| language: multilingual | |
| library_name: transformers | |
| pipeline_tag: text-classification | |
| tags: | |
| - phishing | |
| - email-security | |
| # FishSTOP DistilBERT | |
| Binary content classifier for legitimate vs malicious (phishing or spam) email, used as one | |
| signal in FishSTOP. It does not inspect SPF, DKIM, | |
| DMARC, sender reputation, links or attachments and must not be used as a standalone verdict. | |
| - Base model: `distilbert/distilbert-base-multilingual-cased` | |
| - Labels: `0=LEGITIMATE`, `1=MALICIOUS` (phishing, scam or spam) | |
| - Input: normalized email subject plus body | |
| - Long emails: up to 8 evenly spaced overlapping 512-token windows, | |
| stride 128, maximum malicious-margin aggregation | |
| - Calibration: temperature scaling on the validation split | |
| - Test F1: 0.9811 | |
| - Test precision: 0.9852 | |
| - Test recall: 0.9770 | |
| - Test selective coverage: 1.0000 | |
| The reported probability is meaningful only for data sufficiently similar to the validation | |
| distribution. Performance must be rechecked on recent, external and multilingual email sets. | |