CYRUN — Smart Cyber Defense Platform

AI-powered cyber threat detection, analysis, and explainability. Built for IndiaNext Hackathon 2026 — BuildStorm Track K.E.S. Shroff College, Mumbai · March 16–17, 2026

---

Project Structure

cyrun/
├── frontend/               # React + Vite + Tailwind CSS
│   ├── src/
│   │   ├── components/
│   │   │   ├── layout/     # Sidebar, TopBar
│   │   │   ├── pages/      # Hero, Scan, Dashboard, XAI, Modules, About
│   │   │   └── ui/         # Badge, Button, Panel, RiskMeter, SHAPChart, etc.
│   │   ├── hooks/          # useScrollReveal, useCountUp
│   │   ├── store/          # Zustand scan state
│   │   └── styles/         # globals.css (Tailwind + custom CSS vars)
│   ├── package.json
│   ├── vite.config.js
│   └── tailwind.config.js
│
├── backend/                # Python + FastAPI
│   ├── main.py             # App entry, CORS, lifespan
│   ├── routers/
│   │   ├── scan.py         # POST /api/scan
│   │   └── health.py       # GET /api/health
│   ├── services/
│   │   ├── detector.py     # All detection logic + heuristics
│   │   └── model_loader.py # ML model singletons
│   ├── schemas/
│   │   └── scan.py         # Pydantic request/response models
│   ├── ml_models/
│   │   ├── train_phishing.py
│   │   ├── train_url.py
│   │   ├── train_anomaly.py
│   │   ├── train_all.py    # Run all training in one command
│   │   └── saved/          # Trained .pkl files (generated)
│   ├── tests/
│   │   └── test_detectors.py
│   └── requirements.txt
│
└── docs/
    └── TODO.md             # Layered build plan

---

Quick Start

Frontend

cd frontend
npm install
npm run dev
# → http://localhost:5173

Backend

cd backend

# 1. Create virtual environment
python3 -m venv venv
source venv/bin/activate      # Windows: venv\Scripts\activate

# 2. Install dependencies
pip install -r requirements.txt

# 3. Train ML models
python ml_models/train_all.py

# 4. Start server
uvicorn main:app --reload --port 8000
# → http://localhost:8000
# → http://localhost:8000/docs  (Swagger UI)

Run Tests

cd backend
pytest tests/ -v

---

Detection Modules

Module	Algorithm	Target Threat
2A Phishing	TF-IDF + Logistic Regression	Email / message phishing
2B Malicious URL	Random Forest (20 URL features)	Typosquatting, homograph URLs
2C Prompt Injection	Pattern matching + semantic drift	LLM instruction override
2D Behavior Anomaly	Isolation Forest (UEBA features)	Suspicious login patterns

---

API Reference

POST /api/scan

Request:

{
  "input_text": "Your account has been suspended. Verify at paypa1.com",
  "threat_type": "auto"
}

Response:

{
  "risk_score": 87,
  "risk_band": "CRITICAL",
  "confidence": 94.7,
  "threat_type": "phishing",
  "modules": { ... },
  "shap_features": [ ... ],
  "token_highlights": [ ... ],
  "explanation": "...",
  "mitigations": [ ... ]
}

GET /api/health

Returns model load status and version.

---

Design System

• Theme: Dark-first, olive-green primary accent, red for critical threats
• Fonts: Syne (display), Space Mono (data/labels), DM Sans (body)
• Inspiration: Redline cybersecurity website — dark background, card grid, bold typography
• Layout: Fixed left sidebar, scrollable main content, sticky topbar