Project Architecture & Viva Examination Guide

A comprehensive academic and technical reference designed for project evaluations, viva questions, and technical presentations.

🎯 Project Overview & Objectives

Phishing remains the number one vector for cyberattacks, responsible for over 80% of reported security incidents. Traditional security awareness relies heavily on users noticing subtle discrepancies in browser address barsβ€”a task that is increasingly difficult due to mobile screen truncation, Unicode homoglyphs, and rapid domain spoofing techniques.

The Fake Login Page Awareness Detector is a client-server security tool that inspects user-supplied website URLs and their corresponding webpage content for deceptive credential-harvesting indicators. Rather than providing an opaque binary verdict ("Safe" or "Unsafe"), our system computes a transparent, explainable risk score (0–100), visually tokenizes suspicious domain elements, and breaks down exact rule violations with remedial advice.

Step 1

Target Input

User supplies a login URL or chooses a built-in test case scenario.

Step 2

URL Heuristics

Tokenizer analyzes typosquatting, Levenshtein distance, IDN Punycode, and TLD abuse.

Step 3

DOM Inspection

Requests & BeautifulSoup inspect login forms, password inputs, and external form actions.

Step 4

Explainable Verdict

Risk score (0–100) is displayed on a dynamic gauge alongside security advice.

βš–οΈ Rule-Based Scoring Matrix

Every indicator is assigned an empirically derived weight based on attack severity:

Security Indicator / Heuristic Risk Weight Category Academic Justification
Brand Typosquatting / Lookalike (e.g. paypa1.com) +30 pts Domain Analysis Deliberate misspelling targeting cognitive blindspots via homoglyphs and Levenshtein edit distance.
Subdomain Brand Hijacking (e.g. paypal.com.attacker.com) +25 pts URL Structure Deceives victims by prefixing brand strings while apex domain resolves to attacker infrastructure.
External / Exfiltration Form Action +25 to +30 pts DOM Behavior Form accepts password inputs but posts data to an unauthorized third-party domain or webhook.
Direct IP Address as Hostname (e.g. http://192.168.1.1) +25 pts Domain Analysis Legitimate consumer authentication portals never instruct users to submit credentials to raw IP addresses.
Missing HTTPS Encryption (Plaintext HTTP) +20 pts Protocol Security Exposes transmitted credentials to local network packet sniffing (CWE-319).
Deceptive '@' Credential Delimiter +20 pts URL Structure RFC 3986 userinfo trick where browsers ignore the brand prefix prior to '@'.
High-Abuse TLD with Sensitive Keywords (e.g. .xyz, .top) +15 pts Domain Analysis Cheap disposable top-level domains paired with login/verify keywords correlate with active phishing kits.
Shannon Entropy > 3.3 in Domain String +15 pts Information Theory High mathematical randomness indicative of Domain Generation Algorithms (DGA).
Classification Thresholds: ● 0–29: Low Risk ● 30–59: Medium Risk ● 60–100: High Risk

πŸŽ“ Comprehensive Viva Examination Q&A

Q1. Why did you choose a rule-based detection engine over Machine Learning?
Answer: While Machine Learning (like Random Forests or Neural Networks) can identify statistical patterns, it acts as a "black box" that cannot intuitively explain why a URL was flagged. In contrast, our rule-based expert system provides deterministic explainability: it pinpoints the exact substring, protocol violation, or form action anomaly. For educational awareness and third-year coursework, explainable security is far more valuable because users learn how to spot deceptive patterns themselves.
Q2. What is Typosquatting, and how does your code detect it?
Answer: Typosquatting (URL hijacking) is the registration of common misspellings or visually similar permutations of well-known domains (e.g., paypa1.com instead of paypal.com). Our engine implements two complementary mechanisms:
1. Homoglyph normalization: Swapping visual lookalikes (e.g., '0' to 'o', '1' to 'l', 'rn' to 'm').
2. Levenshtein Edit Distance: A dynamic programming matrix calculation that determines the minimum number of single-character edits required to transform the domain into known brand targets. High similarity (β‰₯ 0.75) outside official brand domains triggers a high-severity warning.
Q3. Does an active HTTPS connection prove that a website is genuine?
Answer: No, absolutely not. HTTPS only guarantees that the connection between the client browser and the destination server is encrypted against on-path eavesdroppers (MitM). Threat actors routinely obtain free, valid SSL/TLS certificates (e.g., via Let's Encrypt or Cloudflare) for malicious lookalike domains. Therefore, while missing HTTPS is a severe red flag on a login page, the presence of HTTPS alone does not establish legitimacy.
Q4. How does the live page inspector examine login form actions?
Answer: Using Python's requests and BeautifulSoup, the inspector parses the HTML Document Object Model (DOM) to locate <form> tags containing <input type="password"> elements. It then evaluates the form's action attribute:
β€’ If the action submits credentials to a foreign domain different from the host (Cross-Domain Submission), it flags potential credential exfiltration.
β€’ If the action submits over plaintext HTTP on an HTTPS page, it flags mixed-content credential transmission.
β€’ If the action is empty or points to #, it flags in-memory JavaScript keylogging/asynchronous exfiltration.
Q5. What is an IDN Homograph / Punycode attack?
Answer: Internationalized Domain Names (IDNs) allow non-ASCII characters in domain names, which are encoded using Punycode with a xn-- prefix. Attackers exploit characters from different alphabets (such as Cyrillic 'Π°' U+0430) that appear visually identical to Latin 'a' (U+0061). To a user, apple.com looks genuine, but the browser resolves xn--pple-43d.com. Our tool inspects for the xn-- signature and flags it immediately.
Q6. How does Shannon Entropy identify suspicious domain names?
Answer: Shannon Entropy measures information density and unpredictability in bits. Normal human-readable English words have an entropy typically between 2.0 and 2.8. Attackers and botnets using Domain Generation Algorithms (DGA) create random alphanumeric strings (like x7q9kz1a0b.info) which exhibit entropy above 3.3. Our algorithm flags strings with elevated entropy as likely disposable or algorithmically generated hosts.
Q7. How do you handle potential false positives?
Answer: We maintain an authoritative whitelist of verified brand domains (e.g. accounts.google.com, login.microsoftonline.com, paypal.com). If a domain matches an authorized official entry, brand lookalike and typosquatting rules are bypassed. Additionally, our tool outputs a graduated risk score and warning indicators rather than an outright blockage, giving users context to make informed decisions.
Q8. What are future improvements for Version 2.0?
Answer: Planned enhancements include:
1. Domain Age & WHOIS API: Flagging newly registered domains (< 30 days old).
2. Visual Similarity Matching: Using OpenCV / Perceptual Hashing (pHash) to detect unauthorized brand logos on login pages.
3. Google Safe Browsing & VirusTotal API Integration: Cross-referencing global threat intelligence feeds.
4. Browser Extension Packaging: Porting the detector to a Chromium/Firefox extension for real-time passive protection.