Phishing Email Classifier — TF-IDF + Logistic Regression (ID/EN)

Model ringan & CPU-friendly untuk deteksi email phishing dwibahasa Indonesia 🇮🇩 & English 🇺🇸 oleh Febriyansyah.

⚠️ Synthetic & educational only — jangan gunakan untuk aktivitas ilegal. Dataset & model dibuat untuk riset defensive security.

Arsitektur

Text → TF-IDF char_wb (2–4 gram, 39k max, sublinear) → LogisticRegression (L2, liblinear, C=1.04)

Featurizer: hfhub.textfeat.Featurizer — TfidfVectorizer(analyzer='char_wb', ngram_range=(2,4), max_features=39000, min_df=2, max_df=0.976, sublinear_tf=True)
Classifier: LogisticRegression(C=1.04, solver='liblinear', max_iter=1700)
Threshold operasional: 0.488 (tuned, bukan 0.5) — prob ≥ 0.488 ⇒ PHISHING
Vocab aktual: ~3.9k istilah (char_wb)
Payload: model.joblib berisi {featurizer, learner, gateway, decode, manifest} — lihat metadata.json untuk audit trail.

Dirancang tanpa dependensi berat (tanpa torch/transformers) — inferensi <50ms di CPU, ideal untuk Spaces gratis & edge.

Dataset Latih

Febriyansyah/phishing-emails-multilingual — 600 email sintetis (300 phishing / 300 benign), seimbang ID/EN, digenerate via scripts/build_phishing_dataset.py (seed 2026). Split: 398 train / 202 validation (33.6% hold-out, seed 424242).

Evaluasi (hold-out 202 sampel)

Metric	Value
Accuracy	1.0000
Macro-F1	1.0000
Confusion Matrix	`[[93, 0], [0, 109]]` (TN, FP / FN, TP)

Hasil sempurna mencerminkan sifat sintetis & pola yang jelas — validasi di data real-world tetap diperlukan sebelum produksi.

Penggunaan

Python (lokal)

pip install scikit-learn numpy
python predict.py "URGENT: Verify your BCA account now at http://bca-secure.verify-center.cc/login"
# → [PHISHING] prob=0.97  (threshold 0.488)

import pickle
from pathlib import Path

payload = pickle.load(open("model.joblib","rb"))
featurizer, clf, thr = payload["featurizer"], payload["learner"], payload["gateway"]
proba = clf.predict_proba(featurizer.transform(["Hello, your invoice is ready"]))[0,1]
print("phishing" if proba >= thr else "benign", proba)

Hugging Face

from huggingface_hub import hf_hub_download
import pickle
p = hf_hub_download("Febriyansyah/phishing-email-classifier", filename="model.joblib")
payload = pickle.load(open(p,"rb"))

Keterbatasan & Etika

Data sintetis — tidak mencakup semua variasi phishing dunia nyata (spear-phishing, BEC, dll).
Bahasa terbatas ID/EN; performa di bahasa lain tidak terjamin.
Guardrail: edu-defense-only — gunakan hanya untuk edukasi & pertahanan.

Space Demo

Coba langsung di 🤗 Space: Febriyansyah/phishing-scout (Gradio, CPU).

Reproduksi

python scripts/build_phishing_dataset.py
python scripts/train_phishing_model.py --csv data/phishing_email/phishing_email_multilingual.csv --out models/phishing_model

Lisensi

MIT — lihat LICENSE.

Citation

@misc{febriyansyah2026phishing,
  author = {Febriyansyah},
  title = {Phishing Email Classifier (TF-IDF + LogReg, ID/EN)},
  year = {2026},
  publisher = {Hugging Face},
  url = {https://huggingface.co/Febriyansyah/phishing-email-classifier}
}

Downloads last month: -

Febriyansyah
/

phishing-email-classifier