Phising Detector: Phising Sentinel

VIEW_01
VIEW_02
VIEW_03

> CORE_MODULES (MAIN_FEATURE)

  • [+] URL Structure Analysis Engine: Utilizes a Random Forest algorithm trained heavily on URL structural features. The model was optimized using balanced class weights to heavily penalize false negatives, resulting in an 81.07% Recall rate to ensure threats do not slip through to the user's inbox.
  • [+] NLP Content Analysis Engine: Uses a Support Vector Machine (SVM) model to evaluate email and message text data for manipulative semantic patterns.
  • [+] Dual-Endpoint API Backend: A production-ready API built with Flask that receives JSON requests containing text or URLs, processes the feature extraction, and returns the classification status. Features a custom Sigmoid mathematical layer to convert binary SVM decision boundaries into user-friendly percentage confidence scores.

PROJECT_STATS

  • CATEGORY: AI/ML
  • ROLE: Machine Learning Engineer
  • TIMELINE: 3 Days
  • COMPLETION: 100%

MISSION_DOSSIER

> THE_OBJECTIVE

Build a Machine Learning model that can analyze email text and URL structure to detect if it is a phishing attack or not. This project is designed to be highly applicable for the banking and e-commerce industries to protect users from credential theft and social engineering.

> SYSTEM_LOGIC

  • Extracting raw URL strings into numerical structural features, such as URL length, the presence of an IP address, and the use of specific strange characters.
  • Utilizing TF-IDF (Term Frequency-Inverse Document Frequency) techniques to transform cleaned email text into numerical matrix representations.
  • Implementing a Two Dedicated Endpoints architecture (/predict/url and /predict/text) to route frontend traffic to the appropriate specialized classification model.

> MISSION_IMPACT

Successfully deployed a scalable, dual-endpoint classification framework capable of evaluating both malicious web routes and deceptive text content in real-time. By prioritizing threat detection sensitivity to achieve an 81.07% Recall rate, this system provides a robust automated defense mechanism against credential theft and social engineering, highly applicable for securing user environments in the banking and e-commerce industries.

LAUNCH_DEMO URLs_ML_SOURCE_CODE NLP_ML_SOURCE_CODE

> EQUIPMENT_LOADOUT (TECH_STACK)

PYTHON 3 MACHINE LEARNING PANDAS SCIKIT-LEARN FLASK NLTK/SPACY VERCEL PYTHONANYWHERE

> SYSTEM_ARCHITECTURE

This project is engineered using a Two Dedicated Endpoints architectural approach to ensure optimal classification accuracy and processing efficiency. The frontend interface acts as the initial checkpoint, autonomously capturing suspicious inputs and structuring them into targeted JSON requests.

Once the data is submitted, the API acts as a direct bridge to the underlying Machine Learning models by routing the traffic to its respective specialized endpoint. Requests sent to the /predict/url endpoint trigger the Random Forest model to analyze structural features, while data sent to the /predict/text endpoint utilizes the NLP Support Vector Machine (SVM) model to evaluate semantic patterns in email or message content.

The entire backend ecosystem is hosted continuously using the Flask framework. Upon receiving the routed data, the server evaluates the extracted features, computes the exact probability, and instantly returns a JSON payload containing the final threat status and confidence score back to the user interface.

> RACE_INCIDENTS & PIT_STOPS

INCIDENT (CHALLENGE) PIT STOP (SOLUTION) RESULT
High False Negative Rate: The initial Random Forest model missed over 50% of actual phishing threats due to highly imbalanced training data. Class Weight Rebalancing: Re-initialized the model with class_weight='balanced' to enforce a strict penalty on the minority class misclassifications. ACCURATE (Recall reached 81.07%)
Cloud Deployment Crashes: Scikit-Learn version conflicts and Cython compilation errors occurred when migrating from Colab to PythonAnywhere's WSGI environment. Dependency Pinning: Downgraded Numpy to \u003E 2.0 and explicitly forced pip3.10 installations in the cloud terminal to match the model's native training environment perfectly. STABLE
Binary Output Limitations: The SVM NLP model strictly outputted absolute 0 or 1 values, preventing the frontend from displaying dynamic danger percentages. Mathematical Probability Conversion: Engineered a custom Sigmoid function (1 / (1 + math.exp(-decision))) inside the API route to translate the SVM's raw distance metrics into 0-100% confidence scores. OPTIMIZED