| ---
|
| language: en
|
| license: mit
|
| library_name: phishbyte
|
| pipeline_tag: text-classification
|
| tags:
|
| - phishing-detection
|
| - email-security
|
| - pytorch
|
| - from-scratch
|
| - no-pretrained-weights
|
| - cascading-inference
|
| - lightweight
|
| - explainable-ai
|
| datasets:
|
| - CEAS-2008
|
| metrics:
|
| - f1
|
| - precision
|
| - recall
|
| - accuracy
|
| model-index:
|
| - name: phishbyte
|
| results:
|
| - task:
|
| type: text-classification
|
| name: Phishing Email Detection
|
| dataset:
|
| name: CEAS-2008
|
| type: ceas-2008
|
| metrics:
|
| - type: f1
|
| value: 0.948
|
| - type: accuracy
|
| value: 0.944
|
| - type: precision
|
| value: 0.954
|
| - type: recall
|
| value: 0.943
|
| ---
|
|
|
| # Phish_Byte
|
|
|
| A from-scratch PyTorch model for **email phishing detection**.
|
| **F1 0.948** on CEAS-2008. **12,545 parameters** (≈9,000× smaller than DistilBERT).
|
| **1,500+ emails/sec** on a laptop GPU. Every verdict explains itself.
|
|
|
| ## Why this exists
|
|
|
| Every phishing detection model on HuggingFace is currently a fine-tuned
|
| transformer (DistilBERT, BERT, RoBERTa) — 65 to 110 million parameters,
|
| ~250 MB on disk, ~50 ms per email on GPU. Phish_Byte takes a different
|
| bet: a small custom MLP trained from scratch, fed by 29 carefully chosen
|
| features, routed through a cascading inference pipeline. The model is
|
| **9,000× smaller** than DistilBERT, performs competitively, deploys
|
| without a GPU, and explains every decision.
|
|
|
| ## Usage
|
|
|
| ```python
|
| from phishbyte import PhishByteEngine
|
|
|
| engine = PhishByteEngine.from_pretrained("AnonymousSingh-007/phishbyte")
|
| verdict = engine.analyze(raw_email_string)
|
|
|
| print(verdict.label) # 'phishing'
|
| print(verdict.probability) # 0.9735
|
| print(verdict.confidence) # 'high'
|
| print(verdict.layer_used) # 2 — MLP made this call
|
| print(verdict.feature_weights) # full per-feature attribution
|
| ```
|
|
|
| ## Architecture
|
|
|
| ```
|
| Layer 1 — rule scorers (~1 ms): domain + URL + SPF + subject
|
| │
|
| ├──► obvious phishing? short-circuit verdict
|
| │
|
| └──► otherwise route to MLP
|
| │
|
| Layer 2 — MLP (~3 ms): 29 → 96 → 48 → 1 (sigmoid)
|
| │
|
| ▼
|
| PhishVerdict {label, probability, confidence, layer_used, feature_weights}
|
| ```
|
|
|
| ## Performance (CEAS-2008, n=2000 held-out)
|
|
|
| | Metric | Value |
|
| |------------------|----------:|
|
| | F1 score | **0.948** |
|
| | Accuracy | 94.40% |
|
| | Precision | 0.9537 |
|
| | Recall | 0.9432 |
|
| | Parameters | 12,545 |
|
| | Model size | ~50 KB |
|
| | Throughput (GPU) | 1,527 /s |
|
| | Throughput (CPU) | ~800 /s |
|
|
|
| ## Features (29 inputs)
|
|
|
| - **Domain (5)**: From/Reply-To/Return-Path mismatch, freemail flag, brand impersonation
|
| - **URL (5)**: HTTPS ratio, anchor mismatch, suspicious TLD, urgency, link density
|
| - **SPF (3)**: SPF fail, no record, no sending IP
|
| - **Subject (7)**: urgency, security theme, brand name, currency, all caps, fake RE, fake transaction ID
|
| - **Character-level (5)**: caps ratio, digit ratio, special chars, avg word length, HTML/text ratio
|
| - **Composite (4)**: per-layer normalized scores
|
|
|
| ## Limitations
|
|
|
| - ~5% of decisions are wrong (F1 0.948, not 1.0). Use as one signal in defence-in-depth, not the only gate.
|
| - Trained on CEAS-2008 — English-language phishing from 2008. Modern attack patterns and non-English emails will degrade performance.
|
| - SPF validation is bypassed for training (historical domains don't resolve) but runs live at inference time.
|
| - Adversarial emails crafted specifically to game these features will get through.
|
|
|
| ## Citation
|
|
|
| ```bibtex
|
| @software{phishbyte2026,
|
| author = {Singh, Samratth},
|
| title = {Phish_Byte: A cascading from-scratch PyTorch model for email phishing detection},
|
| year = {2026},
|
| url = {https://github.com/AnonymousSingh-007/Phish_Byte}
|
| }
|
| ```
|
|
|
| ## License
|
|
|
| MIT
|
|
|
