SamSec007 commited on
Commit
b7345dd
·
verified ·
1 Parent(s): bea2f62

Push model using huggingface_hub.

Browse files
Files changed (3) hide show
  1. README.md +27 -162
  2. config.json +6 -2
  3. model.safetensors +2 -2
README.md CHANGED
@@ -1,162 +1,27 @@
1
- ---
2
- language:
3
- - en
4
- license: mit
5
- library_name: phishbyte
6
- pipeline_tag: text-classification
7
- tags:
8
- - phishing-detection
9
- - email-security
10
- - cybersecurity
11
- - security
12
- - pytorch
13
- - from-scratch
14
- - no-pretrained-weights
15
- - cascading-inference
16
- - lightweight
17
- - explainable-ai
18
- - nlp
19
- - phishing
20
- - spam-detection
21
- - malware-detection
22
- - threat-detection
23
- - email-classification
24
- - text-classification
25
- - feature-engineering
26
- - interpretable-ml
27
- datasets:
28
- - ceas-2008
29
- metrics:
30
- - f1
31
- - precision
32
- - recall
33
- - accuracy
34
- model-index:
35
- - name: phishbyte
36
- results:
37
- - task:
38
- type: text-classification
39
- name: Phishing Email Detection
40
- dataset:
41
- name: CEAS-2008
42
- type: ceas-2008
43
- metrics:
44
- - type: f1
45
- value: 0.948
46
- name: F1 Score
47
- - type: accuracy
48
- value: 0.944
49
- name: Accuracy
50
- - type: precision
51
- value: 0.9537
52
- name: Precision
53
- - type: recall
54
- value: 0.9432
55
- name: Recall
56
- widget:
57
- - text: "From: PayPal Security <security@paypa1-alert.tk>\nReply-To: attacker@evil-domain.ru\nSubject: URGENT: Your account will be suspended\n\nDear Customer, your PayPal account has been suspended. Verify now at http://paypal-login.tk/verify"
58
- example_title: "Phishing email example"
59
- - text: "From: alice@company.com\nReply-To: alice@company.com\nSubject: Team lunch tomorrow\n\nHi everyone, lunch is at noon tomorrow in the usual spot. See you there!"
60
- example_title: "Legitimate email example"
61
- ---
62
-
63
- # Phish_Byte
64
-
65
- A from-scratch PyTorch model for **email phishing detection**.
66
- **F1 0.948** on CEAS-2008. **12,545 parameters** (≈9,000× smaller than DistilBERT).
67
- **1,500+ emails/sec** on a laptop GPU. Every verdict explains itself.
68
-
69
- > **v3 in progress:** expanding to 50K parameters + 6-dataset corpus training.
70
-
71
- ## Quick start
72
-
73
- ```python
74
- from phishbyte import PhishByteEngine
75
-
76
- engine = PhishByteEngine.from_pretrained("SamSec007/phishbyte")
77
- verdict = engine.analyze(raw_email_string)
78
-
79
- print(verdict.label) # 'phishing'
80
- print(verdict.probability) # 0.9735
81
- print(verdict.confidence) # 'high'
82
- print(verdict.layer_used) # 2
83
- print(verdict.feature_weights) # per-feature attribution
84
- ```
85
-
86
- ## Why this exists
87
-
88
- Every phishing detection model on HuggingFace is a fine-tuned transformer —
89
- DistilBERT, BERT, RoBERTa. 65–110M parameters. ~250 MB on disk. ~50 ms/email.
90
-
91
- Phish_Byte is different:
92
- - Custom MLP trained **from scratch** — no pretrained weights
93
- - **29 engineered features** across domain, URL, SPF, subject, and character-level signals
94
- - **Cascading inference** — cheap rules handle obvious cases, MLP handles the rest
95
- - **Full email header analysis** including live SPF validation
96
- - Runs on **CPU without a GPU**
97
- - Every verdict includes **which signals fired and why**
98
-
99
- ## Benchmarks (CEAS-2008, n=2,000 held-out)
100
-
101
- | Metric | Phish_Byte | DistilBERT fine-tuned |
102
- |--------|:----------:|:---------------------:|
103
- | F1 score | **0.948** | ~0.967 |
104
- | Parameters | **12,545** | 66,000,000 |
105
- | Model size | **52 KB** | ~250 MB |
106
- | Throughput (GPU) | **1,527/sec** | ~50/sec |
107
- | GPU required | **No** | Practically yes |
108
- | Header analysis | **Yes (SPF, DKIM)** | No |
109
- | Explainability | **29-feature attribution** | Token-level SHAP |
110
-
111
- ## Feature signals (29 inputs)
112
-
113
- | Category | Features |
114
- |----------|----------|
115
- | Domain (5) | mismatch, Reply-To diff, Return-Path diff, freemail flag, brand impersonation |
116
- | URL (5) | HTTPS ratio, anchor mismatch, suspicious TLD, urgency, link density |
117
- | SPF (3) | fail, no record, no sending IP |
118
- | Subject (7) | urgency, security theme, brand name, currency, all-caps, fake RE, fake transaction ID |
119
- | Character-level (5) | caps ratio, digit ratio, special density, word length, HTML ratio |
120
- | Composite (4) | per-layer normalized scores |
121
-
122
- ## Architecture
123
-
124
- ```
125
- raw email
126
- → Layer 1 (rule scorers, ~1ms) → confidence gate
127
- → Layer 2 (custom MLP, ~3ms) → PhishVerdict
128
- {label, probability, confidence, layer_used, feature_weights}
129
- ```
130
-
131
- ## Install
132
-
133
- ```bash
134
- pip install huggingface_hub safetensors dnspython
135
- ```
136
-
137
- ```python
138
- from phishbyte import PhishByteEngine
139
- engine = PhishByteEngine.from_pretrained("SamSec007/phishbyte")
140
- verdict = engine.analyze(raw_email_string)
141
- ```
142
-
143
- ## Limitations
144
-
145
- - ~5% error rate (F1 0.948). Use as one signal in defence-in-depth.
146
- - Trained on CEAS-2008 (English, 2008-era phishing). Modern attack patterns may reduce recall.
147
- - SPF validation skipped during training on historical data — re-enables at inference time.
148
-
149
- ## Citation
150
-
151
- ```bibtex
152
- @software{phishbyte2026,
153
- author = {Singh, Samratth},
154
- title = {Phish_Byte: Cascading from-scratch PyTorch phishing detection},
155
- year = {2026},
156
- url = {https://github.com/AnonymousSingh-007/Phish_Byte}
157
- }
158
- ```
159
-
160
- ## License
161
-
162
- MIT
 
1
+ ---
2
+ library_name: phishbyte
3
+ license: mit
4
+ pipeline_tag: text-classification
5
+ tags:
6
+ - cascading-inference
7
+ - cybersecurity
8
+ - email-security
9
+ - explainable-ai
10
+ - from-scratch
11
+ - lightweight
12
+ - model_hub_mixin
13
+ - nlp
14
+ - no-pretrained-weights
15
+ - phishing
16
+ - phishing-detection
17
+ - pytorch
18
+ - pytorch_model_hub_mixin
19
+ - spam-detection
20
+ - text-classification
21
+ - threat-detection
22
+ ---
23
+
24
+ This model has been pushed to the Hub using the [PytorchModelHubMixin](https://huggingface.co/docs/huggingface_hub/package_reference/mixins#huggingface_hub.PyTorchModelHubMixin) integration:
25
+ - Code: https://github.com/AnonymousSingh-007/Phish_Byte
26
+ - Paper: [More Information Needed]
27
+ - Docs: [More Information Needed]
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
config.json CHANGED
@@ -1,6 +1,10 @@
1
  {
2
  "dropout1": 0.3,
3
  "dropout2": 0.2,
4
- "hidden_dim": 128,
5
- "input_dim": 29
 
 
 
 
6
  }
 
1
  {
2
  "dropout1": 0.3,
3
  "dropout2": 0.2,
4
+ "dropout3": 0.1,
5
+ "hidden_1": 360,
6
+ "hidden_2": 180,
7
+ "hidden_3": 90,
8
+ "hidden_4": 48,
9
+ "input_dim": 85
10
  }
model.safetensors CHANGED
@@ -1,3 +1,3 @@
1
  version https://git-lfs.github.com/spec/v1
2
- oid sha256:81c474b9fe855039420d2a71cdb18305af57f4d49c5e6ae7d71ee3851ba17bf2
3
- size 52940
 
1
  version https://git-lfs.github.com/spec/v1
2
+ oid sha256:155f6d652a88522b92a237deb4217aa5d6ba7e7ce6af92aa1d3cb9355e56af5b
3
+ size 1032852