Text Classification
Safetensors
PyTorch
English
phishbyte
phishing-detection
email-security
cybersecurity
security
from-scratch
no-pretrained-weights
cascading-inference
lightweight
explainable-ai
nlp
phishing
spam-detection
malware-detection
threat-detection
email-classification
feature-engineering
interpretable-ml
tfidf
residual-network
Eval Results (legacy)
Push model using huggingface_hub.
Browse files- README.md +27 -162
- config.json +6 -2
- model.safetensors +2 -2
README.md
CHANGED
|
@@ -1,162 +1,27 @@
|
|
| 1 |
-
---
|
| 2 |
-
|
| 3 |
-
|
| 4 |
-
|
| 5 |
-
|
| 6 |
-
|
| 7 |
-
|
| 8 |
-
|
| 9 |
-
|
| 10 |
-
|
| 11 |
-
|
| 12 |
-
|
| 13 |
-
|
| 14 |
-
|
| 15 |
-
|
| 16 |
-
|
| 17 |
-
|
| 18 |
-
|
| 19 |
-
|
| 20 |
-
|
| 21 |
-
|
| 22 |
-
|
| 23 |
-
|
| 24 |
-
|
| 25 |
-
|
| 26 |
-
|
| 27 |
-
|
| 28 |
-
- ceas-2008
|
| 29 |
-
metrics:
|
| 30 |
-
- f1
|
| 31 |
-
- precision
|
| 32 |
-
- recall
|
| 33 |
-
- accuracy
|
| 34 |
-
model-index:
|
| 35 |
-
- name: phishbyte
|
| 36 |
-
results:
|
| 37 |
-
- task:
|
| 38 |
-
type: text-classification
|
| 39 |
-
name: Phishing Email Detection
|
| 40 |
-
dataset:
|
| 41 |
-
name: CEAS-2008
|
| 42 |
-
type: ceas-2008
|
| 43 |
-
metrics:
|
| 44 |
-
- type: f1
|
| 45 |
-
value: 0.948
|
| 46 |
-
name: F1 Score
|
| 47 |
-
- type: accuracy
|
| 48 |
-
value: 0.944
|
| 49 |
-
name: Accuracy
|
| 50 |
-
- type: precision
|
| 51 |
-
value: 0.9537
|
| 52 |
-
name: Precision
|
| 53 |
-
- type: recall
|
| 54 |
-
value: 0.9432
|
| 55 |
-
name: Recall
|
| 56 |
-
widget:
|
| 57 |
-
- text: "From: PayPal Security <security@paypa1-alert.tk>\nReply-To: attacker@evil-domain.ru\nSubject: URGENT: Your account will be suspended\n\nDear Customer, your PayPal account has been suspended. Verify now at http://paypal-login.tk/verify"
|
| 58 |
-
example_title: "Phishing email example"
|
| 59 |
-
- text: "From: alice@company.com\nReply-To: alice@company.com\nSubject: Team lunch tomorrow\n\nHi everyone, lunch is at noon tomorrow in the usual spot. See you there!"
|
| 60 |
-
example_title: "Legitimate email example"
|
| 61 |
-
---
|
| 62 |
-
|
| 63 |
-
# Phish_Byte
|
| 64 |
-
|
| 65 |
-
A from-scratch PyTorch model for **email phishing detection**.
|
| 66 |
-
**F1 0.948** on CEAS-2008. **12,545 parameters** (≈9,000× smaller than DistilBERT).
|
| 67 |
-
**1,500+ emails/sec** on a laptop GPU. Every verdict explains itself.
|
| 68 |
-
|
| 69 |
-
> **v3 in progress:** expanding to 50K parameters + 6-dataset corpus training.
|
| 70 |
-
|
| 71 |
-
## Quick start
|
| 72 |
-
|
| 73 |
-
```python
|
| 74 |
-
from phishbyte import PhishByteEngine
|
| 75 |
-
|
| 76 |
-
engine = PhishByteEngine.from_pretrained("SamSec007/phishbyte")
|
| 77 |
-
verdict = engine.analyze(raw_email_string)
|
| 78 |
-
|
| 79 |
-
print(verdict.label) # 'phishing'
|
| 80 |
-
print(verdict.probability) # 0.9735
|
| 81 |
-
print(verdict.confidence) # 'high'
|
| 82 |
-
print(verdict.layer_used) # 2
|
| 83 |
-
print(verdict.feature_weights) # per-feature attribution
|
| 84 |
-
```
|
| 85 |
-
|
| 86 |
-
## Why this exists
|
| 87 |
-
|
| 88 |
-
Every phishing detection model on HuggingFace is a fine-tuned transformer —
|
| 89 |
-
DistilBERT, BERT, RoBERTa. 65–110M parameters. ~250 MB on disk. ~50 ms/email.
|
| 90 |
-
|
| 91 |
-
Phish_Byte is different:
|
| 92 |
-
- Custom MLP trained **from scratch** — no pretrained weights
|
| 93 |
-
- **29 engineered features** across domain, URL, SPF, subject, and character-level signals
|
| 94 |
-
- **Cascading inference** — cheap rules handle obvious cases, MLP handles the rest
|
| 95 |
-
- **Full email header analysis** including live SPF validation
|
| 96 |
-
- Runs on **CPU without a GPU**
|
| 97 |
-
- Every verdict includes **which signals fired and why**
|
| 98 |
-
|
| 99 |
-
## Benchmarks (CEAS-2008, n=2,000 held-out)
|
| 100 |
-
|
| 101 |
-
| Metric | Phish_Byte | DistilBERT fine-tuned |
|
| 102 |
-
|--------|:----------:|:---------------------:|
|
| 103 |
-
| F1 score | **0.948** | ~0.967 |
|
| 104 |
-
| Parameters | **12,545** | 66,000,000 |
|
| 105 |
-
| Model size | **52 KB** | ~250 MB |
|
| 106 |
-
| Throughput (GPU) | **1,527/sec** | ~50/sec |
|
| 107 |
-
| GPU required | **No** | Practically yes |
|
| 108 |
-
| Header analysis | **Yes (SPF, DKIM)** | No |
|
| 109 |
-
| Explainability | **29-feature attribution** | Token-level SHAP |
|
| 110 |
-
|
| 111 |
-
## Feature signals (29 inputs)
|
| 112 |
-
|
| 113 |
-
| Category | Features |
|
| 114 |
-
|----------|----------|
|
| 115 |
-
| Domain (5) | mismatch, Reply-To diff, Return-Path diff, freemail flag, brand impersonation |
|
| 116 |
-
| URL (5) | HTTPS ratio, anchor mismatch, suspicious TLD, urgency, link density |
|
| 117 |
-
| SPF (3) | fail, no record, no sending IP |
|
| 118 |
-
| Subject (7) | urgency, security theme, brand name, currency, all-caps, fake RE, fake transaction ID |
|
| 119 |
-
| Character-level (5) | caps ratio, digit ratio, special density, word length, HTML ratio |
|
| 120 |
-
| Composite (4) | per-layer normalized scores |
|
| 121 |
-
|
| 122 |
-
## Architecture
|
| 123 |
-
|
| 124 |
-
```
|
| 125 |
-
raw email
|
| 126 |
-
→ Layer 1 (rule scorers, ~1ms) → confidence gate
|
| 127 |
-
→ Layer 2 (custom MLP, ~3ms) → PhishVerdict
|
| 128 |
-
{label, probability, confidence, layer_used, feature_weights}
|
| 129 |
-
```
|
| 130 |
-
|
| 131 |
-
## Install
|
| 132 |
-
|
| 133 |
-
```bash
|
| 134 |
-
pip install huggingface_hub safetensors dnspython
|
| 135 |
-
```
|
| 136 |
-
|
| 137 |
-
```python
|
| 138 |
-
from phishbyte import PhishByteEngine
|
| 139 |
-
engine = PhishByteEngine.from_pretrained("SamSec007/phishbyte")
|
| 140 |
-
verdict = engine.analyze(raw_email_string)
|
| 141 |
-
```
|
| 142 |
-
|
| 143 |
-
## Limitations
|
| 144 |
-
|
| 145 |
-
- ~5% error rate (F1 0.948). Use as one signal in defence-in-depth.
|
| 146 |
-
- Trained on CEAS-2008 (English, 2008-era phishing). Modern attack patterns may reduce recall.
|
| 147 |
-
- SPF validation skipped during training on historical data — re-enables at inference time.
|
| 148 |
-
|
| 149 |
-
## Citation
|
| 150 |
-
|
| 151 |
-
```bibtex
|
| 152 |
-
@software{phishbyte2026,
|
| 153 |
-
author = {Singh, Samratth},
|
| 154 |
-
title = {Phish_Byte: Cascading from-scratch PyTorch phishing detection},
|
| 155 |
-
year = {2026},
|
| 156 |
-
url = {https://github.com/AnonymousSingh-007/Phish_Byte}
|
| 157 |
-
}
|
| 158 |
-
```
|
| 159 |
-
|
| 160 |
-
## License
|
| 161 |
-
|
| 162 |
-
MIT
|
|
|
|
| 1 |
+
---
|
| 2 |
+
library_name: phishbyte
|
| 3 |
+
license: mit
|
| 4 |
+
pipeline_tag: text-classification
|
| 5 |
+
tags:
|
| 6 |
+
- cascading-inference
|
| 7 |
+
- cybersecurity
|
| 8 |
+
- email-security
|
| 9 |
+
- explainable-ai
|
| 10 |
+
- from-scratch
|
| 11 |
+
- lightweight
|
| 12 |
+
- model_hub_mixin
|
| 13 |
+
- nlp
|
| 14 |
+
- no-pretrained-weights
|
| 15 |
+
- phishing
|
| 16 |
+
- phishing-detection
|
| 17 |
+
- pytorch
|
| 18 |
+
- pytorch_model_hub_mixin
|
| 19 |
+
- spam-detection
|
| 20 |
+
- text-classification
|
| 21 |
+
- threat-detection
|
| 22 |
+
---
|
| 23 |
+
|
| 24 |
+
This model has been pushed to the Hub using the [PytorchModelHubMixin](https://huggingface.co/docs/huggingface_hub/package_reference/mixins#huggingface_hub.PyTorchModelHubMixin) integration:
|
| 25 |
+
- Code: https://github.com/AnonymousSingh-007/Phish_Byte
|
| 26 |
+
- Paper: [More Information Needed]
|
| 27 |
+
- Docs: [More Information Needed]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
config.json
CHANGED
|
@@ -1,6 +1,10 @@
|
|
| 1 |
{
|
| 2 |
"dropout1": 0.3,
|
| 3 |
"dropout2": 0.2,
|
| 4 |
-
"
|
| 5 |
-
"
|
|
|
|
|
|
|
|
|
|
|
|
|
| 6 |
}
|
|
|
|
| 1 |
{
|
| 2 |
"dropout1": 0.3,
|
| 3 |
"dropout2": 0.2,
|
| 4 |
+
"dropout3": 0.1,
|
| 5 |
+
"hidden_1": 360,
|
| 6 |
+
"hidden_2": 180,
|
| 7 |
+
"hidden_3": 90,
|
| 8 |
+
"hidden_4": 48,
|
| 9 |
+
"input_dim": 85
|
| 10 |
}
|
model.safetensors
CHANGED
|
@@ -1,3 +1,3 @@
|
|
| 1 |
version https://git-lfs.github.com/spec/v1
|
| 2 |
-
oid sha256:
|
| 3 |
-
size
|
|
|
|
| 1 |
version https://git-lfs.github.com/spec/v1
|
| 2 |
+
oid sha256:155f6d652a88522b92a237deb4217aa5d6ba7e7ce6af92aa1d3cb9355e56af5b
|
| 3 |
+
size 1032852
|