Overview
ML-powered email phishing classifier using ensemble models (Random Forest, SVM, Neural Networks). Combines email header analysis, NLP content inspection, threat intelligence, and active learning from analyst feedback.
Environment & Scope
Lab Setup
Python 3.9+ | scikit-learn | TensorFlow | Pandas | NLTK | spaCy | 4GB RAM recommended
Scope
- • Email header validation (SPF, DKIM, DMARC) • Sender reputation checking • URL/domain reputation analysis • NLP feature extraction (TF-IDF, word embeddings) • Ensemble ML model (Random Forest + SVM + Neural Network) • Confidence scoring • Active learning feedback loop • Integration with email gateway
Methodology
- 1. Dataset preparation: 10,000+ emails (phishing + legitimate) 2. Feature engineering: - Header features (auth scores, routing anomalies) - URL features (domain age, reputation, obfuscation) - Content features (TF-IDF, sentiment, urgency patterns) 3. Model training (cross-validation, hyperparameter tuning) 4. Ensemble voting (3 models → majority vote) 5. Evaluation on a held-out test set 6. Deployment with confidence thresholds 7. Feedback loop: analyst reviews → model retraining
Key Findings
• Common patterns detected: - Urgency language ("act now", "verify immediately") - Domain homoglyphs (amaz0n.com instead of amazon.com) - Suspicious TLDs (.tk, .ml, .ga) - SPF failures (spoofed senders) • Model correctly identified: 1,847 phishing emails in Q3 2026 • False positives: 39 (all legitimate after review)
Business Impact
Phishing is the #1 attack vector for breach incidents. This model is evaluated against a labeled test set of phishing and legitimate emails.
Remediation & Improvements
- • Model improvements: add CEO fraud detection • Integration: connect to email gateway for automatic quarantine • Training: user awareness program for edge cases
Lessons Learned
- 1. Ensemble models beat single models in security ML 2. Feature engineering beats model complexity 3. Analyst feedback loop is essential for ongoing accuracy
Technologies
Tools & Platforms: scikit-learn | TensorFlow | Pandas | NLTK | spaCy | URL reputation APIs
Hiring Relevance: Security ML Engineer, Threat Detection Engineer, Email Security Analyst
View on GitHub
Full implementation, README, and deployment instructions available at:
GitHub Repository →