Skip to content
MariusAdjevi
Menu
← All projects

CyberVeille PME

A defensive prototype for assessing suspicious URLs and supporting early response at small businesses.

View repository
CyberVeille URL analysis showing a high phishing risk result

The work behind CyberVeille PME

Problem

Help a small business assess a suspicious URL without visiting it.

My contribution

Built the URL-analysis service, Streamlit interface, local history, and optional alerts during a CMRPI internship.

Verification

Automated tests cover validation, missing model data, batch processing, persistence, and alert failures.

How the system works

  1. URL input
  2. Local URLhaus check
  3. Feature extraction and classifier
  4. SQLite history
  5. Optional SMTP alert

Context and goal

CyberVeille PME was developed during a CMRPI internship as a lightweight prototype for small businesses. It helps a user assess a suspicious URL without visiting it, keep a local incident history, and optionally notify a security contact.

Architecture

A Streamlit interface calls a central detection service. The service validates the input, checks a local URLhaus index, extracts structural URL features, and uses a locally prepared scikit-learn classifier when its artifacts are available. SQLite stores analyses and alert state. SMTP notifications and AbuseIPDB enrichment are optional.

Engineering decisions

  • The application never opens a submitted URL during analysis.
  • A URLhaus match is a strong signal; absence from the index is not treated as proof of safety.
  • Missing local data or model artifacts produce an unavailable state rather than a fabricated verdict.
  • Alerts use configurable thresholds and duplicate suppression, and SMTP failures do not block analysis.
  • The public repository omits downloaded datasets, generated models, operational histories, and internal internship documents.

Outcome and limits

The public repository contains the Streamlit MVP, automated tests, and generic response playbooks. The classifier uses URL characteristics rather than page content. Its documented evaluation used a single dataset, so this page does not claim effectiveness against future campaigns or in production.

See all projects