OctoSight
End-to-end anti-phishing & fraud detection prototype for digital banking
Overview
OctoSight is an end-to-end anti-phishing and fraud detection prototype developed as a capstone project for the Faculty of Computer Science, Universitas Brawijaya. Built with CIMB Niaga digital banking as the case study context, the platform combines a rule-based engine (35%) with machine learning (65%) to deliver a hybrid risk analysis system. It provides a streamlined reporting portal for banking customers, a full admin triage workflow with analytics dashboards, role-based access control, SLA monitoring, and preventive education modules. The system processes phishing reports across multiple channels — SMS, WhatsApp, Email, Website, and Transaction — with automatic ticket generation, evidence OCR, and real-time notifications.
Problems
Rising phishing attacks targeting digital banking users
Digital banking users in Indonesia face increasing phishing and fraud attempts across SMS, WhatsApp, email, and fake websites. Existing reporting mechanisms are fragmented and lack automated triage, leaving users vulnerable and overwhelmed.
Manual triage and investigation bottlenecks
Security teams process phishing reports manually, leading to slow response times, inconsistent prioritization, and difficulty tracking case histories. No unified dashboard exists for monitoring incident trends or SLA compliance.
No hybrid detection combining rule heuristics with ML
Most available solutions rely either purely on rule-based detection (brittle against novel attacks) or pure ML (black-box, hard to explain). Combining both with transparent scoring was a key design challenge.
Complex RBAC requirements across 7 user roles
The system serves end users, customer service, investigators, analysts, moderators, admins, and viewers — each with distinct permissions. Enforcing 37+ granular permissions at both API and frontend layers required careful architecture.
Solutions
Hybrid detection engine with transparent scoring
Built a two-stage detection pipeline: 40+ rule-based heuristics (typosquatting, punycode, brand impersonation, URL shorteners, phishing keywords, scam scenarios) weighted at 35%, combined with a TF-IDF + Logistic Regression ML model (87% accuracy) weighted at 65%. The hybrid score (0–100) is fully explainable with per-rule and per-ML breakdowns.
Multi-channel reporting with automatic ticket generation
Designed a unified incident reporting form supporting 5 report types (SMS, WhatsApp, Email, Website, Transaction) with evidence screenshot upload. Each submission auto-generates a unique ticket ID, runs the detection pipeline, and assigns priority (High ≥75, Medium ≥35, Low <35).
Full admin triage pipeline with Kanban and analytics
Implemented a 7-column Kanban board with drag-and-drop transitions (Submitted → In Review → Confirmed/False Positive/Need More Info → Mitigated → Closed). Includes a paginated triage list with filters (status, priority, date range), CSV export, investigation workspace with OCR evidence viewer, ML feedback loop, and AI-generated notes via Gemini.
Multi-layer RBAC with 37+ granular permissions
Architected role-based access with 7 roles (admin, moderator, investigator, analyst, cs, viewer, user) and 37+ granular permissions. Enforced via require_permission() decorators on all API endpoints and a PermissionGate component + can() hook across 18+ frontend components. Admin role bypasses at DB query level.
Contributions
Architected and developed the entire frontend application using Next.js 15 App Router with 98+ component files across user, admin, auth, and education routes
Designed and implemented the hybrid detection pipeline integration — connecting rule engine, ML inference, OCR processing, and Gemini AI recommendations into a single coordinated workflow
Built the full admin dashboard with Chart.js widgets for incident trends, modus distribution, channel breakdown, risk segmentation, and SLA monitoring
Developed the Kanban board ticket management system with drag-and-drop, bulk operations, CSV export, and paginated triage list with real-time filtering
Implemented RBAC across both frontend (PermissionGate, can() hook) and backend (require_permission()) with 7 roles and 37+ granular permissions
Designed and built the education module with 8 microlearning modules, 10+ articles, quizzes across 4 difficulty levels, and personalized Gemini AI recommendations per report type and risk level
Built the gamification system with points, streaks, badges, and 14 achievement types to drive user engagement and security awareness
Integrated Google OAuth, forgot/reset password flow, real-time in-app notifications via polling, and Gmail SMTP email notifications for status changes
Features
Hybrid Risk Analysis
Real-time preview of phishing risk score combining rule heuristics (35%) and ML prediction (65%) with full explainability
Multi-Channel Reporting
Submit phishing/fraud reports across SMS, WhatsApp, Email, Website, and Transaction channels with evidence screenshots
Analytics Dashboard
Chart.js widgets tracking incident trends, dominant modus, channel distribution, risk segmentation, and SLA compliance metrics
Kanban Board
Drag-and-drop ticket workflow across 7 columns with bulk operations, inline assignment, and real-time status updates
Blacklist Management
CRUD operations for blacklisted URLs, bank accounts, phone numbers, and emails — 4 types with automatic duplicate checking
Education Modules
8 microlearning modules, 10+ articles, and quizzes across 4 difficulty levels with personalized Gemini AI recommendations
Tech Stack
- FastAPI
- Next.js
- Python
- TypeScript
- Docker
- MySQL
- scikit-learn
Gallery
1 / 10
Results
87% ML Accuracy
Logistic Regression + TF-IDF model trained on 2,000+ labeled samples achieved 87% accuracy with 0.87 precision and 0.84 recall
Sub-5 Second Processing
Full detection pipeline — report submission, rule analysis, ML inference, and scoring — completes in under 5 seconds
40+ Detection Rules
Comprehensive rule engine covering typosquatting, punycode, brand impersonation, URL shorteners, phishing keywords, and 4 scam scenarios
8 Docker Services
Production-ready infrastructure with Docker Compose orchestration: Caddy, Next.js, FastAPI, MySQL, Redis, Celery, and phpMyAdmin