File size: 2,259 Bytes
be63ecf
d04cd46
 
 
be63ecf
 
 
 
5333423
d04cd46
e15ba9b
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
---
title: Mail Triage Agent
emoji: πŸ‘€
colorFrom: blue
colorTo: green
sdk: docker
pinned: false
license: mit
app_port: 8000
---
Mail Triage Agent v4 (Security Evaluation)

This repository contains a high-fidelity environment and an autonomous agent designed for Email Security Triage. The project focuses on detecting sophisticated threats like "Digital Seduction" (Phishing), typo-squatted domains, and malicious URL redirections.

πŸš€ Overview

The system consists of two primary components:

Environment (env.py): A FastAPI-based server implementing the OpenEnv specification. it serves a dataset of 15 email scenarios categorized by difficulty (1 to 3).

Agent Logic (inference.py): An LLM-powered agent (using gemini-2.0-flash) that analyzes email metadata, headers, and URLs to make triage decisions.

πŸ›  Project Structure

env.py: The core environment logic. Includes the dataset and scoring metrics.

inference.py: The agent's decision-making loop.

models.py: Pydantic models defining the Observation and Action spaces.

openenv.yaml: Metadata for the OpenEnv benchmark framework.

Dockerfile: Containerization setup for deployment.

requirements.txt: Python dependencies.

πŸ§ͺ Scoring Logic

The environment uses a sophisticated reward system:

Perfect Classification: 1.0 + (difficulty * 0.1)

Partial Credit: 0.4 (e.g., classifying Phishing as Spam).

Dangerous Failure: -1.5 (e.g., letting Phishing into the INBOX).

False Positive: -0.5 (e.g., blocking legitimate mail).

Reasoning Bonus: +0.05 for providing detailed justifications.

βš™οΈ Setup & Installation

Prerequisites

Docker (optional)

Python 3.10+

A Google Gemini API Key

Local Execution

Install dependencies:

pip install -r requirements.txt


Set your environment variables:

export GEMINI_API_KEY="your_api_key_here"


Run the environment server:

uvicorn env:app --host 0.0.0.0 --port 8000


In a separate terminal, run the agent:

python inference.py


πŸ›‘ Security Scenarios Covered

Clean: Official Manipal or Amazon communications with valid SPF/DKIM.

Spam: Marketing mail from Swiggy or Internshala.

Phishing: Typo-squatted domains (e.g., manipal-edu.in vs manipal.edu) and shortened URLs.

Credential Theft: Fake security alerts from bank/Google look-alikes.