Cybersecurity and Artificial Intelligence Capstone Project
Privacy-Preserving Bot & Anomaly Detection for Static-Site Telemetry
A deployed prototype that detects suspicious traffic patterns from minimized static-site telemetry while avoiding unnecessary personal data collection.
Live Prototype Focus
- Cloudflare Pages static website
- JavaScript beacon for minimized telemetry
- Cloudflare Worker intake and risk logic
- Azure-hosted Flask ML prediction API
- Gradient Boosting and Isolation Forest models
- Cloudflare D1 event storage
- Streamlit dashboard reporting
Project Overview
This prototype demonstrates a privacy-aware detection pipeline for identifying human traffic, good bots, bad bots, scanner-like activity, and anomalous events.
Problem
Static websites often use lightweight JavaScript beacons for analytics. Because these endpoints are public, they may receive automated traffic, scrapers, scanners, malicious bots, and activity that can distort telemetry.
Solution
The system places a privacy-preserving detection layer between the website beacon and backend storage. Events are validated by the Worker, scored by two machine-learning models, assigned a risk assessment, stored in D1, and displayed in the dashboard.
Privacy Approach
The prototype uses a minimized 14-feature telemetry schema and avoids collecting raw IP addresses, passwords, cookies, authentication tokens, private content, exact location, names, emails, or invasive browser fingerprinting.
Team and Project Context
Live prototype implementation for the Cybersecurity and Artificial Intelligence capstone project.
Capstone Team
Mahin Chowdhury
Naveen Saranya Patro Behara
Olamide Akinyosola
Suma Madasu
Project Context
Institution: Humber Polytechnic, Ontario, Canada
Faculty: Faculty of Applied Sciences & Technology
Program: Cybersecurity and Artificial Intelligence
Project Sponsor: Salience Enterprises Inc.
Industry Supervisor: Abdullah Ali Syed
Course Instructor: Asama Nseaf
Project Phase: Live Prototype Implementation
Live Project Links
Public links used for the deployed prototype, dashboard access, and project handover.
Live Website
Worker Events API
Streamlit Dashboard
GitHub Repository
Privacy-Preserving Telemetry
Only approved categorical, behavioural, request, and coarse connection features are submitted for prediction.
Examples of Included Signals
- Page category
- Interaction type
- Scroll-depth category
- Request interval
- General user-agent category
- Favicon-request indicator
- robots.txt-request indicator
- Pages per session
- Error rate
- Coarse TLS and connection properties
Data Not Collected
- Raw IP addresses
- Names or emails
- Passwords
- Cookies
- Authentication tokens
- Private page content
- Exact location
- Persistent personal identifiers
- Invasive browser fingerprinting
Detection and Risk Assessment
The prototype combines supervised classification, unsupervised anomaly detection, and deterministic Worker risk logic.
Gradient Boosting
Classifies each telemetry event as human, good bot, bad bot, or scanner and returns prediction confidence and class probabilities.
Isolation Forest
Evaluates whether the event differs from expected benign behaviour and returns a normal or anomalous result with a decision score.
Worker Risk Logic
Combines the supervised prediction, confidence, and anomaly result to assign a final risk score, risk level, and advisory action such as allow, allow with monitoring, monitor, or flag for review.