selection, and buddy-system procedures simulated in AR; (3) Machinery.

Expected Solution

A working Android APK demonstrating at least two complete AR training modules, an assessment engine, QR-based certificate generation and verification, Hindi and Santali localisation, offline functionality, and a web admin compliance dashboard- submitted with a demo video and public GitHub repository.

Background

Enterprises and institutions invest heavily in cybersecurity tools, compliance programs, and risk management initiatives, yet cyber risk is still predominantly communicated using qualitative ratings such as 'Low','Medium', or 'High'.

These coarse categories fail to express the potential financial impact of cyber threats,making it difficult for senior management, boards, and regulators to evaluate whether current cyber investments are adequate or optimally allocated.

Cyber risk is inherently dynamic new vulnerabilities emerge, threat actors change tactics, business services are added or retired, and security controls mature over time.

Most current risk assessment practices rely on periodic, manual exercises, resulting in stale risk registers and limited visibility into the organization’s real-time cyber exposure.

This gap leads to suboptimal prioritization of remediation efforts, under- or over-spending on security controls, and weak alignment between technical risk metrics and business decision-making.

Problem Statement

Design and develop an AI-powered platform that continuously quantifies cyber risk in monetary terms by correlating technical security telemetry with business asset criticality and control effectiveness.

The platform must estimate the likelihood and financial impact of cyber incidents, identify key risk drivers, and recommend cost-effective mitigation strategies under explicit budget constraints.The solution should bridge the gap between technical cybersecurity metrics and business language, enabling CISOs, risk officers, and executive leadership to make informed, data-driven decisions about cyber risk and security investment.

Proposed Solution

Develop a cloud-ready cyber risk analytics platform that ingests data from multiple enterprise security and IT sources—such as vulnerability management, SIEM, IAM, EDR, CSPM, asset inventories, and threat intelligence feeds—and uses AI/ML models to compute continuous risk scores and estimated financial exposure, such as Expected Annual Loss.

The system should provide interactive dashboards and decision-support tools that allow stakeholders to simulate remediation scenarios, evaluate investment options, and understand the return on security investment.The platform must be capable of mapping risk metrics to established cybersecurity frameworks, including ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, RBI Cyber Security Framework, and SEBI Cybersecurity and Cyber Resilience Framework, supporting both regulatory reporting and internal governance.

Key Components

Risk Quantification Engine Continuous aggregation and normalization of data from vulnerability scanners, SIEM, IAM, EDR,CSPM, asset inventory, and other security tools.

Statistical and ML-based estimation of incident likelihood and potential business impact, including downtime costs, data breach costs, regulatory penalties, and reputational effects.

Calculation of enterprise cyber risk as financial exposure metrics (for example, Expected Annual Loss and Value at Risk) at organization, business unit, and asset levels.

Asset criticality modeling to weigh technical findings based on business importance and service dependencies.

Control effectiveness evaluation using telemetry about configuration strength,incident history, and compliance status.

AI Decision Support Layer Predictive analytics for emerging threats and evolving risk based on trends in vulnerabilities, threat intelligence, and control performance.

AI-generated mitigation recommendations that propose prioritized actions—such as patch deployment, access control tightening, network segmentation, and additional monitoring—with quantified risk reduction.

Natural language query interface for non-technical stakeholders, enabling questions like 'What is our highest financial cyber risk today?' or 'Which vulnerabilities contribute most to our expected losses?'.

Scenario simulation tools for exploring 'what-if' analyses, such as 'What happens if MFA is implemented across all privileged accounts?' or 'How will delaying remediation by 30 days affect our financial exposure?'.

Investment Optimization Module Optimization models that recommend sets of controls and remediation actions delivering maximum risk reduction for a specified budget (for example, ₹1 crore).

Computation of ROSI and cost-benefit metrics for different security initiatives to support strategic planning and board-level approvals.

Visualization of 'Investment vs.

Risk Reduction' curves to highlight diminishing returns and optimal spend zones.

Executive and Technical Dashboards Unified views for CISOs and executives, including Enterprise Risk Score, total Financial Exposure, Risk Trend Analysis, Top Risk Contributors, and Risk Reduction Opportunities.

Drill-down capability for technical teams to see control-level and asset-level findings, remediation backlogs, and mapping to frameworks and policies.

Compliance and Framework Mapping Built-in mapping against frameworks such as ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, RBI Cyber Security Framework, and SEBI Cybersecurity and Cyber Resilience Framework.

Support for generating evidence-based reports and dashboards for audits, regulatory filings, and internal governance committees.

Expected Outcomes

Background

Email continues to be one of the most widely used communication channels in government, education, banking,and enterprise ecosystems.

However, it also remains one of the most exploited attack vectors for phishing,impersonation, business email compromise, financial fraud, credential theft, and malware delivery.

Threat actors increasingly use spoofed domains, deceptive sender identities, social engineering techniques, and compromised infrastructure to send highly convincing fraudulent emails that appear legitimate to end users.Traditional email security controls such as spam filters, static blacklists, and rule-based signature mechanisms are often insufficient to detect sophisticated fraudulent emails.

Attackers now use AI-generated language,domain lookalikes, display-name spoofing, hidden redirection links, and relay chains to evade standard detection systems.

In many cases, even when a suspicious email is identified, organizations lack the technical capability to effectively trace the source path, identify probable sender infrastructure, correlate geolocation clues, and support investigation into the origin of the email.This gap creates major challenges for cybersecurity teams, law enforcement support, fraud response units, and institutional administrators who need not only to detect malicious emails but also to investigate their source and reveal indicators that may help identify the actor or infrastructure behind the attack.

Problem Statement

Current email security ecosystems primarily focus on filtering or blocking suspicious content but provide limited intelligence for deep forensic tracing of fraudulent email origins.

Existing tools often do not adequately correlate email headers, SMTP relay paths, SPF/DKIM/DMARC validation results, IP reputation, geolocation indicators, domain registration intelligence, and behavioral patterns to build a complete picture of the sender’s identity or operating location.There is a need for an AI-powered platform capable of detecting phishing, spoofed, impersonated, and fraudulent emails in real time or near real time, analyzing the complete technical structure of an email, tracing its transmission path across mail servers, estimating its origin with location, and generating forensic intelligence and investigative insights that assist in identifying malicious infrastructure, compromised systems, or threat actors behind the attack.The solution should support forensic analysis, fraud prevention, institutional email security, and investigation workflows while maintaining legal, privacy, and evidentiary standards.

Proposed Solution

Develop an AI-Powered Email Threat Detection, GeoLocation and Forensic Intelligence Platform that combines Natural Language Processing (NLP), Machine Learning (ML) , email header forensics, IP intelligence, domain analysis, and graph-based correlation to identify suspicious emails,detect advanced email threats, and investigate their probable origin.

The system should ingest raw email content, metadata, and headers; validate sender authentication mechanisms; extract indicators of compromise; reconstruct relay paths; analyze originating IP addresses and associated geolocation data; and generate a confidence-based assessment of fraud risk and probable sender origin.

The platform should provide actionable alerts, visual trace maps, and forensic reports for security analysts,administrators, and investigators.

Key Components

Fraudulent Email Detection Engine NLP-based analysis of email subject lines, body text, urgency cues, impersonation language, and social engineering patterns.

Detection of phishing indicators such as spoofed sender addresses, deceptive domains, suspicious attachments, malicious links, and obfuscated URLs.

AI/ML models to classify emails as legitimate, suspicious, impersonated, phishing, or fraud-related.

Identification of business email compromise patterns such as payment diversion, fake invoice requests, credential harvesting attempts, and executive impersonation.

Email Header and Protocol Analysis Module Deep analysis of email headers including Return-Path, Received headers, Message-ID, Reply-To,DKIM signatures, SPF alignment, and DMARC status.

Detection of anomalies in mail routing, forged sender fields, relay manipulation, and spoofed transmission records.

Validation of whether the email was sent through authorized infrastructure or suspicious relay paths.

Origin Traceability and Location Analysis Extraction of originating IP addresses from header chains and identification of the earliest reliable sending node.

IP geolocation mapping to estimate the likely country, region, city, ISP, hosting provider, or proxy service associated with the email source.

Correlation with VPN, TOR, open relay, botnet, or cloud-hosted infrastructure indicators where applicable.

Domain intelligence analysis using WHOIS data, DNS records, MX records, hosting fingerprints,and registrar details to identify suspicious sender infrastructure.

Identity Correlation and Attribution Support Correlation of email indicators with known threat intelligence, blacklists, previous incidents,domain clusters, and repeated fraud campaigns.

Graph-based relationship analysis between sender domains, IP addresses, aliases, reply chains, and linked infrastructure.

Confidence-based investigative assessment to assist in revealing probable sender identity, associated infrastructure, or campaign-level attribution patterns.

Support for flagging whether the email likely originated from a compromised account, spoofed domain, anonymized infrastructure, or direct malicious actor environment.

Alerting, Dashboard, and Forensic Reporting Real-time alerts for high-risk emails before user interaction or administrative approval.

Analyst dashboard showing fraud score, spoofing indicators, sender trace path, geolocation map,and attribution confidence.

Generation of structured forensic reports for institutional action, legal review, cyber incident response, and support to law enforcement agencies.

Searchable case management view for grouping related fraudulent emails into campaigns.

Privacy, Legal, and Compliance Safeguards Controlled handling of personal data and metadata in accordance with organizational privacy policies.

Logging, evidence preservation, and chain-of-custody support for investigation purposes. oConfigurable retention and masking mechanisms for sensitive communication data.

Expected Outcomes

Background

Organizations today rely heavily on centralized identity and access management systems, which create significant security and operational risks. These systems are vulnerable to cyber attacks, identity theft, unauthorized access, and single points of failure. Additionally, digital and physical asset ownership is often managed through disconnected or semi-centralized systems, making verification of authenticity, access rights, and ownership history difficult and unreliable. There is a growing need for a decentralized, tamper-proof system that can securely manage user identities, control access permissions, and ensure transparent ownership of digital assets

Detailed Description

The system aims to introduce a blockchain-based framework that integrates decentralized identity management, access control, and NFT-based digital asset ownership. Each user is assigned a decentralized identifier, which serves as a secure and verifiable digital identity independent of centralized authorities and authenticated using cryptographic proofs. Digital assets are represented as Non-Fungible Tokens (NFTs),ensuring each asset is unique, traceable, and permanently recorded on the blockchain.These NFTs are directly allocated to user identities, establishing verifiable ownership that cannot be altered or duplicated.Smart contracts govern all operations within the platform, allowing only authorized administrators to mint NFTs and assign them to user identities, ensuring controlled asset creation and secure distribution. The system also implements Role-Based Access Control (RBAC), where administrators define roles such as Admin, Manager, Auditor,and User and assign specific access rights to each identity. These permissions are enforced automatically by smart contracts during all operations. Every activity, including identity creation, NFT creation, asset allocation, access rights assignment, ownership transfers, and permission updates, is immutably recorded on the blockchain, providing a transparent and tamper-proof audit trail for verifying ownership, authenticity, and access history.

Expected Solution

The expected solution is a decentralized blockchain-based platform that integrates secure digital identity management, NFT-based asset ownership, and access control into a unified and trustless system. It utilizes decentralized identifiers to provide users with self-sovereign, cryptographically verifiable identities that function independently of centralized authorities. Digital assets are issued as Non-Fungible Tokens (NFTs), ensuring uniqueness, traceability, and immutable ownership, with each NFT directly linked to a user’s decentralized identity to establish a permanent and verifiable connection between assets and their owners.The system should be governed by smart contracts that enforce strict rules for NFT creation, allocation, transfer, and validation. Only authorized administrators are allowed to create NFTs and assign them to identities, ensuring secure and controlled asset governance while preventing unauthorized duplication or reassignment. Additionally, the platform should implement Role-Based Access Control (RBAC), where administrators define roles and assign access permissions that determine user privileges within the system. All identity operations, NFT transactions, and access control updates are permanently recorded on the blockchain, ensuring complete transparency, auditability,and tamper-proof verification of ownership, permissions, and transaction history.

Background

The rapid advancement of quantum computing poses a serious threat to classical public-key cryptographic systems such as RSA and Elliptic Curve Cryptography (ECC), which can be broken by algorithms like Shor’s algorithm. This vulnerability endangers the security of critical digital infrastructures. Quantum Digital Signature (QDS) protocols offer information-theoretic security by exploiting fundamental principles of quantum mechanics. Among these, teleportation-based QDS protocols are particularly promising because they enable secure signature generation and verification through quantum teleportation and entanglement, while reducing some of the practical deployment complexities associated with earlier QDS schemes.

Description

This problem focuses on developing a quantum-inspired cyber threat detection framework specifically designed for Quantum Digital Signature (QDS) systems. The framework will detect threats to the integrity and authenticity of digital signatures—such as forgery, impersonation, replay attacks, and quantum channel manipulation—without relying on artificial intelligence or machine learning techniques. Instead, it will utilize quantum principles including Pauli eigenstates, projective measurements, and statistical analysis of measurement outcomes to evaluate forgery probabilities and verification accuracy, while preserving information-theoretic security guarantees.

Objectives

Design a quantum-inspired threat detection framework for teleportation-based Quantum Digital Signature protocols. Detect digital signature forgery, impersonation, replay attacks, and unauthorized verification attempts. Utilize Pauli eigenstates, quantum measurement analysis, and statistical threshold methods for threat identification. Ensure efficient verification algorithms that maintain information-theoretic security. Evaluate the framework through forgery probability analysis, attack simulations, and performance metrics.

Expected Solution

A software framework for Quantum-Inspired Cyber Threat Detection tailored to teleportation-based Quantum Digital Signature protocols. The solution will simulate quantum public key distribution using Bell-state entanglement and quantum teleportation, apply Pauli correction operations and projective measurements for signature verification, and detect malicious activities through statistical evaluation and threshold-based decision rules. The framework will include mathematical modelling, attack simulation capabilities, security analysis, and performance evaluation, ensuring deterministic acceptance of legitimate signatures, low computational complexity, and strong security guarantees.

Background

Critical-infrastructure operators observe their gateway and peering links using passive mirroring or hardware data diodes that copy traffic into a monitoring enclave in one direction only. The enclave can see everything crossing the link, but it has no physical or protocol-level path back into the production network. This is deliberate as it removes an entire class of attack in which a compromised monitoring or analytics system becomes a pivot into the core network, and it preserves a clean chain of custody for forensic use. The trade-off is that any intelligence layer sitting in that enclave must work purely from what it can passively observe such as packet captures, exported flow records (NetFlow/IPFIX/sFlow), and derived metadata with no ability to send probes, complete handshakes with the traffic source, or push a mitigation command back.

Description

The objective is to design and build an AI/ML pipeline that ingests a one-directional stream of IP traffic from a simulated IP data and detects, classifies, and scores cyber-security threats in near real time, using only passively collected data. The pipeline must assume it can never re-contact the traffic's source or destination, cannot rely on completing any handshake itself, and cannot issue any action back across the ingest path. Its output is intelligence as labelled alerts, confidence scores, and supporting evidence displayed on visualisation dashboard. The system is designed to detect the following types of threat:

Expected Solution

The system must be delivered as working prototype (source repository) implementing ingest, feature extraction, model inference, and alert output. Accompanying documentation of the model(s) used, features engineered, and the training/validation approach. The prototype must also include a simple dashboard of live or replayed detections with severity and confidence adhering to the following architectural constraints:

Background

Modern antivirus solutions restrict proprietary software from executing or creating custom scripts designed to analyze the system for deep forensic system analysis. They rely heavily on behavioral heuristics, static signature matching, common compiler outputs (like standard MSVC or GCC artifacts), typical API call sequences and kernel-level monitoring to intercept activities. However, a significant paradigm shift may occur when programmers adopt sophisticated software engineering practices—specifically continuous integration and continuous deployment (CI/CD).

Description

Creating 'Next-Gen' programming language framework, named as 'JOCKY' using cross-platform compiler (windows & ubuntu) which enables systematic creation of scripts for analyzing malicious activities and also provide the complete digital forensics of the computer or network. By utilizing this specific new developed programming language, the framework will not be hindered by any of the existing anti-virus in the environment. This framework should include various scripts/functions which combined with automated polymorphic engines, custom encryption, and multi-vector in-memory execution via native components or Bring your own vulnerable driver (BYOVD) techniques. Framework also able to handle multiple system analysis simultaneously using central management interface. The traffic b/w management interface and client should be routed through trusted cloud infrastructure or content delivery networks (CDNs) using domain fronting or legitimate cloud APIs.

Expected Solution

The scope of the problem is to create scripts/functions in the proprietary programming language (named JOCKY) which enables the user to detect the adversaries:

Background

With the rapid growth of digital storage technologies, organizations, government agencies, law enforcement units, enterprises, and individual users face two major challenges securely destroying sensitive data to prevent unauthorized recovery and recovering deleted digital evidence during forensic investigations. Existing solutions generally focus on either secure data deletion or file recovery and often support limited storage technologies and file systems. This forces investigators and cybersecurity professionals to use multiple tools, increasing complexity, cost, and operational inefficiencies. Therefore, there is a need for a unified platform that integrates secure data sanitization with advanced forensic-grade file recovery and carving capabilities.

Description

The proposed solution aims to develop an integrated software platform consisting of three core modules: (1) Secure Drive Eraser, (2) Secure File & (3) Folder Eraser, and Advanced File Carving and Recovery. The Secure Drive Eraser Module should securely sanitize HDDs, SSDs, USB drives, memory cards, and external storage devices while providing verification mechanisms, audit logging, tamper-resistant reporting, and compliance with industry and government data destruction standards. The Secure File and Folder Eraser Module should enable selective secure deletion of files and folders, remove associated metadata and residual traces, support batch operations, verify erasure success, and provide audit reporting across multiple file systems and operating systems. The Advanced File Carving and Recovery Module should recover deleted files from formatted, damaged, or corrupted media using signature-based, structure-based, and intelligent carving techniques. It should support recovery without file system metadata, fragmented file reconstruction, automatic classification of recovered files, confidence scoring, and comprehensive forensic reporting while preserving evidential integrity.

Expected Solution

The expected outcome is an integrated software platform that combines secure data sanitization and forensic recovery capabilities within a single environment. The solution should provide (1) secure drive erasure with verification and reporting, (2) secure file and folder deletion with metadata cleansing, (3) advanced file carving and recovery from formatted media, support for multiple storage devices and file systems, automated classification and validation of recovered files, comprehensive audit logs and forensic reports, a user-friendly graphical interface, and compliance with forensic and data sanitization standards.

Expected Deliverables include an integrated software tool, (1) Secure Drive Eraser Module, (2) Secure File and Folder Eraser Module, (3) Advanced File Carving and Recovery Module, Reporting and Audit Management System, User Interface Dashboard, validation and testing documentation, user manuals, technical documentation, and performance evaluation reports. The solution should improve secure data disposal practices, reduce the risk of unauthorized data recovery, enhance forensic investigation capabilities, increase recovery rates from damaged storage media, reduce investigation time, improve compliance and auditability, and provide a unified platform for secure sanitization and forensic recovery operations.

Background

Digital/Network Video Recorders (DVR/NVRs) are widely used for surveillance in government agencies, law enforcement, critical infrastructure, businesses, and residential environments. Major DVR/NVR manufacturers such as Dahua Technology, CP Plus, Honeywell Security, TP-Link, Godrej, Uniview, HIKVISON, and Matrix use proprietary storage formats, file systems, metadata structures, and video encoding mechanisms. During forensic investigations, surveillance footage serves as crucial digital evidence; however, the lack of standardization across DVR/NVR vendors makes acquisition, recovery, analysis, and validation difficult. Investigators often rely on multiple vendor-specific tools, resulting in increased investigation time, inconsistent results, timestamp synchronization issues, challenges in deleted footage recovery, and difficulties in maintaining evidence integrity. Therefore, a unified vendor-agnostic DVR/NVR forensic analysis platform is required to provide standardized workflows for evidence acquisition, recovery, analysis, validation, and reporting.

Description

The proposed solution aims to overcome challenges such as non-standard forensic acquisition methods, proprietary file systems and video formats, difficulty in recovering deleted or damaged recordings, inconsistent timestamps, limited event correlation across cameras, challenges in maintaining chain of custody, dependence on multiple tools, lack of standardized reporting, and limited use of intelligent video analytics. The tool should support major DVR/NVR OEMs including Dahua Technology, CP Plus, Honeywell Security, HIKVISON, TP-Link, Godrej, Uniview, Matrix, and other commonly used platforms. It should automatically identify DVR models, parse proprietary file systems, create forensic images, extract videos and metadata, decode proprietary formats, recover deleted footage, normalize timestamps, generate cryptographic hashes (MD5 and SHA-256), correlate events across cameras, maintain chain-of-custody records, generate reports, and perform AI-based analytics such as face, object, and motion detection. Key modules include Device Identification, Acquisition, File System & Format Parsing, Recovery, Timeline Analysis, Reporting, and Machine Learning.

Expected Solution

The expected outcome is a software-based forensic platform capable of performing standardized acquisition, recovery, analysis, validation, and reporting of surveillance evidence across multiple DVR/NVR vendors. The solution should support at least five to six major DVR/NVR OEMs (Dahua Technology, CP Plus, Honeywell Security, TP-Link, Godrej, Uniview, HIKVISON and Matrix), provide a unified forensic workflow, reduce dependency on vendor-specific tools, automate evidence acquisition and analysis, improve deleted video recovery, ensure evidence integrity and admissibility, and generate comprehensive forensic reports.

Deliverables include a comparative analysis of major DVR/NVR OEMs (Dahua Technology, CP Plus, Honeywell Security, TP-Link, Godrej, Uniview, and Matrix), DVR/NVR forensic Image, system architecture documentation, a functional prototype, Standard Operating Procedures (SOPs), validation reports, user manuals, and a final project report. The tool should successfully parse proprietary file systems, decode video formats, recover deleted recordings,verify evidence integrity through cryptographic hashing, generate standardized reports, reduce analysis time, and produce reliable and legally defensible forensic results.

Background

The dark web has become a preferred operating space for threat actors in the modern age, mainly because it lets them hide their identity behind Tor hidden services, which makes attribution of threat actors operating on darkweb the main challenge for any investigation. Such threat actors carry out a wide range of unlawful activities such as drugs and arms sale, stolen data and hacking services, money laundering, terror financing, etc. The objective of this problem statement is to build a system for the deanonymization of dark web threat actors and link them to suspect real-world entities.

Description

The system shall deanonymize dark web threat actors by continuously gathering their footprints from a range of sources (marketplaces, forums, deep web etc.) and linking them to the identifying information available on those sources. The system envisages three core capabilities. First, finding misconfigurations in Tor hidden services—such as exposed server-status pages, SSL certificates tied to clearnet domains, default service banners, descriptor inconsistencies, etc and matching them with clearnet infrastructure to point to the likely origin servers. Second, mapping threat actors across multiple marketplaces into a single relationship graph of handles, PGP keys, wallets and trust links. Third, using AI-based analysis, including stylometric persona identification and behavioural profiling, to link rebranded or migrated personas to known threat actors. The system shall provide an analytical front end to query the database across a chosen timeline and shall work in an autonomous mode, drawing on available sources of good quality and reliability.

Expected Solution

An end-to-end system shall be developed for the collection, storage, contextualization and querying (through GUI/dashboards) of dark web threat actor intelligence—covering actor profiles, identifiers (handles, PGP keys, wallets etc.), hidden service infrastructure indicators, persona linkages, attribution confidence, category, last scan date and source. The system shall also provide the facility to export the result set in CSV, JSON and report formats.

Background

This challenge seeks AI systems capable of learning network behaviour, anticipating attacker progression and supporting proactive cyber defence using the emerging concept of World Models. Design and develop a software prototype that learns the evolving state of a computer network from traffic telemetry and predicts the likelihood and progression of malicious activity before compromise is completed. The solution should ingest network traffic, learn temporal behaviour, forecast future attack states and provide interpretable decision support for defenders. Solutions should demonstrate applicability to enterprise environments and Critical Information Infrastructure. Represent network state using feature vectors or graphs. Learn state-transition dynamics using sequence models (LSTM, Transformer), Graph Neural Networks, latent state models or other AI techniques. Forecast future network states and estimate the probability of attacker progression. Map predicted behaviour to recognised attack stages (e.g. MITRE ATT&CK). Provide explain ability using attention mechanisms, feature attribution or equivalent techniques

Detailed Description

Participants are encouraged to build world models based AI systems that move beyond static intrusion classification towards predictive cyber defence. The solution may utilise flow records, packet captures, authentication logs or other publicly available cybersecurity telemetry. It should model temporal relationships, infer evolving network state, predict future attack progression and present meaningful explanations for its predictions. Traditional machine learning classifiers applied to network traffic treat each flow in isolation and map it to a binary benign/malicious label. This discards the temporal and causal structure of an infiltration: the sequence in which ports are probed, the pattern in which SYN flags precede ACK floods, the inter-arrival timing of reconnaissance packets before lateral movement begins. An infiltration is a process unfolding over time, not a single anomalous packet. World Models — AI architectures that learn an internal causal simulation of how environment states evolve — offer a fundamentally different approach. Rather than classifying traffic, a world model learns the transition dynamics P(S_t+1 | S_t): given the current observed network state (active flows, flag distributions, port activity, packet timing), what is the probability distribution over future states. This enables forward simulation roll out K steps ahead and identify whether the current trajectory converges to an infiltration state, before the attacker completes the kill chain.

Expected Solution

Expected Solution/Deliverables

For Evaluation Source Code Link (GitHub/Drive Link) Readme with Setup Instructions Architecture Document (Max 2 Pages) Demo Video (Max 2 Minutes) Technical Presentation (Max 5 Slides) .

Background

Modern enterprise networks are inherently heterogeneous, consisting of a vast array of hardware from diverse vendors. Organizations are mandated to align these devices with rigorous security frameworks, including CIS Benchmarks, NIST SP 800-53, DISA STIGs, and ISO/IEC 27001. The network environment includes, but is not limited to: Firewalls & SASE: Palo Alto, Fortinet, Cisco (Firepower/Secure/Meraki), Check Point, Juniper (SRX), Sophos, SonicWall, WatchGuard, Barracuda, Zscaler, Cloud-native firewalls (AWS, Azure, GCP), Sangfor, Hillstone, A10, Forcepoint, Stormshield, Netgate (pf/TNSR), Cato Networks, and others. Routers & Switches: Cisco (Catalyst/Nexus), HPE Aruba, Juniper (EX/MX/PTX), Arista, Extreme, NVIDIA (Mellanox), Allied Telesis, Huawei, D-Link, MikroTik, Ubiquiti, Alcatel-Lucent, Ruijie, Adtran, and others. Specialized Networking Open/Disaggregated (Dell, Nokia, 'White Box' hardware running SONiC, Cumulus), Hyperscale/AI (NVIDIA, Arista, Juniper), and Physical Infrastructure (Corning). Note The aforementioned list is illustrative; the application must be ideally designed to support any network device configuration, regardless of vendor or market segment.

Description

The Core HEADING Challenge In modern digital infrastructures, network devices act as the primary gatekeepers of data. However, they are also the most common point of misconfiguration, which accounts for a significant percentage of security breaches. Security frameworks like CIS, NIST, and STIGs offer specific 'hardening' protocols—such as disabling insecure protocols (Telnet/HTTP), enforcing strong cryptographic suites, configuring granular ACLs, and logging all administrative access. Currently, the industry relies on a bifurcated approach: either highly manual, checklist-based human auditing or expensive, vendor-locked enterprise management suites that lack flexibility for heterogeneous, multi-vendor environments. Operational Gap Administrators managing hybrid networks (composed of firewalls, switches, and routers from various vendors like Palo Alto, Cisco, Arista, etc.) lack a centralized 'Source of Truth' for compliance. The challenge is twofold

Expected Solution/Deliverables

For Evaluation Source Code Link (GitHub/Drive Link) Readme with Setup Instructions Architecture Document (Max 2 Pages) Demo Video (Max 2 Minutes) Technical Presentation (Max 5 Slides)

Background

Electronic mail remains one of the most critical communication services for governments, enterprises, financial institutions, and academic organizations. Despite the widespread adoption of Transport Layer Security (TLS), many SMTP, IMAP, and POP3 deployments continue to suffer from cryptographic misconfigurations such as obsolete TLS versions, weak cipher suites, insecure STARTTLS implementations, expired or improperly configured certificates, and non-compliance with modern security standards. These weaknesses expose email infrastructures to downgrade attacks, man-in-the-middle attacks, passive interception, and other cryptographic threats. Although existing network analysis tools provide extensive packet-level visibility, they primarily focus on protocol decoding and traffic inspection. They do not automatically evaluate the overall cryptographic security posture of email communications or provide intelligent risk assessment and prioritization for security analysts.

Description

Design and develop an AI-assisted passive network forensic framework capable of analyzing captured network traffic (PCAP files) containing SMTP, IMAP, and POP3 communications to automatically assess the cryptographic security posture of enterprise email infrastructures. The proposed solution shall reconstruct complete email communication sessions, identify encryption transitions, analyze TLS negotiations, validate digital certificates, detect cryptographic weaknesses, and leverage Artificial Intelligence/Machine Learning techniques to classify security risks, detect anomalous TLS behavior, and generate actionable security recommendations. The framework should assist Security Operations Centers (SOC), Digital Forensics teams, Incident Response teams, and enterprise administrators in rapidly identifying cryptographic vulnerabilities, prioritizing remediation efforts, and ensuring compliance with modern cryptographic best practices.

Objectives

- The proposed system should be capable of Passive analysis of encrypted SMTP, IMAP, and POP3 traffic from PCAP files. Automatic identification of application-layer email protocols. Detection of STARTTLS negotiation and encrypted session upgrades. Reconstruction of complete TCP communication streams. Parsing and reconstruction of TLS handshakes. Extraction and validation of X. 509 digital certificates. Identification of negotiated TLS versions, cipher suites, and key exchange mechanisms. Detection of deprecated protocols, weak cipher suites, insecure cryptographic algorithms, and certificate-related vulnerabilities. Extraction of cryptographic features for intelligent analysis. Application of AI/ML techniques for: Cryptographic risk classification. Detection of anomalous TLS behavior. Security posture scoring. Threat prioritization. Recommendation of mitigation measures. Generation of comprehensive forensic reports and security dashboards.

Expected Solution/Deliverables

The solution should provide the following outputs: Automatic identification of SMTP, IMAP, and POP3 protocols. STARTTLS negotiation detection and validation. Complete TCP stream reconstruction. TLS handshake reconstruction. Detection of negotiated TLS versions. Identification of negotiated cipher suites. Identification of key exchange mechanisms. Extraction of X. 509 certificates. Certificate chain validation. Certificate expiration analysis. Public key algorithm and key length analysis. Digital signature algorithm identification. Detection of weak cryptographic algorithms and deprecated TLS versions. Identification of insecure protocol configurations. Forward Secrecy assessment. AI-based cryptographic risk scoring. AI-assisted anomaly detection for suspicious TLS sessions. Prioritized security findings. Comprehensive cryptographic security posture assessment. Exportable forensic reports in JSON, PDF, and HTML formats. Interactive visualization dashboard for security monitoring and analysis.

Background

Virtual Private Networks (VPNs) are fundamental to secure communication over untrusted networks. Among the available VPN technologies, IPsec is widely adopted across enterprise, government, military, and cloud infrastructures because of its ability to provide confidentiality, integrity and authentication. However, the security of an IPsec deployment depends on multiple factors, including the chosen cryptographic algorithms, authentication mechanisms, key exchange protocols, and operational mode (Tunnel or Transport). Misconfigurations, outdated cipher suites, improper key management, or protocol implementation flaws can significantly weaken the overall security posture. Traditional protocol analysis tools provide packet-level visibility but often require expert interpretation. There is a growing need for intelligent systems capable of automatically analyzing IPsec deployments, identifying protocol characteristics, assessing security risks, and generating actionable recommendations.

Description

Design and develop an AI-driven protocol analysis platform capable of automatically analysing IPsec VPN deployments established under different security configurations. The platform should inspect captured traffic or live network streams, identify protocol characteristics, infer VPN operating modes, evaluate cryptographic configurations and generate an automated security assessment report. The solution should assist analysts in understanding the security posture of IPsec deployments without requiring manual packet inspection. Participants are expected to develop an intelligent framework capable of performing the following tasks.

Expected Solution/Deliverables:

Working software prototype AI classification engine Interactive dashboard Security assessment report Demonstration video Technical documentation Dataset used for training/testing

Background

Transitioning to Post Quantum Cryptography based solutions requires preparedness, risk assessment and financial and operational investment. Towards this, discovery and inventory of Cryptographic Artefacts is the critical first step, that will enable the transition.

Description

Expected Solution

Deliverables

A Comprehensive CBOM analytics tool that can scan Source code repositories, binaries, libraries and container images, for assessing risks (due to quantum computers), classifying artefacts and suggesting alternatives: Produce a report displaying all cryptographic assets including versions/ modes in standardised formats Interactive GUI platform to visualise the scan, risks and results

Background

The rapid adoption of Virtual Digital Assets (VDAs) and decentralized blockchain ecosystems has significantly increased the complexity of cybercrime investigations globally. Law Enforcement Agencies (LEAs) frequently encounter cryptocurrency wallet addresses linked to cyber frauds, ransomware, investment scams, darknet activities, and laundering of crime proceeds. Under the existing investigation workflow, LEAs raise lawful information disclosure requests through the SAHYOG Portal to Virtual Asset Service Providers (VASPs) such as crypto exchanges, custodial wallet providers, and trading platforms. However, in many cases, the suspect wallet identified during investigations belongs to an unhosted wallet or a wallet for which the associated VASP is unknown. This creates major delays in attribution, freezing of assets, and identification of the beneficial owner. Blockchain transactions generally pass through multiple intermediary wallets before reaching centralized exchanges. Identifying the 'nearest direct deposit accepting exchange' manually through blockchain analysis is time-consuming and requires specialized expertise.

Description

The proposed system envisages development of an Automated Blockchain Intelligence & VASP Attribution Engine integrated with the SAHYOG Portal through APIs. The system should Automatically analyze suspect cryptocurrency wallet addresses reported during investigations on the Sahyog Platform Automatically trace blockchain transaction paths to identify o nearest centralized exchange, o custodial wallet service, o or VASP receiving direct deposits from the suspect wallet. Map blockchain of deposit addresses and transaction flows across multiple blockchain networks such as: Bitcoin, Ethereum, Tron, BNB Chain, Solana, Polygon o and other major chains. Support identification of o exchange clusters, o hot wallets, o deposit wallets, o mixers/tumblers, DeFi bridges, o and cross-chain swap services. Integrate Sahyog with blockchain intelligence APIs and graph analytics engines. Provide automated tagging and confidence scoring for suspected VASPs. Generate investigation-ready reports for LEAs. Assist investigators in automatically routing lawful disclosure or freezing requests to the correct VASP through the SAHYOG Portal. The system may additionally support visualization of fund movement, cross-chain transaction mapping, risk scoring, identification of laundering typologies, and alerting for high-risk wallets linked to ransomware, darknet, terrorism financing, or fraud ecosystems.

Expected Solution

A software-based blockchain intelligence platform integrated with the SAHYOG ecosystem capable of: Automated identification of nearest VASP/exchange linked to unknown wallets. API-driven blockchain tracing and attribution support. Multi-chain transaction analysis and visualization. Real-time generation of investigative intelligence. Risk classification of wallets and transaction flows. Dashboard for LEAs with case-based analytics and reporting. Scalable architecture capable of handling large-volume blockchain transaction analysis. The solution should aim to reduce investigation time, improve asset freezing efficiency, enhance attribution capabilities, and strengthen cross-border cybercrime investigations involving VDAs

Background

Cyber fraud victims increasingly report suspect cryptocurrency wallet addresses used by fraudsters for collection of funds in cases involving: investment scams, task-based frauds, sextortion, ransomware, phishing, darknet transactions, and organized cyber-enabled financial crimes. During investigations, the reported wallet addresses are often: non-custodial wallets, temporary burner wallets, or intermediary wallets used for layering and laundering. The inability to quickly identify the cryptocurrency exchange or VASP associated with these wallets delays: freezing of assets, preservation of evidence, tracing of fund flows, and victim fund recovery. Manual blockchain tracing requires significant technical expertise and time, particularly in cases involving: multi-chain transfers, DeFi protocols, mixers/tumblers, bridges, and privacy-enhancing mechanisms.

Description

The proposed solution envisages a Real-Time Crypto Fraud Attribution System capable of automatically analyzing victim-reported wallet addresses and identifying the nearest exchange or VASP receiving direct deposits. The system should ingest wallet addresses reported through cybercrime complaint systems, automatically perform blockchain tracing, identify associated exchanges or VASPs, detect fund movement patterns, and generate actionable intelligence for investigators.

Key Features may include blockchain transaction graph analysis, clustering of exchange wallets, detection of intermediary laundering wallets, identification of cross-chain fund movement, integration with SAHYOG and NCRP platforms, automated alert generation, and risk categorization of wallets. The system should support multiple blockchain ecosystems and provide: real-time tracing capability, automated investigative recommendations, and analytics dashboards for law enforcement agencies Expected Solution A software platform capable of real-time blockchain intelligence generation, automated VASP identification, tracing of suspect wallets, cross-chain transaction analytics, fund-flow visualization, integration with LEA systems, and generation of standardized investigation reports. The system should reduce response time in cyber fraud investigations, improve freezing of proceeds of crime, enhance coordination with VASPs, and strengthen digital evidence collection capabilities. The platform should further support API integrations, scalable blockchain indexing, AI/ML-assisted risk detection, and automated pattern recognition for fraud typologies.

Background

The National Cybercrime Reporting Portal is the centralized Portal, which is serving the whole country. Currently, the Portal facilitates citizens in filing complaints, LEAs act on complaints, Banking/Financial Institutions for their actions along with reports/graphs being pulled on daily basis. Presently, the Portal is receiving approximately 8000 complaints on daily basis. The number of complaints has increased manifold during the past months, and this will continue to rise in future. To address the issue of increasing cybercrimes, the proactive approach shall be adopted.

Description

This framework focuses on the mitigation of cybercrimes by adopting a proactive approach. The framework's output will enable the prediction of likely cash withdrawal locations, which, in turn, will allow law enforcement agencies (LEAs) at the state and local levels, coordinated by I4C, to implement proactive interventions. These interventions could include deploying special teams or alerting local banks and ATMs in high-risk areas. The intelligence generated would also help banks and financial institutions (FIs) through the Citizen Financial Cyber Fraud Reporting and Management System, enabling faster fund blocking and increasing the chances of recovery. By supporting real-time actionable intelligence sharing across jurisdictions, law enforcement agencies and Banks/FIs will be able to respond faster and more effectively to cyber threats. This approach goes beyond merely reacting to complaints and creates a powerful, data-driven defense against financial cyber frauds, strengthening India's overall cybersecurity posture. Enhancing coordination between law enforcement and financial entities will ensure better detection and prevention of financial crimes, creating a more unified and efficient approach to combating cybercrime. Key Deliverables Component:- Description a. Predictive Analytics Engine :-AI/ML-based system to analyse historical cybercrime and financial data to predict potential withdrawal hotspots. Features include pattern detection, geospatial risk modelling, and real-time alerts. b. Risk Heatmap Dashboard:-GIS-enabled dashboard visualizing real-time and potential risk zones with drill-down filters by time, location, and crime category etc. c. Law Enforcement Interface:-Secure interface for investigators to access alerts, intelligence reports, and evidence documentation. d. Alert & Notification System:-Real-time notifications to law enforcements, banks, and I4C officers via SMS,email, API, or dashboard triggers.

Background

Modern criminal activities are increasingly organized and interconnected. Criminals often operate through networks involving associates, intermediaries, financial channels, communication links, locations, and events. Law enforcement agencies collect large volumes of data from sources such as:

Despite having access to this information, investigators frequently face challenges in identifying hidden relationships among suspects because the data is fragmented, unstructured, and distributed across multiple systems. Manual analysis can be slow, labor-intensive, and prone to missing critical connections. With advances in Artificial Intelligence (AI), Machine Learning (ML), Natural Language Processing (NLP), and Graph Analytics, it is now possible to automatically discover relationships, detect patterns, and generate insights that can assist investigators in understanding criminal networks more effectively.

Description

The objective is to develop an AI-powered system that can analyze large volumes of criminal and intelligence-related data to uncover hidden networks and relationships among individuals, organizations, locations, and events. The system should:

Expected Solution

Develop an AI-powered system that automatically analyzes structured and unstructured crime-related data to uncover criminal networks, identify key influencers, detect suspicious patterns, and provide actionable intelligence for investigators.