mikaelnurminen/phishing-email-detector-v51

Phishing Email Detector V5.1

Phishing Email Detector V5.1 is a multi-task DistilBERT model trained on merged phishing email corpora with auxiliary phishing-type supervision and calibrated probability outputs.

Developed by members of l3ak, a cybersecurity / CTF team

👉 Demo: https://huggingface.co/spaces/mikaelnurminen/phishing-detector-app

Model Overview

• —Base model: distilbert-base-uncased
• —Task: phishing vs safe classification
• —Auxiliary task: phishing type classification (6 classes)
• —Input: preprocessed email text
• —Output: phishing probability (0–1)
• —Loss: weighted CE + label smoothing
• —Calibration: temperature scaling
• —Threshold modes: balanced / high-recall / high-precision

Training Data

The model is trained on a merged and deduplicated dataset from two public phishing email sources:

After merge + deduplication: ~30k+ emails

Data Processing Pipeline

• —HTML → text stripping
• —URL + email masking
• —Cross-dataset deduplication
• —Stratified split
• —Feature extraction (URLs, domains, tokens, etc.)
• —Pseudo-labelling of phishing type

Phishing Type Auxiliary Labels

Phishing emails receive one of 6 heuristic types:

1. 1.Credential harvesting
2. 2.Financial / invoice
3. 3.Account suspension
4. 4.Malware / attachment
5. 5.Brand impersonation
6. 6.Generic spam

Safe emails → type = −1 (masked in loss)

This auxiliary supervision improves representation learning and recall.

Performance (Test Set)

Decision Thresholds

Training Configuration

• —Max length: MAX_LENGTH (DistilBERT input)
• —Effective batch: 64 (grad accumulation)
• —Scheduler: linear
• —Optimizer: AdamW
• —Epochs: V5.1 training regime
• —GPU: CUDA (mixed precision)