08 / MACHINE LEARNING SECURITY
Phishing Email Detection Model
Scikit-learn classification model trained on email header and content features to detect phishing attempts with feature engineering, cross-validation, and performance evaluation.
Project overview
Machine learning approach to phishing detection using supervised classification. The model learns patterns in legitimate and phishing emails to predict unknown message intent and assist email security teams in filtering campaigns.
Dataset and features
Training data extracted from public phishing corpora and legitimate email datasets. Feature engineering focused on:
- Header Analysis: Sender domain reputation, SPF/DKIM/DMARC alignment, suspicious reply-to patterns.
- Content Features: Urgency keywords, misspellings, suspicious URL patterns, hidden form fields, attachment anomalies.
- Statistical Features: Character diversity, entropy, domain age, TLD reputation, link-to-text ratio.
- NLP Features: Sentiment polarity, grammar anomalies, targeted recipient detection.
Model development
Algorithm: Random Forest classifier with hyperparameter tuning via GridSearchCV.
Evaluation Metrics: Precision, recall, F1-score, ROC-AUC, and confusion matrix analysis with focus on minimizing false negatives (missed phishing).
Cross-Validation: 5-fold stratified cross-validation to ensure robust generalization across email distribution shifts.
Feature Importance: SHAP and permutation-based feature importance to explain model decisions and identify strongest phishing indicators.
Results and validation
- Achieved ~94% precision and ~91% recall on test set.
- Model generalizes well to unseen phishing campaigns and evolving sender tactics.
- Top predictive features: suspicious URL presence, sender domain mismatch, urgency language patterns.
- Explainability: Per-email prediction reasoning supports SOC analyst review and appeals.
Security considerations
- Model not used in isolation—designed to augment, not replace, human analysis and email gateway rules.
- Adversarial robustness: Feature engineering prioritizes signals resistant to common evasion (polymorphic content, obfuscation).
- Ongoing retraining required as phishing tactics evolve; monitoring for concept drift and performance decay.
- Privacy-first: Training data anonymized; no PII retained or exposed in model artifacts.
Deployment pathway
Model packaged as Python module for integration into email filtering pipelines or SOC alert enrichment systems. API endpoints allow real-time prediction on incoming messages.