Upload app.py

app.py

@@ -0,0 +1,171 @@
+import gradio as gr
+import joblib
+import pandas as pd
+import numpy as np
+import re
+import string
+import socket
+import ssl
+import whois
+import dns.resolver
+from urllib.parse import urlparse
+from datetime import datetime
+from sklearn.preprocessing import LabelEncoder
+from sklearn.linear_model import LogisticRegression
+
+# Load correct models
+phishing_model = joblib.load("phishing_stack.pkl")
+malware_model = joblib.load("new_malware_stack.pkl")
+
+
+# Feature extraction for both phishing and malware
+def extract_features(url):
+    extracted = tldextract.extract(url)
+    domain = f"{extracted.domain}.{extracted.suffix}"
+    hostname = extracted.domain
+    scheme = "https" if url.startswith("https") else "http"
+
+    try:
+        ip_address = socket.gethostbyname(domain)
+        has_ip = 1
+    except:
+        ip_address = ''
+        has_ip = 0
+
+    features = {
+        "url_length": len(url),
+        "hostname_length": len(hostname),
+        "num_dots": url.count("."),
+        "num_hyphens": url.count("-"),
+        "num_digits": sum(char.isdigit() for char in url),
+        "num_special_chars": len(re.findall(r"[!@#$%^&*()_+=\[\]{};':\"\\|,.<>\/?]", url)),
+        "has_ip_address": has_ip,
+        "has_https": scheme == "https",
+        "has_suspicious_words": int(bool(re.search(r"(login|verify|bank|account|update|secure)", url, re.IGNORECASE))),
+        "is_shortened": int(bool(re.search(r"(bit\.ly|goo\.gl|tinyurl\.com|t\.co|ow\.ly)", url))),
+        "tld": extracted.suffix
+    }
+
+    # Additional features for malware
+    try:
+        whois_info = whois.whois(domain)
+        features["domain_age_days"] = (
+            (whois_info.expiration_date - whois_info.creation_date).days
+            if whois_info.expiration_date and whois_info.creation_date
+            else -1
+        )
+        features["domain_expiry_days"] = (
+            (whois_info.expiration_date - whois_info.updated_date).days
+            if whois_info.expiration_date and whois_info.updated_date
+            else -1
+        )
+    except:
+        features["domain_age_days"] = -1
+        features["domain_expiry_days"] = -1
+
+    try:
+        response = requests.get(url, timeout=5)
+        features["dns_ttl"] = response.elapsed.microseconds // 1000
+    except:
+        features["dns_ttl"] = -1
+
+    try:
+        ctx = ssl.create_default_context()
+        with ctx.wrap_socket(socket.socket(), server_hostname=domain) as s:
+            s.settimeout(5)
+            s.connect((domain, 443))
+            cert = s.getpeercert()
+            features["ssl_issuer"] = cert.get("issuer", [("N/A", "")])[0][0]
+            features["ssl_valid"] = True
+    except:
+        features["ssl_issuer"] = "Unknown"
+        features["ssl_valid"] = False
+
+    features["has_suspicious_keyword"] = features["has_suspicious_words"]
+    features["is_https"] = features["has_https"]
+
+    return features
+
+
+def classify_url(url):
+    features = extract_features(url)
+
+    phishing_input = [
+        features["url_length"],
+        features["hostname_length"],
+        features["num_dots"],
+        features["num_hyphens"],
+        features["num_digits"],
+        features["num_special_chars"],
+        features["has_ip_address"],
+        features["has_https"],
+        features["has_suspicious_words"],
+        features["is_shortened"],
+        features["tld"]
+    ]
+
+    malware_input = [
+        features["url_length"],
+        features["hostname_length"],
+        features["num_dots"],
+        features["num_hyphens"],
+        features["num_digits"],
+        features["num_special_chars"],
+        features["has_suspicious_keyword"],
+        features["has_ip_address"],
+        features["is_https"],
+        features["is_shortened"],
+        features["tld"],
+        features["domain_age_days"],
+        features["domain_expiry_days"],
+        features["dns_ttl"],
+        features["ssl_issuer"],
+        features["ssl_valid"]
+    ]
+
+    phishing_pred = phishing_model.predict([phishing_input])[0]
+    phishing_proba = phishing_model.predict_proba([phishing_input])[0].max()
+
+    malware_pred = malware_model.predict([malware_input])[0]
+    malware_proba = malware_model.predict_proba([malware_input])[0].max()
+
+    final_result = (
+        "Phishing" if phishing_pred == "Phishing" else
+        "Malware" if malware_pred == "malicious" else
+        "Benign"
+    )
+
+    return {
+        "url": url,
+        "final_result": final_result,
+        "phishing": {
+            "prediction": phishing_pred,
+            "confidence": phishing_proba,
+            "features": dict(zip([
+                "url_length", "hostname_length", "num_dots", "num_hyphens", "num_digits",
+                "num_special_chars", "has_ip_address", "has_https", "has_suspicious_words",
+                "is_shortened", "tld"
+            ], phishing_input))
+        },
+        "malware": {
+            "prediction": malware_pred,
+            "confidence": malware_proba,
+            "features": dict(zip([
+                "url_length", "hostname_length", "num_dots", "num_hyphens", "num_digits",
+                "num_special_chars", "has_suspicious_keyword", "has_ip_address", "is_https",
+                "is_shortened", "tld", "domain_age_days", "domain_expiry_days", "dns_ttl",
+                "ssl_issuer", "ssl_valid"
+            ], malware_input))
+        }
+    }
+
+
+with gr.Blocks() as demo:
+    gr.Markdown("## 🔐 URL Threat Detection - Phishing & Malware")
+    with gr.Row():
+        url_input = gr.Textbox(label="Enter URL", placeholder="https://example.com", lines=1)
+    output = gr.JSON(label="Prediction Results")
+    submit_btn = gr.Button("Check URL")
+    submit_btn.click(fn=classify_url, inputs=[url_input], outputs=[output])
+
+demo.launch()