🔒 PhishGuard AI — Phishing URL Detection System

A machine-learning powered web application that classifies URLs as Benign or Phishing using only lexical and structural URL features — no DNS lookups, no page rendering, sub-5ms inference.

---

📋 Table of Contents

• Overview
• Live Demo
• Features
• Project Structure
• Dataset
• Feature Engineering
• Machine Learning Models
• Model Performance
• Dashboard Pages
• Installation
• Usage
• Reproducing Model Training
• Tech Stack
• Deployment Ideas
• License

---

🎯 Overview

PhishGuard AI detects phishing URLs by extracting 21 raw lexical/structural features from the URL string alone, then deriving 8 engineered features for a total of 29 features. Six scikit-learn classifiers are trained, evaluated, and compared inside an interactive Streamlit dashboard.

Why lexical-only?

• ✅ Works offline — no network calls at inference time
• ✅ Catches zero-day phishing before blocklists update
• ✅ Sub-5ms prediction latency — suitable for browser extensions and DNS proxies
• ✅ Privacy-preserving — URL is never fetched or rendered

---

🚀 Live Demo

Run locally:

streamlit run app.py

Then open http://localhost:8501 in your browser.

---

✨ Features

Feature	Description
🏠 Overview Dashboard	KPI cards, model comparison table, multi-dimensional radar chart
📊 Data Dashboard	Class distribution, feature correlation heatmap, feature summary stats
🔬 EDA & Insights	Interactive histograms, KDE plots, violin/box plots, scatter matrix, MI ranking
🤖 Live Prediction	Manual feature sliders + sample URL picker, real-time inference across all 6 models
📈 Model Comparison	ROC curves, Precision-Recall curves, confusion matrices, CV distributions
🔍 Feature Importance	Gini importance, Mutual Information scores, cumulative importance with threshold table
📋 Project Report	Full documentation: problem statement, dataset, preprocessing, engineering, results

---

📁 Project Structure

Phishing_URL_Detection/
│
├── app.py                  # Main Streamlit application (7 pages, ~1 500 lines)
├── train_models.py         # Model training & artifact generation script
├── requirements.txt        # Python dependencies
├── Dataset.csv             # Raw URL-Phish dataset (116 600 rows)
│
├── models/                 # Pre-trained model artefacts (auto-generated)
│   ├── logistic_regression.pkl
│   ├── decision_tree.pkl
│   ├── k_nearest_neighbours.pkl
│   ├── linear_svm.pkl
│   ├── gradient_boosting.pkl
│   ├── random_forest.pkl
│   ├── feature_cols.pkl
│   ├── metrics.json
│   ├── stats.json
│   ├── feature_importance.json
│   ├── mi_scores.json
│   ├── feature_stats.json
│   ├── corr_matrix.json
│   └── sample_test.csv
│
├── data/                   # (Optional) processed data directory
└── .streamlit/             # Streamlit configuration

---

📂 Dataset

Property	Value
Source	URL-Phish (synthetic, real-world feature distributions)
Total Records	116,600
Benign URLs	100,000 (85.8%)
Phishing URLs	16,600 (14.2%)
Class Ratio	~6:1 (benign : phishing)
Train / Test Split	80% / 20% stratified
Raw Features	21
Engineered Features	8
Total Features	29

The dataset uses lexical features only — all features can be computed directly from the URL string without making any network requests.

Raw features include: url_len, dom_len, tld_len, subdom_cnt, letter_cnt, digit_cnt, special_cnt, eq_cnt, qm_cnt, amp_cnt, dot_cnt, dash_cnt, under_cnt, letter_ratio, digit_ratio, spec_ratio, is_https, slash_cnt, entropy, path_len, query_len

---

🔧 Feature Engineering

Eight derived features are computed on top of the raw features:

Engineered Feature	Formula	Rationale
complexity_index	entropy × spec_ratio	Combined entropy + special-char signal
dom_digit_density	digit_cnt / (dom_len + 1)	Digit-heavy domains = auto-generated phishing
path_url_ratio	path_len / (url_len + 1)	Long path in short URL → suspicious redirect
query_url_ratio	query_len / (url_len + 1)	Heavy query strings → redirect obfuscation
has_query	int(query_len > 0)	Binary flag for query string presence
slash_density	slash_cnt / (url_len + 1)	Normalised slash count
dot_density	dot_cnt / (url_len + 1)	Deeply nested sub-domains
obfuscation_score	eq + qm + amp + under counts	Aggregate obfuscation character count

3 of these engineered features rank in the top 10 by Gini importance, validating the feature engineering step.

---

🤖 Machine Learning Models

All models are wrapped in scikit-learn Pipelines that include:

1. SimpleImputer (median strategy) — prevents data leakage
2. StandardScaler — zero-mean, unit-variance normalisation

Model	Key Hyperparameters
Logistic Regression	C=1.0, class_weight=balanced, max_iter=1000
Decision Tree	max_depth=12, class_weight=balanced, min_samples_leaf=5
K-Nearest Neighbours	n_neighbors=7, n_jobs=-1
Linear SVM	CalibratedClassifierCV(LinearSVC), C=0.5, class_weight=balanced
Gradient Boosting	n_estimators=150, max_depth=5, learning_rate=0.1, subsample=0.8
Random Forest	n_estimators=200, class_weight=balanced, max_features=sqrt

Cross-validation: 5-Fold Stratified CV is run on a 20 000-sample subset for speed.

---

📊 Model Performance

Results are computed on the held-out 20% test set (stratified split).

Model	Accuracy	Precision	Recall	F1 Score	ROC-AUC
🌲 Random Forest 🏆	~0.9850	~0.97	~0.94	~0.955	~0.998
🚀 Gradient Boosting	~0.9830	~0.96	~0.93	~0.945	~0.997
⚡ Linear SVM	~0.9720	~0.94	~0.90	~0.920	~0.990
📈 Logistic Regression	~0.9700	~0.93	~0.89	~0.910	~0.988
🌳 Decision Tree	~0.9650	~0.92	~0.88	~0.900	~0.960
🔍 K-Nearest Neighbours	~0.9600	~0.90	~0.87	~0.885	~0.975

🏆 Random Forest is the best model with the highest F1 and ROC-AUC scores.
All 6 models achieve AUC > 0.96, confirming that URL structural features are highly discriminative.

---

🖥️ Dashboard Pages

🏠 Overview

• Top-level KPI metrics (total URLs, best accuracy, F1, ROC-AUC, features, models)
• Sortable model comparison table (HTML styled)
• Multi-Dimensional Model Radar — spider chart comparing all 6 models across 5 metrics

📊 Data Dashboard

• Class distribution donut chart
• Feature mean comparison (Benign vs Phishing) bar chart
• Interactive correlation heatmap (top 16 features)
• Feature summary statistics table

🔬 EDA & Insights (5 tabs)

• Distributions — histogram + KDE overlay per feature, with class stats
• Violin & Box — violin plots and box plots with SD markers
• Scatter Matrix — 2D scatter with selectable X/Y features
• Class KDE — multi-feature KDE grid (up to 6 features)
• MI Ranking — Mutual Information scores bar chart, top 20

🤖 Model Prediction

• Manual Feature Input — 21 sliders + auto-computed engineered features
• Sample URL — pick from 200 real test samples (benign or phishing)
• Primary model result card + phishing risk gauge + risk progress bar
• All-models prediction cards with per-model probability
• Consensus verdict (X/6 models agree)

📈 Model Comparison (5 tabs)

• Gauge row for best model (Accuracy, Precision, Recall, F1, AUC)
• Metrics bar chart (multi-select metrics)
• ROC curves (all 6 models)
• Precision-Recall curves (all 6 models)
• Confusion matrix (model-selectable) with TP/TN/FP/FN breakdown
• 5-Fold CV F1 distribution box plots

🔍 Feature Importance (3 tabs)

• Random Forest Gini importance (horizontal bar + donut pie for top 10)
• Mutual Information scores (all features)
• Cumulative importance with 80%/90%/95% threshold lines and summary table

📋 Project Report

Full written documentation covering problem statement, dataset overview, preprocessing pipeline, feature engineering rationale, model results, key findings, and deployment recommendations.

---

⚙️ Installation

Prerequisites

• Python 3.9 or higher
• pip

Steps

# 1. Clone the repository
git clone https://github.com/SamarthGarge/Phishing_URL_Detection.git
cd Phishing_URL_Detection

# 2. (Recommended) Create a virtual environment
python -m venv venv
venv\Scripts\activate        # Windows
# source venv/bin/activate   # macOS / Linux

# 3. Install dependencies
pip install -r requirements.txt

Dependencies

streamlit>=1.32.0
pandas>=2.0.0
numpy>=1.24.0
scikit-learn>=1.3.0
plotly>=5.18.0
joblib>=1.3.0
scipy>=1.11.0

---

🚀 Usage

Run the Streamlit App

streamlit run app.py

The app opens at http://localhost:8501.

Note: The models/ directory with pre-trained .pkl files must be present.
If it is missing, run the training script first (see below).

Navigate the App

Use the sidebar navigation to switch between the 7 pages:

Sidebar Item	Page
🏠 Overview	Model summary, radar chart
📊 Data Dashboard	Dataset visualisations
🔬 EDA & Insights	Exploratory analysis
🤖 Model Prediction	Live URL prediction
📈 Model Comparison	Evaluation metrics
🔍 Feature Importance	Gini & MI analysis
📋 Project Report	Full documentation

---

🏋️ Reproducing Model Training

To retrain all models from scratch:

# Make sure Dataset.csv is in the project root, then:
python train_models.py

This script will:

1. Load Dataset.csv (or generate synthetic data if not found)
2. Apply IQR outlier capping on 7 continuous features
3. Engineer 8 derived features
4. Perform stratified 80/20 train/test split
5. Train all 6 models with sklearn Pipelines
6. Compute Mutual Information scores and 5-Fold CV F1
7. Save all .pkl files and JSON artefacts to models/

Expected output:

📂 Loading dataset …
📐 Computing Mutual Information …
🤖 Training models …
Model                     Acc    Prec     Rec      F1     AUC      CV F1
────────────────────────────────────────────────────────────────────────
Logistic Regression     0.9700  0.9300  0.8900  0.9100  0.9880  0.9050±0.003
...
🏆 Best Model by F1: Random Forest  (F1=0.9550  AUC=0.9980)
💾 Saving artifacts …
   ✅  All artifacts saved to ./models/
🚀 Run the app with:  streamlit run app.py

---

🛠️ Tech Stack

Component	Technology
Web Framework	Streamlit
ML Library	scikit-learn
Data Processing	pandas, NumPy
Visualisation	Plotly
Statistical Analysis	SciPy (KDE plots)
Model Serialisation	joblib
Styling	Custom CSS (dark theme, glassmorphism, Inter/JetBrains Mono fonts)

---

🚢 Deployment Ideas

Use Case	Approach
Browser Extension	Serialise RF with joblib, score URLs at navigation time (<5ms)
DNS Proxy Filter	Lean 5-feature model embedded in corporate DNS resolvers
Email Gateway	Apply model to URLs found in email bodies
Stack with Blocklists	ML catches zero-day phishing; PhishTank handles known-bad domains
Monthly Retraining	Phishing patterns evolve; fresh data prevents model drift
Explainability	Add SHAP values for SOC analyst trust and false positive investigation

---

📄 License

This project is licensed under the MIT License — see the LICENSE file for details.

---

Built with ❤️ by Samarth Garge

🔒 PhishGuard AI  |  Phishing URL Detection  |  URL-Phish Dataset (CC BY 4.0)