| license: apache-2.0 | |
| library_name: scikit-learn | |
| pipeline_tag: text-classification | |
| language: | |
| - en | |
| - fa | |
| tags: | |
| - cybersecurity | |
| - phishing-detection | |
| - text-classification | |
| - multilingual | |
| datasets: | |
| - AriaAICompany/phish-messages | |
| # phish-structural | |
| Small calibrated reviewers used by the Phish Space. | |
| - `tfidf_lr.joblib` — `TfidfVectorizer(char_wb 3-5)` + logistic regression, sigmoid-calibrated | |
| - `lightgbm.joblib` — LightGBM on structural features only, sigmoid-calibrated | |
| Trained on the development campaigns of `AriaAICompany/phish-messages` (seed 3). Test campaigns are held out by campaign, sender group, and template. | |
| ## Intended use | |
| Decision support for a human reviewing a **synthetic or already-shared** message. Scores are not a safe/unsafe certificate and are not a probability of account compromise. | |
| ## Out of scope | |
| - Fetching or rendering live URLs | |
| - Executing attachments | |
| - Judging malice from a logo screenshot | |
| - Treating copied SPF/DKIM/DMARC headers as a trusted receiver verdict | |
| - Production mailbox enforcement | |
| ## Metrics | |
| See `metrics.json` written by `scripts/build_artifacts.py` and `evaluations/evaluation.json` in the Space. Lab PR-AUC on synthetic fixtures is not operational accuracy. | |