SUDO SPANDR: The Complete Technical Architecture & Master Forensic Treatise

SUDO SPANDR - Comprehensive Technical Architecture & Forensic Compendium

AICTE SIH 2026 Problem Statement #26106 Sovereign Defense Grade

SUDO SPANDR: Complete Technical Architecture & Master Compendium

Autonomous Email Forensics, Reverse-Engineering Autopsy, Dual-Sandbox Detonation & Enterprise Security Gateway (ESG) ka sampurna technical analysis.

1. Executive Summary & Problem Statement #26106 Analysis

1.1 2026 ka Strategic Email Threat Landscape

Current digital ecosystem mein electronic mail (RFC 5321/5322) pure enterprise, banking, defense logistics aur governance ka sabse critical backbone hai. Lekin iska original open architecture bina kisi built-in cryptographic validation ke banaya gaya tha, jiske chalte modern adversaries ke liye email sabse bada attack vector (MITRE ATT&CK T1566: Phishing) ban chuka hai. CERT-In aur national security advisories ke mutabiq, lagbhag 88% se 91% cyber intrusions email vector ke zariye hi initiate hote hain.

Modern attack campaigns traditional typographical spam se aage badhkar sophisticated techniques utilize kar rahi hain:

AI-Generated Contextual Lures: Hostile Large Language Models (LLMs) ke zariye aisi high-urgency language generate ki jaati hai jo human cognitive bias ko exploit karti hai.
MIME Confusion & Parser Differentials: Email boundaries ko manipulate kiya jata hai taaki security gateway payload ko detect na kare, jabki recipient ka Mail User Agent (MUA) use render kar le.
Fast-Flux DNS & Multi-Hop Relay Chains: Bulletproof hosting providers aur compromised intermediate MTAs ka use karke IP reputation filters ko bypass kiya jata hai.
Display-Name Masquerading: Dikhne wale sender display name ko trusted brands ke roop mein spoof kiya jata hai jabki actual transmitting mailbox attacker ke domain par hoti hai.
Unicode & IDN Homoglyphs: Latin characters ko visually identical Cyrillic ya Greek characters se badal kar undetectable phishing domains register kiye jaate hain.
AiTM (Adversary-in-the-Middle) Reverse Proxies: Evilginx jaise frameworks session tokens aur multi-factor authentication (MFA) ko real-time mein steal karte hain.

1.2 AICTE SIH 2026 Problem Statement #26106 ka Core Mandate

Ministry of Education, AICTE aur Cyber Security Division ne Problem Statement #26106 formulate kiya: "Autonomous High-Throughput Electronic Mail Forensic Dissector, Reverse-Engineering Suite, and Evidentiary Admissibility Engine". Is mandate ke char core pillars hain:

100% Offline Air-Gapped Operation: System ko bina kisi public internet ya cloud API dependencies ke run hona hoga, taaki sensitive national intelligence ya seized evidence leak na ho.
Bitstream-Level Post-Mortem Dissection: Email ko text document nahi balki executable compiled binary ki tarah treat karna hoga, jisme structural grammar parsing, true magic byte inspection aur Shannon entropy calculation shamil ho.
Cognitive Local AI Threat Reasoning: Offline on-premise neural engine jo psychological coercion, urgency scoring aur automated MITRE ATT&CK mapping bina external LLM API calls ke execute kare.
Statutory Indian Evidentiary Compliance: Evidence admissibility ke liye Bharatiya Sakshya Adhiniyam (BSA) 2023 ki Section 63 (purani Section 65B Indian Evidence Act ka replacement) ke tahat cryptographic digital certificates automatically generate karna.

Critical Flaw of Cloud-Dependent Utilities: Traditional utilities raw evidence ko public cloud APIs (jaise VirusTotal, public OpenAI/Anthropic endpoints) par bhejti hain. High-stakes forensic investigations mein kisi foreign commercial cloud par evidence upload karna ek direct security breach hai, jo legal chain of custody ko break kar deta hai aur evidence ko court mein inadmissible bana deta hai. SUDO SPANDR 100% on-premise deterministic execution se is risk ko permanently eliminate karta hai.

2. Reverse-Engineering Forensic Philosophy: Email as a Compiled Binary

2.1 Conceptual Paradigm (Ghidra & IDA Pro Analogue)

Legacy email analyzers email ko flat text file samajhte hain, jo ki ek fundamentally flawed approach hai. SUDO SPANDR email analysis ko binary reverse-engineering ke nazariye se dekhta hai, jo NSA ke Ghidra Framework aur Hex-Rays IDA Pro ke principles par based hai.

RFC 5322 bitstream ko Mail User Agent (MUA jaise Microsoft Outlook ya Thunderbird) theek usi tarah unpack karta hai jaise OS loader kisi PE32 ya ELF binary ko RAM mein load karta hai.

Binary Executable (PE32 / ELF)	Ghidra / IDA Pro Counterpart	Email Analogue (RFC 5322 / MIME)	SUDO SPANDR Component
DOS / PE Header & Entrypoint	File Header & Machine Architecture	Transport Envelope & Return-Path	Envelope Check & Header Dissector
Import Address Table (IAT)	External API Syscalls & Dependencies	MTA Relay Transit Chain (Received Hops)	Hop Transit DAG & Latency Analyzer
Code Signing Certificate	Authenticode Signature Verification	Cryptographic Auth (SPF, DKIM, DMARC)	Crypto Auth Engine & Alignment Matrix
Section Headers (.text, .data, .rsrc)	Section Virtual Memory Map	MIME Multi-Part Boundaries & Content-Types	MIME Hierarchy & Attachment Anatomizer
Packed Droppers & Shellcode	Entropy Analysis & Obfuscation Detect	High-Entropy Encoded Attachments	Shannon Entropy Carver & Magic Identifier
Decompiled C Pseudocode	Ghidra Decompiler Core	Cognitive NLP Intent & Local LLM Dossier	Local LLM Copilot & Threat Reasoner

2.2 Digital "Post-Mortem" Autopsy ke 5 Anatomical Steps

External Morphological Examination (Header Pathology): Declared From: address ko underlying SMTP Return-Path: se compare kiya jata hai. Multiline folding anomalies aur missing mandatory headers inspect hote hain.
Toxicological & Cryptographic Screening: Sending MTA IP ka DNS SPF record verification, DKIM RSA public key se body hash (bh=) integrity testing aur DMARC alignment check execute hoti hai.
Internal Anatomical Dissection (MIME Boundary Slicing): Raw byte stream ko individual MIME parts mein recursively slice kiya jata hai taaki polyglot files, hidden scripts aur corrupted boundary delimiters expose ho sakein.
Cellular Density & Shellcode Carving (Shannon Entropy): Carved payloads par information density score calculate hota hai. Highly packed droppers aur encrypted ransomware loaders elevated entropy ($H \ge 7.2$ bits/byte) dikhate hain.
Neurological & Psychological Profiling (Cognitive NLP): Body text ko local NLP engine ke dwara scan karke artificial urgency, financial coercion aur executive authority intimidation detect ki jaati hai.

2.3 Forensic Integrity ke 3 Inviolable Pillars

Pillar I: Absolute Bitstream Invariance (Read-Only Custody): Evidence file disk par read-only mode mein lock ho jaati hai. Sabhi parsing aur transformations RAM mein decoupled memory pointers par execute hote hain (0.00% byte drift).
Pillar II: Deterministic, Repeatable Computations: Given identical input bytes, chahe SHA-256 ho ya entropy calculation, system har platform aur hardware par bit-for-bit identical results output karta hai.
Pillar III: Court-Admissible Chain of Custody: Har analysis session machine telemetry, examiner details aur cryptographic digests ko combine karke statutory Section 63 BSA 2023 certificate compile karta hai.

3. Tripartite Ecosystem Architecture

SUDO SPANDR monolithic structure ke bajaye teen synchronized tiers mein divide kiya gaya hai jo har operational context ko cover karta hai:

Tier 1: Sovereign Core Forensic Workstation (TUI & Ghidra GUI)

Air-gapped labs aur field investigators ke liye. Isme do interfaces hain: Terminal TUI (`app.py`) jo Python rich library par based fast-action command deck hai, aur Ghidra Forensic Desktop (`gui_app.py`) jo PyQt6 C++ bindings par based dockable multi-window workspace hai jisme live Shannon speedometers aur synchronized hex views hain.

Tier 2: Enterprise Web Operations Platform & Dual-Sandbox Suite

SOC command centers ke liye FastAPI backend aur Vanilla JS frontend par structured web platform. Isme zero-overhead In-App Chromium Sandbox aur full Virtual Linux PC Sandbox (Xvfb/noVNC), Neo4j campaign graph engine, aur Proof-of-Authority (PoA) Consortium Blockchain ledger notarization integrated hai.

Tier 3: Enterprise Security Gateway (ESG) & Milter Interception Sinks

Active boundary defense daemon jo Postfix/Sendmail MTA ke sath directly interact karta hai. Yeh Port 10025 par transparent asynchronous SMTP proxy aur Port 8893 par binary Postfix Milter wire protocol socket provide karta hai, jo Content Disarm & Reconstruction (CDR) aur sub-millisecond threat rejection execute karta hai.

4. Volume I Deep Dive: Core Forensic Monograph & 12-Stage Dissection Pipeline

4.1 12-Stage End-to-End Forensic Autopsy Pipeline

Jab koi investigator evidence file feed karta hai, to system sequential 12 phases execute karta hai:

+---------+-------------------------------------------------------------------------------+
| STAGE 1 | EVIDENCE INGESTION & CRYPTOGRAPHIC BITSTREAM LOCKING (SHA-256, MD5, SHA-512) |
| STAGE 2 | RFC 5322 LEXICAL ANALYSIS, HEADER UNFOLDING & STATE MACHINE TOKENIZATION       |
| STAGE 3 | ENVELOPE IDENTITY & DISPLAY-NAME SPOOFING PATHOLOGY                           |
| STAGE 4 | CRYPTOGRAPHIC AUTHENTICATION MATRIX EVALUATION (SPF, DKIM, DMARC, ARC)        |
| STAGE 5 | RELAY TRANSIT TOPOLOGY RECONSTRUCTION & DELTA LATENCY MATHEMATICS             |
| STAGE 6 | HYPERLINK HARVESTING, IDN PUNYCODE DECODING & HOMOGLYPH MATRIX DISSECTION     |
| STAGE 7 | MIME MULTI-PART BODY CARVING & RECURSIVE ATTACHMENT EXTRACTION                |
| STAGE 8 | TRUE FILE MAGIC BYTE IDENTIFICATION & DOUBLE-EXTENSION DETECTION              |
| STAGE 9 | SHANNON ENTROPY BITSTREAM CARVING (PACKED SHELLCODE & DROPPER IDENTIFICATION) |
| STAGE 10| COGNITIVE NLP & CATBERT PSYCHOLOGICAL THREAT PROFILING                        |
| STAGE 11| LOCAL LLM NEURAL COPILOT REASONING & POLICE FIR COMPLAINT SYNTHESIS           |
| STAGE 12| RULE COMPILATION (YARA / SNORT) & SECTION 63 BSA 2023 CERTIFICATE EXPORT     |
+---------+-------------------------------------------------------------------------------+

4.2 Core Component Anatomy (`core/`)

core/parser.py: Raw EML/MSG bytes ingest karke immutable hashes compute karta hai, RFC 5322 Section 2.2.3 ke mutabiq multiline headers ko unfold karta hai aur nested MIME tree traverse karta hai.
core/forensics.py: Display-Name masquerading heuristics evaluate karta hai, cryptographic alignment calculate karta hai aur multi-hop relay headers ko bottom-up topological sort karta hai.
core/carver.py: Payload ko memory buffer mein safely extract karke starting 16 bytes inspect karta hai aur true magic byte match karta hai.
core/ai_engine.py: Offline Ollama daemon (LLaMA-3/Mistral) se communicate karta hai, ya GPU na hone par pure-Python deterministic CatBERT-Neural-CPU engine par failover karta hai.
core/rule_gen.py: Extracted IOCs ko operational YARA signatures aur Snort/Suricata rules mein compile karta hai.
core/bsa_cert.py & core/pdf_gen.py: Zero external dependency pure-Python PostScript pipeline jo court-admissible Section 63 BSA 2023 certificates generate karta hai.

5. Mathematical & Algorithmic Foundations

5.1 Shannon Information Entropy Theory in Payload Forensics

1948 mein Claude Shannon dwara formulate ki gayi information entropy data stream ke andar uncertainty ya randomness measure karti hai. Forensic reverse engineering mein yeh encrypted shellcode aur packed binaries detect karne ka ultimate mathematical standard hai.

Byte Frequency Probability:
P(x_i) = f(x_i) / N = [ Σ_{k=1}^{N} I(b_k = x_i) ] / N

Shannon Entropy Formula (bits/byte):
H(X) = - Σ_{i=0}^{255} P(x_i) log_2 P(x_i)

Theoretical Maximum (for 256 byte values):
H_max = log_2(256) = 8.0000 bits per byte

Entropy Range (H)	Physical Structural Characteristics	Typical File Typology	Forensic Status
0.00 ≤ H < 3.50	Extreme uniformity; zero byte repetition	Sparse binary arrays, raw memory dumps, ASCII logs	BENIGN / LOW RISK
3.50 ≤ H < 5.20	Structured natural language character distribution	Plaintext English emails, standard HTML/CSS code	BENIGN / LOW RISK
5.20 ≤ H < 6.80	Standard compiled machine instructions, ASCII strings	Uncompressed PE32/ELF executables, standard PDFs	NORMAL EXECUTABLE
6.80 ≤ H < 7.20	Moderate algorithmic compression or encoding	JPEG/PNG images, gzip streams, standard ZIP files	ELEVATED / INSPECT
7.20 ≤ H ≤ 8.00	Near-perfect pseudorandomness; minimal repetition	UPX/Themida packed binaries, ransomware droppers, shellcode	CRITICAL MALWARE ALERT

The Cryptographic Packing Paradox: Malware authors static signature scans bypass karne ke liye packers use karte hain. Lekin encryption ka fundamental law yeh hai ki yeh entropy ko theoretical maximum ($H > 7.6$) ke pass push kar deta hai. Agar koi file document (jaise .pdf ya .docx) hone ka claim kare aur uski entropy $7.2$ se upar ho, to SUDO SPANDR use instantly Packed Weaponized Dropper classify karta hai.

5.2 String Distance Metrics & Homoglyph Collision Math

Phishing mein lookalike domains detect karne ke liye dynamic programming Levenshtein aur Damerau-Levenshtein distance use hota hai:

D(i, j) = min [ D(i-1, j) + 1, D(i, j-1) + 1, D(i-1, j-1) + I(s_1[i] ≠ s_2[j]) ]

Damerau-Levenshtein transposition ($s_1[i] = s_2[j-1]$ and $s_1[i-1] = s_2[j]$) ko bhi account karta hai (e.g., amzon.com vs amazon.com).

Normalized Similarity Ratio:
S(s_1, s_2) = 1.0 - [ D(s_1, s_2) / max(|s_1|, |s_2|) ]

Agar protected bank list ke against similarity ratio $S(s_1, s_2) \ge 0.80$ match ho jaye lekin $s_1 \neq s_2$, to yeh confirmed Typo-Squatting / Phishing Impersonation Attack hai.

Unicode Homoglyph Collision: Cyrillic 'а' (U+0430) Latin 'a' (U+0061) se visual duplicate hota hai. Punycode (xn--) decode karke system mixed-script labels isolate karta hai aur characters ko canonical ASCII forms mein map karke collision evaluate karta hai.

5.3 Graph-Theoretic Reconstruction of Mail Relay Transit Topology

Email transmission Directed Acyclic Graph (DAG) $G = (V, E)$ hoti hai jahan har vertex $v$ ek MTA (IP, Hostname, Timestamp $T(v)$) hai aur edge $(v_i, v_{i+1})$ ek relay hop hai.

Hop Delta Latency:
Δt_i = T(v_{i+1}) - T(v_i)

Temporal Monotonicity: Sabhi hops mein $\Delta t_i \ge 0$ hona chahiye. Negative delta ($\Delta t_i < 0$) fake transit header injection ya desynchronized clock prove karta hai.
Routability Invariant: Origin hop $v_0$ private IP (RFC 1918) ho sakta hai, lekin ek baar public IP aane ke baad koi intermediate hop dobara private IP par nahi ja sakta jab tak final corporate gateway na aa jaye. Aisa hona internal relay injection ka sign hai.

6. Legal Admissibility & Bharatiya Sakshya Adhiniyam (BSA) 2023 Section 63

6.1 Statutory Transition: Repeal of Section 65B IEA

1 July 2024 se Indian Evidence Act, 1872 formally repeal ho chuka hai aur uska sthan Bharatiya Sakshya Adhiniyam, 2023 (Act No. 47 of 2023) ne le liya hai. Purani Section 65B ke badle ab electronic records ki legal admissibility Section 63 BSA 2023 ke dwara govern hoti hai.

Section 63 BSA 2023 ke Core Clauses

Section 63(1): Computer-generated electronic record paper print ya electronic media mein copy hone par document mana jata hai aur bina original device laye court mein directly admissible hota hai.
Section 63(2)(a): Computer us person ke lawful control mein tha jo regularly data store/process kar raha tha.
Section 63(2)(b): Ordinary course of activities mein data regularly feed kiya ja raha tha.
Section 63(2)(c): Computer properly operate kar raha tha, aur outage se record accuracy affect nahi hui.
Section 63(2)(d): Produced electronic record original data ka true reproduction hai.
Section 63(4): Responsible official dwara signed formal evidentiary certificate mandatory hai.

6.2 Cryptographic Chain-of-Custody Architecture

+----------------------------------------------------------------------------------------+
|                 SUDO SPANDR CRYPTOGRAPHIC BITSTREAM CUSTODY PIPELINE                   |
+----------------------------------------------------------------------------------------+
| SEIZED EVIDENCE FILE (.eml / .msg / .pst)                                              |
| └── Storage: POSIX Read-Only Lock                                                      |
|                                                                                        |
| CRYPTOGRAPHIC BITSTREAM IMMUTABILITY LAYER                                             |
| ├── SHA-256 Digest : 72c61465cf2ac170881b54a61fe8a0bca50c319cf9657cc40dcfb505...     |
| ├── MD5 Digest    : 24785ca8da5ee4f605a91438992c4228                                  |
| └── File Size     : 13,624 Bytes (Exact bitstream byte count)                          |
|                                                                                        |
| EXAMINER & SYSTEM ENVIRONMENT BINDING                                                  |
| ├── Workstation   : kali-forensic-lab-01                                               |
| ├── Kernel OS     : Linux 6.1.0-kali-amd64 #1 SMP PREEMPT_DYNAMIC                      |
| ├── MAC Address   : 08:00:27:C4:B9:71                                                  |
| └── Forensic Case : CS-CASE-20260907-72C614                                           |
|                                                                                        |
| LEGAL ATTESTATION COMPILATION (Section 63 BSA 2023)                                    |
| ├── Timestamp UTC : 2026-09-07 17:30:00 UTC                                            |
| ├── Declaration   : "All examinations conducted on bitstream duplicates..."            |
| └── Legal Status  : Admissible in Indian Criminal Courts & Cyber Tribunals             |
+----------------------------------------------------------------------------------------+

7. UI/UX Workstations & Local AI Architecture

7.1 Ghidra GUI vs Rich TUI

System do interfaces offer karta hai: Tactical TUI jo 8 interactive keyboard panels ([1] 4-Panel Deck, [2] Hop Map, [3] CatBERT AI, [4] Hex Carver, [5] BSA-63 PDF, [6] Batch Queue, [7] YARA Rules, [8] Summary Card) deta hai. Ghidra Desktop Workstation PyQt6 par built hai jisme Top KPI Deck, Pathology Findings cards, searchable header tables aur synchronized 16-byte Ghidra hex view speedometers ke sath integrate hain.

7.2 Dual-Tier Local Neural Copilot

Sovereign zero-data-leakage architecture ke liye do tiers implement kiye gaye hain:

Tier 1: High-Capacity Local LLMs (Ollama): LLaMA-3 (8B/70B), Mistral-7B, Qwen-2.5-Coder. GPU ya multi-core CPU par 4-bit/8-bit GGUF quantization ke sath background QThread mein run hote hain. Factual telemetry se tightly bounded prompts hallucination prevent karte hain.
Tier 2: Deterministic Embedded Engine (CatBERT-Neural-CPU): Field laptops jahan GPU ya daemon nahi chal sakta, wahan pure-Python CatBERT fallback karta hai jo urgency keywords, financial coercion aur authority intimidation scan karta hai. Rule-based hone ke karan iska output 100% deterministic aur repeatable hota hai.

7.3 Automated Indian Police FIR Complaint Synthesis

Local Copilot one-click ([Space] / [F]) par Indian Law Enforcement ke liye ready-to-file First Information Report (FIR) complaint draft karta hai:

Section 66D IT Act 2000: Cheating by personation using computer resource (display-name & domain spoofing).
Section 318(4) BNS 2023: Cheating and dishonestly inducing delivery of property (replaces IPC 420; fraudulent wire transfers).
Section 336(3) & 340(2) BNS 2023: Forgery of valuable security and electronic records (replaces IPC 468 & 471).
Section 63 BSA 2023: Mandatory evidence certificate chain of custody attachment.

8. Volume II Deep Dive: Web Operations Platform & Dual-Sandbox Detonation

8.1 Deterministic 100-Point Threat Scoring Matrix

S_total = min(100.00, Σ [ W_i · δ_i(Artifact) ] + S_entropy + S_lexical)

Signal Identifier	Category	Penalty Weight	Detection Trigger
`AUTH_DMARC_FAIL`	Authentication	+25.0	SPF aur DKIM dono identifier alignment fail karte hain
`AUTH_SPF_FAIL`	Authentication	+18.0	MTA IP SPF authorized list mein exist nahi karti
`SPOOF_DISPLAY_MISMATCH`	Impersonation	+22.0	Display name bank claim karta hai jabki domain untrusted hai
`HOMOGRAPH_IDN_PUNYCODE`	Obfuscation	+20.0	Unicode / Cyrillic confusable characters detect hue
`ATTACH_ENTROPY_PACKED`	Disassembly	+24.0	Attachment Shannon entropy H(X) ≥ 7.2
`ATTACH_MAGIC_MISMATCH`	Disassembly	+30.0	File extension true binary magic bytes se match nahi karti
`SANDBOX_AITM_PHISH`	Detonation	+35.0	Detonated URL credential harvesting form render karti hai

8.2 True Magic-Byte Signatures vs MIME Spoofing

4D 5A (MZ): Windows PE32 executable binary (Trigger: ATTACH_MAGIC_MISMATCH).
25 50 44 46 (%PDF): Authentic Adobe PDF document.
50 4B 03 04 (PK..): Standard ZIP container ya Office OpenXML archive.
7F 45 4C 46 (.ELF): Linux executable binary.

8.3 Dual-Sandbox Isolation Framework

Subsystem A: Lightweight In-App Chromium Emulated Sandbox

Hyperlinks ko sub-500ms mein safely detonate karta hai. X-Frame-Options: SAMEORIGIN aur CSP frame-ancestors blocks ko bypass karne ke liye custom edge reverse proxy (preview-frame.js) headers ko strip karke content ko iframe.srcdoc ke zariye secure container mein render karta hai. Isme Zero-Network In-App Google Search aur Honeypot Credential Vault shamil hai jahan fake login forms submit hone par credentials network par leak hone ke bajaye local memory vault mein capture ho jaate hain.

Subsystem B: Full Air-Gapped Virtual Linux PC Sandbox

Heavy binary aur macro execution ke liye virtual display :99 par headless X11 server (Xvfb $1280 \times 720$, 24-bit TrueColor) spin karta hai. x11vnc aur Python Websockify (port 7860) ke zariye raw RFB packets ko WebSocket frames mein convert kiya jata hai aur hardware-accelerated HTML5 noVNC canvas par render kiya jata hai. Filesystem ephemeral tmpfs RAM disk par chalta hai jisse single click par environment wipe hoke 1.5s mein fresh pristine state re-arm ho jaati hai.

9. Neo4j Threat Graph & Blockchain Evidentiary Integrity

9.1 Neo4j 5-Node Cyber Threat Ontology

Advanced persistent threat campaigns ki correlation tracking ke liye structured property graph:

(:OriginMTA): Originating server socket (IP, Country, City, ASN, rDNS).
(:EmailIdentity): Sender identity (Email address, Display name, Domain).
(:TargetMailbox): Victim entity (Recipient address, Corporate department).
(:ThreatCampaign): Campaign grouping (Campaign ID, Label, Threat score).
(:DigitalEvidence): Immutable artifact (SHA-256 digest, File size, Timestamp).

(origin:OriginMTA)-[:TRANSMITTED_BY]->(sender:EmailIdentity)
(sender:EmailIdentity)-[:TARGETED]->(target:TargetMailbox)
(sender:EmailIdentity)-[:ATTRIBUTED_TO]->(campaign:ThreatCampaign)
(evidence:DigitalEvidence)-[:SUBMITTED_AS_PROOF_OF]->(campaign:ThreatCampaign)
(sender:EmailIdentity)-[:EMBEDS_PAYLOAD]->(payload:PayloadURL)

9.2 Consortium Blockchain Notarization & Merkle Root

Proof-of-Authority (PoA) Consortium Notary Ledger par case evidence commit kiya jata hai:

Merkle_Root = SHA256( SHA256(Leaf_A + Leaf_B) + SHA256(Leaf_C + Leaf_D) )

Consortium validator nodes (LEAs, CERT-In) dwara transaction block height par seal ho jaata hai. Public verification endpoint (/api/v1/blockchain/verify/{tx_hash}) se real-time integrity verify ki ja sakti hai.

10. Volume III Deep Dive: Enterprise Security Gateway (ESG v4.0) & Wire Sinks

10.1 Dual Interception Sinks

Modality A: Transparent Inbound SMTP Proxy (Port 10025)

Enterprise DNS MX records ESG proxy ko point karte hain. Incoming connections par RFC 5321 session handle hota hai, DATA chunks buffer hote hain aur dot un-stuffing execute hoti hai. Inspection verdict ke hisab se:

CLEAN (Score < 40): Injects X-SudoSpandr-Verdict: CLEAN aur internal mailbox MTA (Port 2525) par relay karta hai.
SUSPICIOUS (40 ≤ Score < 75): Subject line rewrite karta hai ([SUSPICIOUS]) aur spam folder mein bhejta hai.
MALICIOUS (Score ≥ 75): Session terminate karta hai hard SMTP bounce ke sath: 550 5.7.1 Message rejected by SUDO SPANDR ESG: Threat score X/100 aur raw EML ko evidence vault mein seal karta hai.

Modality B: Postfix Milter Wire Protocol Socket (Port 8893)

Existing Postfix infrastructure ke sath loopback binary Milter Version 6 socket (RFC 2852) par operate karta hai. Frame-by-frame processing provide karta hai (SMFIC_CONNECT, SMFIC_HELO, SMFIC_MAIL, SMFIC_HEADER, SMFIC_BODY). Iska main advantage Zero-Copy Rejection hai: agar sender IP blacklisted hai to SMFIC_MAIL stage par hi connection drop ho jata hai bina large body download kiye.

10.2 Master Threat Inspector Code Execution Flow (`inspector.py`)

Master inspection loop 8 structured stages execute karta hai:

MIME Disassembly: email.policy.default se text/html bodies aur attachments safely separate hote hain.
Evidence Digest Generation: Raw byte array ka SHA-256 hash lock hota hai (e.g., Case ID SPANDR-ESG-AE65045ADD).
Hybrid Backend Delegation: Central SOC core ko async HTTP call karta hai; offline hone par auto-fallback.
Local Heuristic Evaluation: 25+ discrete rules evaluate hote hain.
Live DNS Cryptographic Authentication: SPF, DKIM aur DMARC non-blocking DNS queries execute hoti hain.
Composite Threat Score Calculation: composite_score = min(100, rule_score + auth_penalty).
Deep Forensic Autopsy Synthesis: Multi-hop delta timing aur cognitive linguistics compile hote hain.
Policy Action Resolution: Final verdict (CLEAN, SUSPICIOUS, MALICIOUS) resolve karke RFC headers inject hote hain.

11. Content Disarm & Reconstruction (CDR) & Cognitive Linguistics

11.1 Zero-Trust Content Disarm & Reconstruction (CDR) Engine

Incoming files inherently untrusted maani jaati hain aur unke components ko disinfect kiya jata hai:

.docm, .xlsm (VBA Macros): OpenXML structure unpack karke vbaProject.bin streams ko strip karta hai aur clean .docx/.xlsx mein re-encode karta hai (DISARMED_STRIPPED_MACROS).
.pdf.exe, .docx.scr (Double Extensions): Secondary executable extension detect karke binary ko encrypted quarantine enclave mein isolate karta hai (ISOLATED_PE_TRAP).
Polyglot Archives (.zip, .7z): Recursive unpack karke hidden executable blocks remove karta hai (REMOVED_ACTIVE_CONTENT).

11.2 Cognitive Linguistics & Composite Psychological Index (CPI)

Pure text-based BEC attacks ko detect karne ke liye 4-axis influence vectors score kiye jaate hain:

Fear & Coercion ($S_{\text{fear}}$): Account suspension, legal threats (25-30 pts).
Financial Urgency ($S_{\text{fin}}$): Wire transfers, routing numbers, urgent invoice (30-40 pts).
Executive Authority ($S_{\text{auth}}$): CEO/CFO titles, confidentiality cloaking (20-25 pts).
Channel Isolation ($S_{\text{iso}}$): "Do not call me, in a meeting" (30 pts).

raw_sum = S_fear + S_fin + S_auth + S_iso
composite_psychological_index = min(100, int(raw_sum · 0.55))

70% se upar ka CPI score high-confidence coercive BEC lure confirm karta hai.

11.3 Linux Kernel Socket Tuning (`/etc/sysctl.conf`)

# SUDO SPANDR ESG Production Performance Tuning
fs.file-max = 2097152
net.core.somaxconn = 65535
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15

12. Real-World Case Studies & Indian BFSI Regulatory Framework

12.1 Real-World Lab Case Studies

Case Study 1: $25.6M Executive Wire Fraud (LockBit / Russian Relay)

CEO display name spoof karke $25.6M offshore transfer ka email bheja gaya jisme Russian reply-to drop-box tha. ESG ne Hop #1 Origin IP 194.26.29.112 (Russian Bulletproof AS48282) detect kiya, CPI score 88% calculate kiya, aur message ko boundary par SMTP 550 reject karke Section 63 BSA certificate ke sath vault mein seal kar diya.

Case Study 2: Bank of Baroda Typosquatted Phishing via German Tor Exit Node

Fake domain b0b-bank-security.in se direct IP login link bheja gaya. Levenshtein distance ne b0b vs bob (Distance = 1) flag kiya, Hop #1 IP 185.220.101.5 ko German Tor exit node identify kiya, aur hard SPF fail par message block kar diya.

Case Study 3: Weaponized Double Extension Executable (`.pdf.exe`)

Overdue invoice ke bahane Signed_Invoice_Overdue.pdf.exe bheja gaya. CDR engine ne PE32 magic bytes (4D 5A) detect karke ISOLATED_PE_TRAP execute kiya aur payload quarantine kar diya.

12.2 National BFSI Directives & Regulatory Compliance

RBI Cyber Security Framework for Banks (Annex 1): Section 3.1 (SPF/DKIM/DMARC and Levenshtein lookalike protection), Section 4.2 (CDR macro stripping and double extension isolation), Section 6.3 (Prometheus metrics and SSE streaming), Section 9.1 (NIST FIPS SHA-256 evidence retention).
CERT-In Guidelines (Section 70B IT Act): NPL India synchronized NTP timestamps, immutable HMAC vaults, aur mandatory 6-hour incident reporting window ke liye 1-click CERT-In incident package export.
SEBI & IRDAI Directives: Non-malware wire fraud detection using Cognitive Linguistics NLP profiler.

13. Technical Specifications, Signatures & Legal Templates

13.1 Production YARA Signature Specification

rule SUDO_SPANDR_Weaponized_Lure_Detection {
    meta:
        description = "Identifies spear-phishing lure targeting banking institutions"
        author = "SUDO SPANDR Automated Threat Synthesis"
        reference = "AICTE SIH 2026 Problem Statement #26106"
        date = "2026-09-07"
        severity = "HIGH"
        mitre_tactic = "TA0001"
        mitre_technique = "T1566.002"
    strings:
        $header_spoof = "State Bank of India Online Security Operations" nocase
        $subject_lure = "Immediate KYC Update Required to Avoid Account Freezing" nocase
        $url_domain = "onlinesbi-security-update.net" nocase
        $url_path = "/sbi/verify-kyc.php" nocase
        $hex_pattern = { 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 }
    condition:
        (uint16(0) == 0x5A4D and pe.entropy(0, filesize) > 7.2) or
        (all of ($header_*) and any of ($url_*)) or
        hash.sha256(0, filesize) == "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
}

13.2 Formal Section 63 BSA 2023 Evidentiary Certificate Format

========================================================================================
CERTIFICATE OF ADMISSIBILITY OF ELECTRONIC EVIDENCE UNDER SECTION 63 OF 
THE BHARATIYA SAKSHYA ADHINIYAM (BSA), 2023
========================================================================================
Certificate Reference: BSA63-CERT-AE65045ADD
Case Reference ID:     SPANDR-ESG-AE65045ADD
Certified Timestamp:   2026-09-07T17:13:56.299550+00:00 (UTC)

I, the undersigned Authorized Digital Forensic Examiner / System Administrator, do hereby 
solemnly certify and declare pursuant to Section 63 of the Bharatiya Sakshya Adhiniyam, 2023:

1. IDENTIFICATION OF ELECTRONIC RECORD:
   The electronic record described herein consists of an intercepted RFC 5322 Electronic Mail
   Message, captured at the network transfer boundary before delivery to the recipient mailbox.
   • Sender Address:   ceo-desk@b0b-finance-update.in
   • Recipient Address: treasury@corporate-client.com
   • Message Subject:  URGENT: Confidential Wire Transfer Needed Immediately ($25.6M)
   • Inbound Peer IP:  194.26.29.112 (Bulletproof C2 Host AS48282 Russia)

2. DETAILS OF COMPUTER SYSTEM AND OPERATION:
   The electronic record was produced by the SUDO SPANDR Enterprise Email Security Gateway (ESG v4.0)
   operating lawfully within the enterprise network perimeter. The hardware and software systems
   were operating properly at all material times, and the integrity of the byte stream was 
   cryptographically sealed at the exact millisecond of network receipt.

3. CRYPTOGRAPHIC VERIFICATION & HASH INTEGRITY:
   Pursuant to NIST FIPS 180-4 and ISO/IEC 10118-3 standards, a cryptographic Secure Hash Algorithm
   (SHA-256) digest was calculated across the complete unedited byte stream:
   • Algorithm:        SHA-256 (256-bit cryptographic digest)
   • Recorded Hash:    ae65045addedb14fa6919c0f053642b0694839811dfd133b301ba80c2914c372
   • Recalculated Hash:ae65045addedb14fa6919c0f053642b0694839811dfd133b301ba80c2914c372
   • Integrity Status: SEALED_INTACT_TAMPER_FREE (Tamper Detected: FALSE)
   • Hardware Seal:    HMAC-SHA256-ae65045addedb14f

4. EXAMINER DECLARATION:
   I hereby state that to the best of my knowledge and belief, the particulars stated above are true,
   and this certificate is issued in compliance with Section 63 of the Bharatiya Sakshya Adhiniyam, 2023.

   Signature: _________________________________________
   Name:        Digital Forensics Examiner (Team SUDO SPANDR)
   Designation: Chief Cyber Incident Responder
   Station:     Enterprise Security Operations Center (Smart India Hackathon #26106)
========================================================================================

13.3 Key RESTful Endpoints & Postfix Milter Opcodes

Method / Opcode	Path / Byte	Functional Purpose
`POST`	`/api/v1/analyze-eml`	Raw RFC 5322 EML and MSG file upload and full autopsy dissection.
`POST`	`/api/v1/sandbox/detonate`	Edge proxy URL detonation and DOM tree extraction.
`GET`	`/api/v1/blockchain/verify/{tx_hash}`	Proof-of-Authority Merkle root verification on Consortium Ledger.
`GET`	`/metrics`	Prometheus text format metric exposition (scanned, clean, rejected).
`GET`	`/api/v1/live-feed`	Server-Sent Events (SSE) real-time push notification stream.
`SMFIC_CONNECT`	`0x43 ('C')`	Milter hook extracting remote IP; validates against Tor exit nodes.
`SMFIC_MAIL`	`0x4D ('M')`	Milter hook extracting sender domain; initiates async SPF/DKIM queries.
`SMFIC_BODYEOB`	`0x45 ('E')`	Milter hook signaling End-of-Body; triggers master autopsy engine verdict.

14. Conclusion & Strategic Impact

SUDO SPANDR AICTE Smart India Hackathon 2026 Problem Statement #26106 ke sabhi criteria ko complete rigor ke sath fulfill karta hai:

0.00% Hash Drift: Pure in-memory unbuffered processing ke sath raw evidence disk par untouchable rehta hai.
< 15ms Processing Latency: Enterprise scale par sub-millisecond asynchronous wire-speed mail filtering.
Mathematical Precision: Shannon entropy bitstream calculation, Levenshtein homoglyph distance matrices aur DAG relay graphs se har decision mathematically provable hai.
Court-Admissible Legal Adherence: Bharatiya Sakshya Adhiniyam (BSA) 2023 Section 63 compliant automated cryptographic certification.
Sovereign Digital Defense: 100% air-gapped, zero foreign cloud telemetry reliance ke sath Indian critical cyber infrastructure ke liye ek impenetrable shield.

neeshant