ScamShield: Mobile-first cloud-powered threat intelligence network for detecting SMS phishing (smishing) campaigns in South Africa — ISJ107V Integrated Software Project
# ScamShield
**A Mobile-First Cloud-Powered Threat Intelligence Network for Detecting SMS
Phishing (Smishing) Campaigns in South Africa**
> ISJ107V Integrated Software Project — Tshwane University of Technology,
> Faculty of ICT, Computer Science Department
> Student: Philasande Makhubela (216432363)
South Africa has seen a sharp rise in SMS phishing that impersonates banks,
SARS, and courier services. ScamShield detects suspicious SMS messages and
embedded URLs in near real time, assigns an explainable 0–100 risk score with
at least three reason codes, and shares newly discovered scam indicators
across all users through a cloud threat-intelligence network.
## Architecture
**Full visual documentation with diagrams: docs/ARCHITECTURE.md**
(system overview, scoring sequence, intelligence propagation, database ER
diagram, and app structure — all rendered natively by GitHub.)
In one sentence: a Flutter app captures SMS, runs instant local checks, and
sends features to a FastAPI service that fuses rule-based and ML sub-scores
into an explained 0-100 risk score, enriched by a shared Supabase threat
database fed daily by URLhaus/OpenPhish and instantly by user reports.
## Repository structure → proposal deliverables
| Folder | Deliverable (proposal §) | Status |
|---|---|---|
| `ml/` | Hybrid detection engine — rules + ML (§3.2.2 core) | ✅ Done — F1 0.956 |
| `api/` | Cloud Threat Scoring API (§3.2.2) | ✅ Done — ~3 ms latency |
| `ingestion/` | Public Threat Intelligence Integration (§3.2.4) + Shared DB schema (§3.2.3) | ✅ Done — daily automated ingestion |
| `mobile-app/` | Flutter Mobile Application (§3.2.1, FR-01..FR-10) + In-App Analytics Dashboard (§3.2.5) | ✅ Source complete — build via `mobile-app/setup.sh` |
| `fintech-client/` | Mock Fintech API Client (§3.2.6) | 🔜 Planned |
## Key results so far
| Success criterion | Target | Achieved |
|---|---|---|
| Scam detection F1-score | ≥ 0.85 | **0.942** held-out; model selection §14.5: LogReg 0.941 > RF 0.923 …