Phishing Email Detection Model
Random Forest classifier trained on 164,000+ emails — 97.97% accuracy, 98.1% precision, production-deployable.
Overview
Phishing remains the #1 initial access vector in enterprise breaches. Rule-based filters (blacklists, keyword matching) fail against novel phishing campaigns that don't reuse known indicators. This project builds a machine learning classifier that learns the statistical patterns of phishing emails rather than relying on static rules.
Trained on 164,000+ labeled emails and evaluated against a held-out test set, the model achieves 97.97% accuracy with 98.1% precision — meaning fewer than 2% of legitimate emails are incorrectly flagged, which is the critical metric for production email filtering.
Dataset and Preprocessing
The dataset contains 164,000+ emails labeled as phishing or legitimate. Raw emails contain significant noise — HTML tags, encoding artifacts, quoted reply chains, and formatting inconsistencies. Preprocessing pipeline:
Pipeline:
1. Strip HTML tags (BeautifulSoup)
2. Decode MIME parts and attachments metadata
3. Extract structured fields: Subject, From, Reply-To, Return-Path
4. Normalize URLs: extract domain, count redirects, flag IP-based URLs
5. Tokenize body text → TF-IDF vectorization
6. Combine all features into single feature matrixFeature Engineering
Raw email text alone is a weak signal. The strongest features came from combining multiple signal types:
| Feature Group | Features | Phishing Signal |
|---|---|---|
| URL patterns | Domain age, IP-based URLs, redirect count, URL length, HTTPS usage | Phishing URLs tend to be long, newly registered, redirect-heavy, and IP-based |
| Sender analysis | From/Reply-To mismatch, domain reputation, SPF/DKIM alignment | Phishing spoofs display name while using unrelated sending domain |
| Text features | TF-IDF on subject + body, urgency keywords, impersonation terms | "Verify your account", "Suspended", "Immediate action" patterns |
| Header anomalies | Received chain length, X-Mailer presence, encoding mismatches | Phishing often uses bulk senders with abnormal header chains |
| Structural | HTML-only email, image-to-text ratio, attachment types | Phishing often hides text in images to evade keyword filters |
Model Selection and Results
Three classifiers were evaluated: Naive Bayes (baseline), Logistic Regression, and Random Forest. Random Forest was selected for its robustness to feature correlation, built-in feature importance ranking, and resistance to overfitting on high-dimensional TF-IDF features.
98.1% precision was the key optimization target — false positives (legitimate emails flagged as phishing) are more damaging in a production email filter than false negatives. A missed phishing email requires user awareness; a blocked legitimate email breaks business communication.