Improving ML logic to reduce False Negatives.

ml_utils.py

@@ -1,1128 +1,303 @@
-# # ml_utils.py
-
-# import re
-# import logging
-# from typing import Dict, Optional
-# from urllib.parse import urlparse
-
-# from transformers import pipeline
-# from langdetect import detect, LangDetectError
-
-# logging.basicConfig(level=logging.INFO)
-# logger = logging.getLogger(__name__)
-
-
-# class ScamDetectionService:
-#     def __init__(self):
-#         logger.info("Loading zero-shot classification model...")
-
-#         # Real HuggingFace zero-shot classifier
-#         # facebook/bart-large-mnli is free, no fine-tuning needed, works out of the box
-#         self.classifier = pipeline(
-#             "zero-shot-classification",
-#             model="facebook/bart-large-mnli"
-#         )
-
-#         self.scam_labels = ["scam or phishing", "suspicious", "safe"]
-
-#         # URL shorteners — rule-based check on top of ML
-#         self.suspicious_domains = [
-#             'bit.ly', 'tinyurl.com', 'short.link', 'tiny.cc', 'ow.ly'
-#         ]
-
-#         logger.info("Model loaded successfully.")
-
-#     def detect_language(self, text: str) -> str:
-#         """Detect language using langdetect library"""
-#         try:
-#             return detect(text)
-#         except LangDetectError:
-#             return 'en'  # default to English if detection fails
-
-#     def get_language_confidence(self, text: str) -> float:
-#         """Rough confidence based on text length"""
-#         word_count = len(text.split())
-#         if word_count < 5:
-#             return 0.6
-#         elif word_count < 15:
-#             return 0.8
-#         return 0.9
-
-#     def analyze_text_scam(self, text: str, language: str = None) -> Dict:
-#         """Analyze text using zero-shot NLP classification"""
-#         if not text or not text.strip():
-#             return {
-#                 "risk_level": "Safe",
-#                 "confidence": 0.0,
-#                 "reasoning": "Empty text provided",
-#                 "detected_language": "unknown"
-#             }
-
-#         detected_language = language or self.detect_language(text)
-
-#         try:
-#             result = self.classifier(text, candidate_labels=self.scam_labels)
-
-#             # result["labels"][0] is the top predicted label
-#             top_label = result["labels"][0]
-#             top_score = result["scores"][0]
-
-#             # Map model output to our risk levels
-#             if "scam" in top_label:
-#                 risk_level = "Scam"
-#             elif "suspicious" in top_label:
-#                 risk_level = "Suspicious"
-#             else:
-#                 risk_level = "Safe"
-
-#             reasoning = f"Model classified as '{top_label}' with {round(top_score * 100, 1)}% confidence"
-
-#             return {
-#                 "risk_level": risk_level,
-#                 "confidence": round(top_score, 4),
-#                 "reasoning": reasoning,
-#                 "detected_language": detected_language
-#             }
-
-#         except Exception as e:
-#             logger.error(f"Classification failed: {e}")
-#             return {
-#                 "risk_level": "Suspicious",
-#                 "confidence": 0.5,
-#                 "reasoning": f"Model error, defaulting to suspicious: {str(e)}",
-#                 "detected_language": detected_language
-#             }
-
-#     def analyze_url_scam(self, url: str, context: str = "") -> Dict:
-#         """
-#         Analyze URL using a combination of:
-#         1. Rule-based checks (IP, known patterns, shorteners)
-#         2. Zero-shot classification on the URL string + context
-#         """
-#         if not url:
-#             return {
-#                 "risk_level": "Safe",
-#                 "confidence": 0.0,
-#                 "reasoning": "No URL provided",
-#                 "domain": "",
-#                 "url_status": "invalid"
-#             }
-
-#         try:
-#             if not url.startswith(('http://', 'https://')):
-#                 url = 'http://' + url
-
-#             parsed_url = urlparse(url)
-#             domain = parsed_url.netloc.lower()
-
-#             rule_risk = 0.0
-#             rule_reasons = []
-
-#             known_scam_patterns = [
-#                 "faceb00k", "paypa1", "amaz0n", "micros0ft",
-#                 "appleid-support", "login-secure", "claim-your-free",
-#                 "lottery", "techsupport", "quickloan"
-#             ]
-
-#             if any(pattern in domain for pattern in known_scam_patterns):
-#                 rule_risk += 0.7
-#                 rule_reasons.append("Matches known scam domain pattern")
-
-#             if any(s in domain for s in self.suspicious_domains):
-#                 rule_risk += 0.6
-#                 rule_reasons.append("Uses URL shortening service")
-
-#             if re.search(r'\d+\.\d+\.\d+\.\d+', domain):
-#                 rule_risk += 0.8
-#                 rule_reasons.append("Uses raw IP address instead of domain")
-
-#             if len(url) > 100:
-#                 rule_risk += 0.2
-#                 rule_reasons.append("Unusually long URL")
-
-#             suspicious_words = ['login', 'verify', 'update', 'confirm', 'secure']
-#             if any(word in url.lower() for word in suspicious_words):
-#                 rule_risk += 0.3
-#                 rule_reasons.append("Contains suspicious keywords in URL")
-
-#             # Also run zero-shot on the URL + context string for extra signal
-#             analysis_text = f"URL: {url}"
-#             if context:
-#                 analysis_text += f" Context: {context}"
-
-#             ml_result = self.classifier(analysis_text, candidate_labels=self.scam_labels)
-#             ml_top_label = ml_result["labels"][0]
-#             ml_top_score = ml_result["scores"][0]
-
-#             # Blend rule-based + ML score
-#             if "scam" in ml_top_label:
-#                 ml_risk = ml_top_score
-#             elif "suspicious" in ml_top_label:
-#                 ml_risk = ml_top_score * 0.5
-#             else:
-#                 ml_risk = 0.0
-
-#             final_score = min((rule_risk * 0.6) + (ml_risk * 0.4), 1.0)
-
-#             if final_score >= 0.6:
-#                 risk_level = "Scam"
-#             elif final_score >= 0.35:
-#                 risk_level = "Suspicious"
-#             else:
-#                 risk_level = "Safe"
-
-#             rule_summary = "; ".join(rule_reasons) if rule_reasons else "No rule-based flags"
-#             reasoning = f"{rule_summary} | ML: '{ml_top_label}' ({round(ml_top_score * 100, 1)}%)"
-
-#             return {
-#                 "risk_level": risk_level,
-#                 "confidence": round(final_score, 4),
-#                 "reasoning": reasoning,
-#                 "domain": domain,
-#                 "url_status": "analyzed"
-#             }
-
-#         except Exception as e:
-#             return {
-#                 "risk_level": "Suspicious",
-#                 "confidence": 0.5,
-#                 "reasoning": f"URL analysis error: {str(e)}",
-#                 "domain": "unknown",
-#                 "url_status": "error"
-#             }
-
-#     def generate_user_response(self, risk_level: str) -> str:
-#         responses = {
-#             "Safe": "✅ This message appears safe.",
-#             "Suspicious": "⚠️ Be cautious - this message has suspicious elements.",
-#             "Scam": "🚨 WARNING: This appears to be a scam! Do not click links or share personal info."
-#         }
-#         return responses.get(risk_level, "Unable to analyze.")
-
-
-##############################################################################################
-# ml_utils.py
-
-# import re
-# import logging
-# from typing import Dict, Optional
-# from urllib.parse import urlparse
-
-# from transformers import pipeline
-# from langdetect import detect
-# from langdetect.lang_detect_exception import LangDetectException
-
-# logging.basicConfig(level=logging.INFO)
-# logger = logging.getLogger(__name__)
-
-
-# class ScamDetectionService:
-#     def __init__(self):
-#         logger.info("Loading zero-shot classification model...")
-
-#         # Real HuggingFace zero-shot classifier
-#         # facebook/bart-large-mnli is free, no fine-tuning needed, works out of the box
-#         self.classifier = pipeline(
-#             "zero-shot-classification",
-#             model="facebook/bart-large-mnli"
-#         )
-
-#         self.scam_labels = ["scam or phishing", "suspicious", "safe"]
-
-#         # URL shorteners — rule-based check on top of ML
-#         self.suspicious_domains = [
-#             'bit.ly', 'tinyurl.com', 'short.link', 'tiny.cc', 'ow.ly'
-#         ]
-
-#         logger.info("Model loaded successfully.")
-
-#     def detect_language(self, text: str) -> str:
-#         """Detect language using langdetect library"""
-#         try:
-#             return detect(text)
-#         except LangDetectException:
-#             return 'en'  # default to English if detection fails
-
-#     def get_language_confidence(self, text: str) -> float:
-#         """Rough confidence based on text length"""
-#         word_count = len(text.split())
-#         if word_count < 5:
-#             return 0.6
-#         elif word_count < 15:
-#             return 0.8
-#         return 0.9
-
-#     def analyze_text_scam(self, text: str, language: str = None) -> Dict:
-#         """Analyze text using zero-shot NLP classification"""
-#         if not text or not text.strip():
-#             return {
-#                 "risk_level": "Safe",
-#                 "confidence": 0.0,
-#                 "reasoning": "Empty text provided",
-#                 "detected_language": "unknown"
-#             }
-
-#         detected_language = language or self.detect_language(text)
-
-#         try:
-#             result = self.classifier(text, candidate_labels=self.scam_labels)
-
-#             # result["labels"][0] is the top predicted label
-#             top_label = result["labels"][0]
-#             top_score = result["scores"][0]
-
-#             # Map model output to our risk levels
-#             if "scam" in top_label:
-#                 risk_level = "Scam"
-#             elif "suspicious" in top_label:
-#                 risk_level = "Suspicious"
-#             else:
-#                 risk_level = "Safe"
-
-#             reasoning = f"Model classified as '{top_label}' with {round(top_score * 100, 1)}% confidence"
-
-#             return {
-#                 "risk_level": risk_level,
-#                 "confidence": round(top_score, 4),
-#                 "reasoning": reasoning,
-#                 "detected_language": detected_language
-#             }
-
-#         except Exception as e:
-#             logger.error(f"Classification failed: {e}")
-#             return {
-#                 "risk_level": "Suspicious",
-#                 "confidence": 0.5,
-#                 "reasoning": f"Model error, defaulting to suspicious: {str(e)}",
-#                 "detected_language": detected_language
-#             }
-
-#     def analyze_url_scam(self, url: str, context: str = "") -> Dict:
-#         """
-#         Analyze URL using a combination of:
-#         1. Rule-based checks (IP, known patterns, shorteners)
-#         2. Zero-shot classification on the URL string + context
-#         """
-#         if not url:
-#             return {
-#                 "risk_level": "Safe",
-#                 "confidence": 0.0,
-#                 "reasoning": "No URL provided",
-#                 "domain": "",
-#                 "url_status": "invalid"
-#             }
-
-#         try:
-#             if not url.startswith(('http://', 'https://')):
-#                 url = 'http://' + url
-
-#             parsed_url = urlparse(url)
-#             domain = parsed_url.netloc.lower()
-
-#             rule_risk = 0.0
-#             rule_reasons = []
-
-#             known_scam_patterns = [
-#                 "faceb00k", "paypa1", "amaz0n", "micros0ft",
-#                 "appleid-support", "login-secure", "claim-your-free",
-#                 "lottery", "techsupport", "quickloan"
-#             ]
-
-#             if any(pattern in domain for pattern in known_scam_patterns):
-#                 rule_risk += 0.7
-#                 rule_reasons.append("Matches known scam domain pattern")
-
-#             if any(s in domain for s in self.suspicious_domains):
-#                 rule_risk += 0.6
-#                 rule_reasons.append("Uses URL shortening service")
-
-#             if re.search(r'\d+\.\d+\.\d+\.\d+', domain):
-#                 rule_risk += 0.8
-#                 rule_reasons.append("Uses raw IP address instead of domain")
-
-#             if len(url) > 100:
-#                 rule_risk += 0.2
-#                 rule_reasons.append("Unusually long URL")
-
-#             suspicious_words = ['login', 'verify', 'update', 'confirm', 'secure']
-#             if any(word in url.lower() for word in suspicious_words):
-#                 rule_risk += 0.3
-#                 rule_reasons.append("Contains suspicious keywords in URL")
-
-#             # Also run zero-shot on the URL + context string for extra signal
-#             analysis_text = f"URL: {url}"
-#             if context:
-#                 analysis_text += f" Context: {context}"
-
-#             ml_result = self.classifier(analysis_text, candidate_labels=self.scam_labels)
-#             ml_top_label = ml_result["labels"][0]
-#             ml_top_score = ml_result["scores"][0]
-
-#             # Blend rule-based + ML score
-#             if "scam" in ml_top_label:
-#                 ml_risk = ml_top_score
-#             elif "suspicious" in ml_top_label:
-#                 ml_risk = ml_top_score * 0.5
-#             else:
-#                 ml_risk = 0.0
-
-#             final_score = min((rule_risk * 0.6) + (ml_risk * 0.4), 1.0)
-
-#             if final_score >= 0.6:
-#                 risk_level = "Scam"
-#             elif final_score >= 0.35:
-#                 risk_level = "Suspicious"
-#             else:
-#                 risk_level = "Safe"
-
-#             rule_summary = "; ".join(rule_reasons) if rule_reasons else "No rule-based flags"
-#             reasoning = f"{rule_summary} | ML: '{ml_top_label}' ({round(ml_top_score * 100, 1)}%)"
-
-#             return {
-#                 "risk_level": risk_level,
-#                 "confidence": round(final_score, 4),
-#                 "reasoning": reasoning,
-#                 "domain": domain,
-#                 "url_status": "analyzed"
-#             }
-
-#         except Exception as e:
-#             return {
-#                 "risk_level": "Suspicious",
-#                 "confidence": 0.5,
-#                 "reasoning": f"URL analysis error: {str(e)}",
-#                 "domain": "unknown",
-#                 "url_status": "error"
-#             }
-
-#     def generate_user_response(self, risk_level: str) -> str:
-#         responses = {
-#             "Safe": "✅ This message appears safe.",
-#             "Suspicious": "⚠️ Be cautious - this message has suspicious elements.",
-#             "Scam": "🚨 WARNING: This appears to be a scam! Do not click links or share personal info."
-#         }
-#         return responses.get(risk_level, "Unable to analyze.")
-
-#################################################################################################
-
-# ml_utils.py - FIXED VERSION
-
-# import re
-# import logging
-# from typing import Dict
-# from urllib.parse import urlparse
-
-# # Use a REAL spam detection model
-# from transformers import pipeline
-
-# logging.basicConfig(level=logging.INFO)
-# logger = logging.getLogger(__name__)
-
-
-# class ScamDetectionService:
-#     def __init__(self):
-#         logger.info("Loading spam detection model...")
-        
-#         # Option A: mrm8488/bert-tiny-finetuned-sms-spam-detection
-#         # 90%+ accuracy on SMS spam, only 17MB
-#         self.classifier = pipeline(
-#             "text-classification",
-#             model="mrm8488/bert-tiny-finetuned-sms-spam-detection"
-#         )
-        
-#         # URL shortener blacklist
-#         self.suspicious_domains = [
-#             'bit.ly', 'tinyurl.com', 'short.link', 'tiny.cc', 'ow.ly'
-#         ]
-        
-#         logger.info("Model loaded successfully.")
-
-#     def detect_language(self, text: str) -> str:
-#         """Simple language detection based on character set"""
-#         # Lightweight approach - no need for langdetect
-#         if re.search(r'[\u0900-\u097F]', text):  # Devanagari
-#             return 'hi'
-#         elif re.search(r'[\u0980-\u09FF]', text):  # Bengali/Odia
-#             return 'or'
-#         else:
-#             return 'en'
-
-#     def analyze_text_scam(self, text: str, language: str = None) -> Dict:
-#         """Analyze text using fine-tuned spam detection model"""
-#         if not text or not text.strip():
-#             return {
-#                 "risk_level": "Safe",
-#                 "confidence": 0.0,
-#                 "reasoning": "Empty text provided",
-#                 "detected_language": "unknown"
-#             }
-
-#         detected_language = language or self.detect_language(text)
-
-#         try:
-#             # Get prediction
-#             result = self.classifier(text)[0]
-            
-#             # Model returns: {'label': 'SPAM', 'score': 0.99}
-#             label = result['label'].upper()
-#             score = result['score']
-            
-#             # Map to your risk levels
-#             if label == 'SPAM' and score > 0.7:
-#                 risk_level = "Scam"
-#                 confidence = score
-#             elif label == 'SPAM' and score > 0.4:
-#                 risk_level = "Suspicious"
-#                 confidence = score * 0.8
-#             else:
-#                 risk_level = "Safe"
-#                 confidence = 1 - score
-            
-#             # Add rule-based boost for common scam patterns
-#             scam_keywords = [
-#                 'congratulations', 'winner', 'claim', 'urgent', 'verify',
-#                 'account suspended', 'prize', 'free money', 'click here',
-#                 'act now', 'limited time', 'bank details'
-#             ]
-            
-#             keyword_count = sum(1 for kw in scam_keywords if kw.lower() in text.lower())
-#             if keyword_count >= 2:
-#                 # Boost confidence if multiple scam keywords present
-#                 confidence = min(confidence + 0.15, 0.99)
-#                 if risk_level == "Safe":
-#                     risk_level = "Suspicious"
-            
-#             reasoning = f"Spam classifier: {label} ({round(score * 100, 1)}%)"
-#             if keyword_count > 0:
-#                 reasoning += f" + {keyword_count} scam keywords detected"
-
-#             return {
-#                 "risk_level": risk_level,
-#                 "confidence": round(confidence, 4),
-#                 "reasoning": reasoning,
-#                 "detected_language": detected_language
-#             }
-
-#         except Exception as e:
-#             logger.error(f"Classification failed: {e}")
-#             return {
-#                 "risk_level": "Suspicious",
-#                 "confidence": 0.5,
-#                 "reasoning": f"Model error: {str(e)}",
-#                 "detected_language": detected_language
-#             }
-
-#     def analyze_url_scam(self, url: str, context: str = "") -> Dict:
-#         """
-#         Analyze URL using rule-based checks + ML on context
-#         """
-#         if not url:
-#             return {
-#                 "risk_level": "Safe",
-#                 "confidence": 0.0,
-#                 "reasoning": "No URL provided",
-#                 "domain": "",
-#                 "url_status": "invalid"
-#             }
-
-#         try:
-#             if not url.startswith(('http://', 'https://')):
-#                 url = 'http://' + url
-
-#             parsed_url = urlparse(url)
-#             domain = parsed_url.netloc.lower()
-
-#             rule_risk = 0.0
-#             rule_reasons = []
-
-#             # Known scam domain patterns
-#             scam_patterns = [
-#                 "faceb00k", "paypa1", "amaz0n", "micros0ft",
-#                 "appleid-support", "login-secure", "claim-your-free",
-#                 "lottery", "techsupport", "quickloan", "verify-account"
-#             ]
-
-#             if any(pattern in domain for pattern in scam_patterns):
-#                 rule_risk += 0.8
-#                 rule_reasons.append("Domain mimics trusted brand")
-
-#             if any(s in domain for s in self.suspicious_domains):
-#                 rule_risk += 0.6
-#                 rule_reasons.append("URL shortening service")
-
-#             # IP address instead of domain
-#             if re.search(r'\d+\.\d+\.\d+\.\d+', domain):
-#                 rule_risk += 0.9
-#                 rule_reasons.append("Uses raw IP address")
-
-#             # Suspicious TLDs
-#             suspicious_tlds = ['.tk', '.ml', '.ga', '.cf', '.gq', '.xyz']
-#             if any(domain.endswith(tld) for tld in suspicious_tlds):
-#                 rule_risk += 0.5
-#                 rule_reasons.append("Suspicious top-level domain")
-
-#             # Long URL (often phishing)
-#             if len(url) > 100:
-#                 rule_risk += 0.3
-#                 rule_reasons.append("Unusually long URL")
-
-#             # Security-related words in URL
-#             security_words = ['login', 'verify', 'update', 'confirm', 'secure', 'account']
-#             if any(word in url.lower() for word in security_words):
-#                 rule_risk += 0.4
-#                 rule_reasons.append("Contains security-related keywords")
-
-#             # If context provided, analyze it for spam
-#             ml_risk = 0.0
-#             if context:
-#                 context_result = self.analyze_text_scam(context)
-#                 if context_result['risk_level'] == 'Scam':
-#                     ml_risk = context_result['confidence']
-#                 elif context_result['risk_level'] == 'Suspicious':
-#                     ml_risk = context_result['confidence'] * 0.5
-
-#             # Combine rule-based + ML
-#             final_score = min((rule_risk * 0.7) + (ml_risk * 0.3), 1.0)
-
-#             if final_score >= 0.7:
-#                 risk_level = "Scam"
-#             elif final_score >= 0.4:
-#                 risk_level = "Suspicious"
-#             else:
-#                 risk_level = "Safe"
-
-#             rule_summary = "; ".join(rule_reasons) if rule_reasons else "No suspicious patterns"
-#             reasoning = f"{rule_summary}"
-#             if context:
-#                 reasoning += f" | Context analysis: {context_result['risk_level']}"
-
-#             return {
-#                 "risk_level": risk_level,
-#                 "confidence": round(final_score, 4),
-#                 "reasoning": reasoning,
-#                 "domain": domain,
-#                 "url_status": "analyzed"
-#             }
-
-#         except Exception as e:
-#             return {
-#                 "risk_level": "Suspicious",
-#                 "confidence": 0.5,
-#                 "reasoning": f"URL analysis error: {str(e)}",
-#                 "domain": "unknown",
-#                 "url_status": "error"
-#             }
-
-#     def generate_user_response(self, risk_level: str) -> str:
-#         responses = {
-#             "Safe": "✅ This message appears safe.",
-#             "Suspicious": "⚠️ Be cautious - this message has suspicious elements.",
-#             "Scam": "🚨 WARNING: This appears to be a scam! Do not click links or share personal info."
-#         }
-#         return responses.get(risk_level, "Unable to analyze.")
-###################################################################################################
-
-# ml_utils.py - PROPERLY CALIBRATED VERSION
-
-# import re
-# import logging
-# from typing import Dict
-# from urllib.parse import urlparse
-
-# from transformers import pipeline
-
-# logging.basicConfig(level=logging.INFO)
-# logger = logging.getLogger(__name__)
-
-
-# class ScamDetectionService:
-#     def __init__(self):
-#         logger.info("Loading spam detection model...")
-        
-#         self.classifier = pipeline(
-#             "text-classification",
-#             model="mrm8488/bert-tiny-finetuned-sms-spam-detection"
-#         )
-        
-#         self.suspicious_domains = [
-#             'bit.ly', 'tinyurl.com', 'short.link', 'tiny.cc', 'ow.ly'
-#         ]
-        
-#         logger.info("Model loaded successfully.")
-
-#     def detect_language(self, text: str) -> str:
-#         """Simple language detection based on character set"""
-#         if re.search(r'[\u0900-\u097F]', text):
-#             return 'hi'
-#         elif re.search(r'[\u0980-\u09FF]', text):
-#             return 'or'
-#         else:
-#             return 'en'
-
-#     def analyze_text_scam(self, text: str, language: str = None) -> Dict:
-#         """Analyze text using fine-tuned spam detection model"""
-#         if not text or not text.strip():
-#             return {
-#                 "risk_level": "Safe",
-#                 "confidence": 0.0,
-#                 "reasoning": "Empty text provided",
-#                 "detected_language": "unknown"
-#             }
-
-#         detected_language = language or self.detect_language(text)
-
-#         try:
-#             result = self.classifier(text)[0]
-            
-#             label = result['label'].upper()
-#             score = result['score']
-            
-#             # FIXED: Proper threshold mapping
-#             if label == 'SPAM':
-#                 # Model says SPAM
-#                 if score >= 0.5:  # Changed from 0.7 - trust the model more
-#                     risk_level = "Scam"
-#                     confidence = score
-#                 else:
-#                     risk_level = "Suspicious"
-#                     confidence = score * 0.9
-#             else:
-#                 # Model says HAM (not spam)
-#                 if score >= 0.8:  # Very confident it's safe
-#                     risk_level = "Safe"
-#                     confidence = score
-#                 elif score >= 0.5:  # Somewhat confident it's safe
-#                     risk_level = "Safe"
-#                     confidence = score * 0.8
-#                 else:
-#                     # Model unsure, check for keywords
-#                     risk_level = "Suspicious"
-#                     confidence = 1 - score
-            
-#             # Rule-based keyword boost
-#             scam_keywords = [
-#                 'congratulations', 'winner', 'won', 'claim', 'urgent', 
-#                 'verify', 'suspended', 'prize', 'free money', 'click here',
-#                 'act now', 'limited time', 'expire', 'confirm', 'update',
-#                 'dear customer', 'bank details', 'credit card', 'password'
-#             ]
-            
-#             text_lower = text.lower()
-#             keyword_matches = [kw for kw in scam_keywords if kw in text_lower]
-#             keyword_count = len(keyword_matches)
-            
-#             # Boost scam score if keywords present
-#             if keyword_count >= 3:
-#                 if risk_level == "Safe":
-#                     risk_level = "Scam"
-#                     confidence = min(confidence + 0.3, 0.95)
-#                 elif risk_level == "Suspicious":
-#                     risk_level = "Scam"
-#                     confidence = min(confidence + 0.2, 0.90)
-#             elif keyword_count >= 2:
-#                 if risk_level == "Safe":
-#                     risk_level = "Suspicious"
-#                     confidence = min(confidence + 0.2, 0.85)
-            
-#             # Check for common spam patterns
-#             spam_patterns = [
-#                 r'\b(click here|click now)\b',
-#                 r'\b(act now|hurry|urgent)\b',
-#                 r'\b(won|winner|prize)\b',
-#                 r'\b(free money|cash prize)\b',
-#                 r'\b(verify|confirm|update).*(account|password|details)\b',
-#                 r'\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b',  # Credit card pattern
-#             ]
-            
-#             pattern_matches = sum(1 for pattern in spam_patterns if re.search(pattern, text_lower))
-            
-#             if pattern_matches >= 2 and risk_level != "Scam":
-#                 risk_level = "Scam"
-#                 confidence = min(confidence + 0.25, 0.92)
-            
-#             reasoning = f"ML: {label} ({round(score * 100, 1)}%)"
-#             if keyword_count > 0:
-#                 reasoning += f" | {keyword_count} scam keywords: {', '.join(keyword_matches[:3])}"
-#             if pattern_matches > 0:
-#                 reasoning += f" | {pattern_matches} suspicious patterns"
-
-#             return {
-#                 "risk_level": risk_level,
-#                 "confidence": round(confidence, 4),
-#                 "reasoning": reasoning,
-#                 "detected_language": detected_language
-#             }
-
-#         except Exception as e:
-#             logger.error(f"Classification failed: {e}")
-#             return {
-#                 "risk_level": "Suspicious",
-#                 "confidence": 0.5,
-#                 "reasoning": f"Model error: {str(e)}",
-#                 "detected_language": detected_language
-#             }
-
-#     def analyze_url_scam(self, url: str, context: str = "") -> Dict:
-#         """Analyze URL using rule-based checks + ML on context"""
-#         if not url:
-#             return {
-#                 "risk_level": "Safe",
-#                 "confidence": 0.0,
-#                 "reasoning": "No URL provided",
-#                 "domain": "",
-#                 "url_status": "invalid"
-#             }
-
-#         try:
-#             if not url.startswith(('http://', 'https://')):
-#                 url = 'http://' + url
-
-#             parsed_url = urlparse(url)
-#             domain = parsed_url.netloc.lower()
-
-#             rule_risk = 0.0
-#             rule_reasons = []
-
-#             # Known scam patterns
-#             scam_patterns = [
-#                 "faceb00k", "paypa1", "amaz0n", "micros0ft", "g00gle",
-#                 "appleid", "login-secure", "claim-your", "verify-account",
-#                 "lottery", "techsupport", "quickloan", "account-update"
-#             ]
-
-#             if any(pattern in domain for pattern in scam_patterns):
-#                 rule_risk += 0.8
-#                 rule_reasons.append("Domain mimics trusted brand")
-
-#             if any(s in domain for s in self.suspicious_domains):
-#                 rule_risk += 0.6
-#                 rule_reasons.append("URL shortening service")
-
-#             if re.search(r'\d+\.\d+\.\d+\.\d+', domain):
-#                 rule_risk += 0.9
-#                 rule_reasons.append("Uses raw IP address")
-
-#             suspicious_tlds = ['.tk', '.ml', '.ga', '.cf', '.gq', '.xyz', '.top']
-#             if any(domain.endswith(tld) for tld in suspicious_tlds):
-#                 rule_risk += 0.7
-#                 rule_reasons.append("Suspicious top-level domain")
-
-#             if len(url) > 100:
-#                 rule_risk += 0.3
-#                 rule_reasons.append("Unusually long URL")
-
-#             security_words = ['login', 'verify', 'update', 'confirm', 'secure', 'account']
-#             if any(word in url.lower() for word in security_words):
-#                 rule_risk += 0.4
-#                 rule_reasons.append("Security-related keywords in URL")
-
-#             # Analyze context if provided
-#             ml_risk = 0.0
-#             if context:
-#                 context_result = self.analyze_text_scam(context)
-#                 if context_result['risk_level'] == 'Scam':
-#                     ml_risk = context_result['confidence']
-#                 elif context_result['risk_level'] == 'Suspicious':
-#                     ml_risk = context_result['confidence'] * 0.6
-
-#             final_score = min((rule_risk * 0.65) + (ml_risk * 0.35), 1.0)
-
-#             if final_score >= 0.65:
-#                 risk_level = "Scam"
-#             elif final_score >= 0.35:
-#                 risk_level = "Suspicious"
-#             else:
-#                 risk_level = "Safe"
-
-#             rule_summary = "; ".join(rule_reasons) if rule_reasons else "No suspicious patterns"
-#             reasoning = f"{rule_summary}"
-#             if context:
-#                 reasoning += f" | Message context: {context_result['risk_level']}"
-
-#             return {
-#                 "risk_level": risk_level,
-#                 "confidence": round(final_score, 4),
-#                 "reasoning": reasoning,
-#                 "domain": domain,
-#                 "url_status": "analyzed"
-#             }
-
-#         except Exception as e:
-#             return {
-#                 "risk_level": "Suspicious",
-#                 "confidence": 0.5,
-#                 "reasoning": f"URL analysis error: {str(e)}",
-#                 "domain": "unknown",
-#                 "url_status": "error"
-#             }
-
-#     def generate_user_response(self, risk_level: str) -> str:
-#         responses = {
-#             "Safe": "✅ This message appears safe.",
-#             "Suspicious": "⚠️ Be cautious - this message has suspicious elements.",
-#             "Scam": "🚨 WARNING: This appears to be a scam! Do not click links or share personal info."
-#         }
-#         return responses.get(risk_level, "Unable to analyze.")
-
-##################################################################################################
-
-# ml_utils.py - TF-IDF + Logistic Regression (PROVEN APPROACH)
-
-import re
-import pickle
-import logging
-from typing import Dict
-from urllib.parse import urlparse
-from pathlib import Path
-
-from sklearn.feature_extraction.text import TfidfVectorizer
-from sklearn.linear_model import LogisticRegression
-from sklearn.pipeline import Pipeline
-import pandas as pd
-
-logging.basicConfig(level=logging.INFO)
-logger = logging.getLogger(__name__)
-
-
-class ScamDetectionService:
-    def __init__(self):
-        logger.info("Loading spam detection model...")
-        
-        model_path = Path("spam_model.pkl")
-        
-        if model_path.exists():
-            with open(model_path, 'rb') as f:
-                self.model = pickle.load(f)
-            logger.info("Model loaded from disk.")
-        else:
-            logger.info("Training new model on SMS Spam dataset...")
-            self.train_model()
-        
-        self.suspicious_domains = [
-            'bit.ly', 'tinyurl.com', 'short.link', 'tiny.cc', 'ow.ly'
-        ]
-        
-        logger.info("Model ready.")
-
-    def train_model(self):
-        """Train TF-IDF + Logistic Regression on spam dataset"""
-        try:
-            df = pd.read_csv("spam.csv", encoding='latin-1')[['v1', 'v2']]
-            df.columns = ['label', 'text']
-            
-            # Convert labels: ham -> 0, spam -> 1
-            df['label'] = df['label'].map({'ham': 0, 'spam': 1})
-            
-            # Build pipeline
-            self.model = Pipeline([
-                ('tfidf', TfidfVectorizer(
-                    max_features=3000,
-                    ngram_range=(1, 2),  # Unigrams + bigrams
-                    stop_words='english',
-                    min_df=2,
-                    sublinear_tf=True
-                )),
-                ('clf', LogisticRegression(
-                    max_iter=1000,
-                    C=1.0,
-                    class_weight='balanced'  # Handle class imbalance
-                ))
-            ])
-            
-            # Train on full dataset
-            logger.info(f"Training on {len(df)} messages...")
-            self.model.fit(df['text'], df['label'])
-            
-            # Save model
-            with open("spam_model.pkl", 'wb') as f:
-                pickle.dump(self.model, f)
-            
-            logger.info("Model trained and saved to spam_model.pkl")
-            
-        except FileNotFoundError:
-            logger.error("spam.csv not found! Please download the SMS Spam Collection dataset.")
-            raise
-        except Exception as e:
-            logger.error(f"Training failed: {e}")
-            raise
-
-    def detect_language(self, text: str) -> str:
-        """Simple language detection based on character set"""
-        if re.search(r'[\u0900-\u097F]', text):  # Devanagari
-            return 'hi'
-        elif re.search(r'[\u0980-\u09FF]', text):  # Bengali/Odia
-            return 'or'
-        else:
-            return 'en'
-
-    def analyze_text_scam(self, text: str, language: str = None) -> Dict:
-        """Analyze text using trained spam classifier"""
-        if not text or not text.strip():
-            return {
-                "risk_level": "Safe",
-                "confidence": 0.0,
-                "reasoning": "Empty text provided",
-                "detected_language": "unknown"
-            }
-
-        detected_language = language or self.detect_language(text)
-
-        try:
-            # Get probability scores [ham_prob, spam_prob]
-            proba = self.model.predict_proba([text])[0]
-            spam_prob = proba[1]  # Probability of spam class
-            
-            # Map to risk levels with adjusted thresholds
-            if spam_prob >= 0.65:
-                risk_level = "Scam"
-                confidence = spam_prob
-            elif spam_prob >= 0.35:
-                risk_level = "Suspicious"
-                confidence = spam_prob
-            else:
-                risk_level = "Safe"
-                confidence = 1 - spam_prob
-            
-            # Additional rule-based checks for edge cases
-            scam_keywords = [
-                'congratulations', 'winner', 'won', 'claim', 'urgent',
-                'verify', 'suspended', 'prize', 'free money', 'click here',
-                'act now', 'limited time', 'expire', 'confirm'
-            ]
-            
-            text_lower = text.lower()
-            keyword_count = sum(1 for kw in scam_keywords if kw in text_lower)
-            
-            # Boost if multiple scam keywords present
-            if keyword_count >= 3 and risk_level == "Safe":
-                risk_level = "Suspicious"
-                confidence = max(confidence, 0.6)
-            
-            reasoning = f"Spam probability: {round(spam_prob * 100, 1)}%"
-            if keyword_count > 0:
-                reasoning += f" ({keyword_count} scam keywords detected)"
-
-            return {
-                "risk_level": risk_level,
-                "confidence": round(confidence, 4),
-                "reasoning": reasoning,
-                "detected_language": detected_language
-            }
-
-        except Exception as e:
-            logger.error(f"Classification failed: {e}")
-            return {
-                "risk_level": "Suspicious",
-                "confidence": 0.5,
-                "reasoning": f"Model error: {str(e)}",
-                "detected_language": detected_language
-            }
-
-    def analyze_url_scam(self, url: str, context: str = "") -> Dict:
-        """
-        Analyze URL using rule-based checks + ML on context
-        """
-        if not url:
-            return {
-                "risk_level": "Safe",
-                "confidence": 0.0,
-                "reasoning": "No URL provided",
-                "domain": "",
-                "url_status": "invalid"
-            }
-
-        try:
-            if not url.startswith(('http://', 'https://')):
-                url = 'http://' + url
-
-            parsed_url = urlparse(url)
-            domain = parsed_url.netloc.lower()
-
-            rule_risk = 0.0
-            rule_reasons = []
-
-            # Known scam domain patterns
-            scam_patterns = [
-                "faceb00k", "paypa1", "amaz0n", "micros0ft", "g00gle",
-                "appleid", "login-secure", "claim-your", "verify-account",
-                "lottery", "techsupport", "quickloan", "account-update"
-            ]
-
-            if any(pattern in domain for pattern in scam_patterns):
-                rule_risk += 0.8
-                rule_reasons.append("Domain mimics trusted brand")
-
-            if any(s in domain for s in self.suspicious_domains):
-                rule_risk += 0.6
-                rule_reasons.append("URL shortening service")
-
-            # IP address instead of domain
-            if re.search(r'\d+\.\d+\.\d+\.\d+', domain):
-                rule_risk += 0.9
-                rule_reasons.append("Uses raw IP address")
-
-            # Suspicious TLDs
-            suspicious_tlds = ['.tk', '.ml', '.ga', '.cf', '.gq', '.xyz', '.top']
-            if any(domain.endswith(tld) for tld in suspicious_tlds):
-                rule_risk += 0.7
-                rule_reasons.append("Suspicious top-level domain")
-
-            # Long URL (often phishing)
-            if len(url) > 100:
-                rule_risk += 0.3
-                rule_reasons.append("Unusually long URL")
-
-            # Security-related words in URL
-            security_words = ['login', 'verify', 'update', 'confirm', 'secure', 'account']
-            if any(word in url.lower() for word in security_words):
-                rule_risk += 0.4
-                rule_reasons.append("Security-related keywords in URL")
-
-            # Analyze context if provided
-            ml_risk = 0.0
-            if context:
-                context_result = self.analyze_text_scam(context)
-                if context_result['risk_level'] == 'Scam':
-                    ml_risk = context_result['confidence']
-                elif context_result['risk_level'] == 'Suspicious':
-                    ml_risk = context_result['confidence'] * 0.6
-
-            # Combine rule-based + ML
-            final_score = min((rule_risk * 0.65) + (ml_risk * 0.35), 1.0)
-
-            if final_score >= 0.65:
-                risk_level = "Scam"
-            elif final_score >= 0.35:
-                risk_level = "Suspicious"
-            else:
-                risk_level = "Safe"
-
-            rule_summary = "; ".join(rule_reasons) if rule_reasons else "No suspicious patterns"
-            reasoning = f"{rule_summary}"
-            if context:
-                reasoning += f" | Message context: {context_result['risk_level']}"
-
-            return {
-                "risk_level": risk_level,
-                "confidence": round(final_score, 4),
-                "reasoning": reasoning,
-                "domain": domain,
-                "url_status": "analyzed"
-            }
-
-        except Exception as e:
-            return {
-                "risk_level": "Suspicious",
-                "confidence": 0.5,
-                "reasoning": f"URL analysis error: {str(e)}",
-                "domain": "unknown",
-                "url_status": "error"
-            }
-
-    def generate_user_response(self, risk_level: str) -> str:
-        responses = {
-            "Safe": "✅ This message appears safe.",
-            "Suspicious": "⚠️ Be cautious - this message has suspicious elements.",
-            "Scam": "🚨 WARNING: This appears to be a scam! Do not click links or share personal info."
-        }
+# ml_utils.py - Conservative thresholds, low false negatives
+
+import re
+import pickle
+import logging
+from typing import Dict
+from urllib.parse import urlparse
+from pathlib import Path
+
+from sklearn.feature_extraction.text import TfidfVectorizer
+from sklearn.linear_model import LogisticRegression
+from sklearn.pipeline import Pipeline
+import pandas as pd
+
+logging.basicConfig(level=logging.INFO)
+logger = logging.getLogger(__name__)
+
+
+class ScamDetectionService:
+    def __init__(self):
+        logger.info("Loading spam detection model...")
+
+        model_path = Path("spam_model.pkl")
+
+        if model_path.exists():
+            with open(model_path, 'rb') as f:
+                self.model = pickle.load(f)
+            logger.info("Model loaded from disk.")
+        else:
+            logger.info("Training new model on SMS Spam dataset...")
+            self.train_model()
+
+        self.suspicious_shorteners = [
+            'bit.ly', 'tinyurl.com', 'short.link', 'tiny.cc', 'ow.ly',
+            'goo.gl', 't.co', 'rb.gy', 'is.gd', 'v.gd', 'cutt.ly'
+        ]
+
+        # Social engineering patterns the SMS dataset misses.
+        # These cover bank/govt impersonation, OTP fraud, KYC scams — common in India.
+        self.social_engineering_patterns = [
+            # OTP / credential harvesting
+            (r'\botp\b', 0.5, "OTP request"),
+            (r'\bshare.{0,20}otp\b', 0.85, "Requesting OTP"),
+            (r'\bconfirm.{0,20}(otp|pin|password)\b', 0.8, "Requesting credentials"),
+            (r'\b(last\s*4|last\s*four).{0,20}(digit|card)\b', 0.8, "Requesting card digits"),
+            (r'\b(card\s*number|cvv|expiry)\b', 0.75, "Requesting card details"),
+
+            # Bank / govt impersonation
+            (r'\b(bank|rbi|sbi|hdfc|icici|axis|kotak).{0,30}(suspend|block|close|deactivat)\b', 0.85, "Bank account threat"),
+            (r'\b(fraud\s*prevention|fraud\s*team)\b', 0.6, "Fraud team impersonation"),
+            (r'\b(verify|verif).{0,20}(account|identity|detail)\b', 0.65, "Account verification request"),
+            (r'\b(kyc|know\s*your\s*customer).{0,20}(update|expire|pending|complet)\b', 0.85, "KYC scam"),
+            (r'\baadhaar.{0,30}(link|update|verify|expire)\b', 0.8, "Aadhaar scam"),
+
+            # Urgency / pressure tactics
+            (r'\b(account|service).{0,20}(suspend|block|terminat|deactivat)\b', 0.7, "Account suspension threat"),
+            (r'\b(immediate|immediately|urgent|urgently).{0,30}(action|call|contact|verify)\b', 0.7, "Urgency pressure"),
+            (r'\bwithin\s*(24|48|72)\s*hours?\b', 0.65, "Time pressure"),
+            (r'\b(call|contact).{0,20}(helpline|support|team|number).{0,20}\d{10}\b', 0.7, "Fake helpline"),
+
+            # Prize / lottery
+            (r'\b(won|win|winner|winning).{0,30}(prize|lottery|lucky|reward|cash|gift)\b', 0.85, "Lottery/prize scam"),
+            (r'\bcongratulations.{0,50}(won|selected|chosen|winner)\b', 0.9, "Congratulations scam"),
+            (r'\bclaim.{0,20}(prize|reward|cash|gift|money)\b', 0.8, "Claim prize"),
+
+            # Job / investment
+            (r'\b(work\s*from\s*home|earn.{0,10}per\s*day|daily\s*earning)\b', 0.75, "Fake job offer"),
+            (r'\b(invest.{0,20}(return|profit|earning)).{0,30}(guaranteed|assured)\b', 0.8, "Investment scam"),
+            (r'\bdouble.{0,15}(money|investment|amount)\b', 0.85, "Investment doubling scam"),
+
+            # Generic phishing
+            (r'\bclick.{0,20}(link|here|below).{0,20}(verify|confirm|update|claim)\b', 0.75, "Phishing link"),
+            (r'\b(update|confirm).{0,20}(personal|bank|card|account)\s*(detail|info|data)\b', 0.8, "Data harvesting"),
+        ]
+
+        logger.info("Model ready.")
+
+    def train_model(self):
+        """Train TF-IDF + Logistic Regression on spam dataset"""
+        try:
+            df = pd.read_csv("spam.csv", encoding='latin-1')[['v1', 'v2']]
+            df.columns = ['label', 'text']
+            df['label'] = df['label'].map({'ham': 0, 'spam': 1})
+
+            self.model = Pipeline([
+                ('tfidf', TfidfVectorizer(
+                    max_features=3000,
+                    ngram_range=(1, 2),
+                    stop_words='english',
+                    min_df=2,
+                    sublinear_tf=True
+                )),
+                ('clf', LogisticRegression(
+                    max_iter=1000,
+                    C=1.0,
+                    class_weight='balanced'
+                ))
+            ])
+
+            logger.info(f"Training on {len(df)} messages...")
+            self.model.fit(df['text'], df['label'])
+
+            with open("spam_model.pkl", 'wb') as f:
+                pickle.dump(self.model, f)
+
+            logger.info("Model trained and saved.")
+
+        except FileNotFoundError:
+            logger.error("spam.csv not found!")
+            raise
+        except Exception as e:
+            logger.error(f"Training failed: {e}")
+            raise
+
+    def detect_language(self, text: str) -> str:
+        if re.search(r'[\u0900-\u097F]', text):
+            return 'hi'
+        elif re.search(r'[\u0980-\u09FF]', text):
+            return 'or'
+        else:
+            return 'en'
+
+    def get_language_confidence(self, text: str) -> float:
+        word_count = len(text.split())
+        if word_count < 5:
+            return 0.6
+        elif word_count < 15:
+            return 0.8
+        return 0.9
+
+    def _check_social_engineering(self, text: str):
+        """
+        Check for social engineering patterns the SMS dataset misses.
+        Returns (max_risk_score, list of matched reasons).
+        """
+        text_lower = text.lower()
+        matched = []
+        max_score = 0.0
+
+        for pattern, score, reason in self.social_engineering_patterns:
+            if re.search(pattern, text_lower):
+                matched.append(reason)
+                max_score = max(max_score, score)
+
+        return max_score, matched
+
+    def analyze_text_scam(self, text: str, language: str = None) -> Dict:
+        if not text or not text.strip():
+            return {
+                "risk_level": "Safe",
+                "confidence": 0.0,
+                "reasoning": "Empty text provided",
+                "detected_language": "unknown"
+            }
+
+        detected_language = language or self.detect_language(text)
+
+        try:
+            proba = self.model.predict_proba([text])[0]
+            spam_prob = proba[1]
+
+            # Social engineering check (catches vishing, OTP, KYC scams)
+            se_score, se_reasons = self._check_social_engineering(text)
+
+            # Blend ML + rule scores. Take the max, not average.
+            # This is intentionally conservative — we'd rather flag a safe message
+            # as suspicious than let a scam through.
+            effective_score = max(spam_prob, se_score)
+
+            # Conservative thresholds:
+            # Safe = below 20% combined risk. Anything above 20% gets at least Suspicious.
+            # Scam = above 55% (was 65% before — that was too lenient).
+            if effective_score >= 0.55:
+                risk_level = "Scam"
+                confidence = effective_score
+            elif effective_score >= 0.20:
+                risk_level = "Suspicious"
+                confidence = effective_score
+            else:
+                risk_level = "Safe"
+                confidence = 1 - effective_score
+
+            # Build reasoning
+            reasoning_parts = [f"Spam probability: {round(spam_prob * 100, 1)}%"]
+            if se_reasons:
+                reasoning_parts.append(f"Flags: {', '.join(se_reasons[:3])}")
+
+            return {
+                "risk_level": risk_level,
+                "confidence": round(confidence, 4),
+                "reasoning": " | ".join(reasoning_parts),
+                "detected_language": detected_language
+            }
+
+        except Exception as e:
+            logger.error(f"Classification failed: {e}")
+            return {
+                "risk_level": "Suspicious",
+                "confidence": 0.5,
+                "reasoning": f"Model error: {str(e)}",
+                "detected_language": detected_language
+            }
+
+    def analyze_url_scam(self, url: str, context: str = "") -> Dict:
+        if not url:
+            return {
+                "risk_level": "Safe",
+                "confidence": 0.0,
+                "reasoning": "No URL provided",
+                "domain": "",
+                "url_status": "invalid"
+            }
+
+        try:
+            if not url.startswith(('http://', 'https://')):
+                url = 'http://' + url
+
+            parsed_url = urlparse(url)
+            domain = parsed_url.netloc.lower()
+
+            rule_risk = 0.0
+            rule_reasons = []
+
+            scam_patterns = [
+                "faceb00k", "paypa1", "amaz0n", "micros0ft", "g00gle",
+                "appleid", "login-secure", "claim-your", "verify-account",
+                "lottery", "techsupport", "quickloan", "account-update"
+            ]
+
+            if any(pattern in domain for pattern in scam_patterns):
+                rule_risk += 0.8
+                rule_reasons.append("Domain mimics trusted brand")
+
+            if any(s in domain for s in self.suspicious_shorteners):
+                rule_risk += 0.6
+                rule_reasons.append("URL shortening service")
+
+            if re.search(r'\d+\.\d+\.\d+\.\d+', domain):
+                rule_risk += 0.9
+                rule_reasons.append("Uses raw IP address")
+
+            suspicious_tlds = ['.tk', '.ml', '.ga', '.cf', '.gq', '.xyz', '.top', '.pw', '.click']
+            if any(domain.endswith(tld) for tld in suspicious_tlds):
+                rule_risk += 0.7
+                rule_reasons.append("Suspicious TLD")
+
+            if len(url) > 100:
+                rule_risk += 0.3
+                rule_reasons.append("Unusually long URL")
+
+            security_words = ['login', 'verify', 'update', 'confirm', 'secure', 'account', 'signin']
+            if any(word in url.lower() for word in security_words):
+                rule_risk += 0.4
+                rule_reasons.append("Security keywords in URL")
+
+            ml_risk = 0.0
+            context_risk_level = None
+            if context:
+                context_result = self.analyze_text_scam(context)
+                context_risk_level = context_result['risk_level']
+                if context_result['risk_level'] == 'Scam':
+                    ml_risk = context_result['confidence']
+                elif context_result['risk_level'] == 'Suspicious':
+                    ml_risk = context_result['confidence'] * 0.6
+
+            final_score = min((rule_risk * 0.65) + (ml_risk * 0.35), 1.0)
+
+            if final_score >= 0.55:
+                risk_level = "Scam"
+            elif final_score >= 0.25:
+                risk_level = "Suspicious"
+            else:
+                risk_level = "Safe"
+
+            rule_summary = "; ".join(rule_reasons) if rule_reasons else "No suspicious patterns"
+            reasoning = rule_summary
+            if context_risk_level:
+                reasoning += f" | Message context: {context_risk_level}"
+
+            return {
+                "risk_level": risk_level,
+                "confidence": round(final_score, 4),
+                "reasoning": reasoning,
+                "domain": domain,
+                "url_status": "analyzed"
+            }
+
+        except Exception as e:
+            return {
+                "risk_level": "Suspicious",
+                "confidence": 0.5,
+                "reasoning": f"URL analysis error: {str(e)}",
+                "domain": "unknown",
+                "url_status": "error"
+            }
+
+    def generate_user_response(self, risk_level: str) -> str:
+        responses = {
+            "Safe": "✅ This message appears safe.",
+            "Suspicious": "⚠️ Be cautious - this message has suspicious elements.",
+            "Scam": "🚨 WARNING: This appears to be a scam! Do not click links or share personal info."
+        }
         return responses.get(risk_level, "Unable to analyze.")