puyang2025/phish-email-datasets

Dataset Card: Phish Email Datasets

Dataset Summary

This repository contains three Parquet files of email records for phishing-related modeling and analysis.

• —Total rows across files: 7,962
• —Common fields: sender/receiver metadata, date string, subject, body, URL indicator or URL content, label
• —Storage format: Apache Parquet

Repository Contents

Schema

The datasets use the following fields (order may vary):

• —sender (string): email sender information
• —receiver (string): email recipient information
• —date (string): raw date text extracted from email headers
• —subject (string): email subject line
• —body (string): email body text
• —urls (int or string): URL feature with inconsistent encoding across files
• —label (int): class label

Data Quality Notes

• —Missing values exist, especially in receiver, date, and sender (notably in Nigerian_Fraud.parquet).
• —date is stored as raw strings with mixed formats; parsing to a timestamp requires normalization.
• —urls is not schema-consistent:
• —In Nazario.parquet and Nigerian_Fraud.parquet, it behaves like a binary indicator (0/1).
• —In Nazario_5.parquet, it contains mixed string values including '0', '1', '[]', and serialized URL lists.
• —A small number of rows have empty body text.

Label Semantics

The repository does not include authoritative label documentation. Working assumption (to be verified before production use):

• —1 = phishing/fraudulent email
• —0 = non-phishing (ham/legitimate) email

Intended Use

• —Baseline experiments for phishing email classification
• —Feature engineering and text preprocessing research
• —Dataset conversion and interoperability testing (CSV/Parquet workflows)

Out-of-Scope / Risks

• —Security blocking decisions without additional validation and calibration
• —Use as a sole source of ground truth
• —Direct comparison across files without harmonizing schema and preprocessing

Ethical and Privacy Considerations

• —Email data can contain personally identifiable information (PII) and sensitive content.
• —Use for research and defensive security purposes only.
• —Apply redaction/anonymization when sharing derived artifacts.

Recommended Preprocessing

1. 1.Standardize urls into a single representation (for example, numeric indicator + extracted URL count).
2. 2.Parse and normalize date into timestamps where possible.
3. 3.Normalize text fields (subject, body) and handle missing metadata fields.
4. 4.Confirm label semantics against original source documentation if available.

Example Loading Code

import pandas as pd

df = pd.read_parquet("Nazario_5.parquet")
print(df.head())
print(df["label"].value_counts(dropna=False))

Provenance, Licensing, and Citation

• —Provenance: not documented in this repository.
• —License: not documented in this repository.
• —Citation: add source-specific citation(s) when provenance is confirmed.