Team: Hartnell Phishing

Team Participants:
  • Edward Salla
  • Kafui Tourner
  • Reign Reyes
  • Samer Malaty
  • Theodore Sims

“California Community Colleges lost approximately $3 million in state funding and $10 million in federal funding because of financial aid fraud in 2024.”

Problem

IT security staff spend significant time each month manually reviewing the phishing reporting inbox, classifying threats, and creating multiple tailored outputs including executive summaries, newsletters, and targeted emails for different student and staff audiences. This includes scanning reported phishing and spam emails, categorizing threat types, and crafting distinct messaging for each audience segment. This time-intensive manual process limits staff capacity and prevents them from focusing on high-value activities like proactive security measures and response to active threats. With phishing and spam reports requiring monthly summarization and distribution across the institution, the existing workflow creates recurring bottlenecks that delay awareness of trending cyber threats and strain IT security staff availability. The heavy focus on routine report compilation and communication drafting consumes time that could be better spent on threat analysis and strengthening the institution’s overall security posture. 

Technical Solution

The Hartnell Phishing team developed a serverless phishing-analysis pipeline that converts labeled email reports into audience-specific security awareness materials and a browser-based dashboard. Building on AWS infrastructure provided by the Hartnell IT team—Amazon S3 (cloud storage) and AWS Lambda (serverless compute)—the summer camp team built a Python classifier that categorizes reported phishing messages into twenty higher-education-specific threat types using a rule-based engine, recognizing patterns like Canvas credential phishing, financial-aid scams, fake internships, and MFA reset lures. After classification, the Lambda calculates deterministic insights from category statistics—leading threat, second category, uncategorized percentage, and a recommendation to prioritize awareness for the top pattern—then renders four audience-specific HTML drafts and a CSV statistics file, writes immutable per-run artifacts to a drafts bucket on Amazon S3, and publishes a completion manifest so the dashboard loads the newest results automatically. The dashboard uses Chart.js to visualize category metrics directly in the browser, and the entire pipeline runs locally within the institution’s AWS account with no email content leaving for external analysis, giving Hartnell College IT staff a faster, auditable, and cost-effective way to identify monthly phishing trends, generate executive reports, and produce targeted security alerts for students, faculty, and staff—ultimately saving hours of manual effort each month and enabling proactive communication about the specific threats their campus community faces. 

Showcase

Presentation RecordingA recording of AI Summer Camp students presenting their project.
SlideshowThe accompanying slides shown in the video.
Source CodeAll of the code and assets developed during the course of the AI Summer Camp.

About the DxHub

The Cal Poly Digital Transformation Hub (DxHub) is a strategic relationship with Amazon Web Services (AWS) and is the world’s first cloud innovation center supported by AWS on a University campus. The primary goal of the DxHub is to provide students with real-world problem-solving experiences by immersing them in the application of proven innovation methods in combination with the latest technologies to solve important challenges in the public sector. The challenges being addressed cover a wide variety of topics including homelessness, evidence-based policing, digital literacy, virtual cybersecurity laboratories and many others. The DxHub leverages the deep subject matter expertise of government, education, and non-profit organizations to clearly understand the customers affected by public sector challenges and develop solutions that meet the customer needs.