Build a Simple AI-Based Phishing Detector (Beginner Tutorial)

python3 -m venv .venv-phish
source .venv-phish/bin/activate
pip install --upgrade pip
pip install pandas scikit-learn joblib

cat > make_dataset.py <<'PY'
import pandas as pd

phish_samples = [
    ("Your account is locked. Verify immediately at http://fake-bank.com", 1),
    ("Urgent: update payroll info now or your pay is delayed", 1),
    ("Security alert: login from unknown device. Download the attached form", 1),
    ("Package held: pay customs fee via gift card", 1),
    ("Congrats, you won a prize! Click to claim", 1),
]

benign_samples = [
    ("Team meeting notes and next sprint goals", 0),
    ("Invoice attached for approved purchase order", 0),
    ("Reminder: security training scheduled next week", 0),
    ("Quarterly newsletter and product updates", 0),
    ("Welcome to the platform—getting started guide", 0),
]

df = pd.DataFrame(phish_samples + benign_samples, columns=["text", "label"])
df.to_csv("emails.csv", index=False)
print("Wrote emails.csv with", len(df), "rows")
PY

python make_dataset.py

cat > train_and_eval.py <<'PY'
import json
import pandas as pd
from sklearn.model_selection import train_test_split
from sklearn.feature_extraction.text import TfidfVectorizer
from sklearn.linear_model import LogisticRegression
from sklearn.pipeline import Pipeline
from sklearn.metrics import classification_report, confusion_matrix

df = pd.read_csv("emails.csv")
X_train, X_test, y_train, y_test = train_test_split(df["text"], df["label"], test_size=0.3, random_state=42, stratify=df["label"])

pipeline = Pipeline([
    ("tfidf", TfidfVectorizer(ngram_range=(1, 2), min_df=1)),
    ("clf", LogisticRegression(max_iter=400, class_weight="balanced")),
])

pipeline.fit(X_train, y_train)
preds = pipeline.predict(X_test)

report = classification_report(y_test, preds, target_names=["benign", "phish"], digits=3, output_dict=True)
cm = confusion_matrix(y_test, preds, labels=[0, 1])

with open("model.json", "w") as f:
    json.dump({"params": pipeline.get_params(deep=False)}, f, indent=2)

print("Confusion matrix [[TN, FP], [FN, TP]]:", cm.tolist())
print("Precision/Recall/F1:", json.dumps(report, indent=2))
PY

python train_and_eval.py

cat > score_email.py <<'PY'
import sys
import joblib
import pandas as pd
from sklearn.pipeline import Pipeline

MODEL_PATH = "model.pkl"

def load_model():
    return joblib.load(MODEL_PATH)

def main():
    if len(sys.argv) < 2:
        print("Usage: python score_email.py 'email text'")
        sys.exit(1)
    text = sys.argv[1]
    model: Pipeline = load_model()
    proba = model.predict_proba([text])[0][1]
    print(f"phish_probability={proba:.3f}")
    if proba > 0.7:
        print("Action: quarantine and send to human review")

if __name__ == "__main__":
    main()
PY

pip install joblib
python - <<'PY'
import joblib
from sklearn.pipeline import Pipeline
import pandas as pd
from sklearn.feature_extraction.text import TfidfVectorizer
from sklearn.linear_model import LogisticRegression

df = pd.read_csv("emails.csv")
pipe = Pipeline([
    ("tfidf", TfidfVectorizer(ngram_range=(1, 2), min_df=1)),
    ("clf", LogisticRegression(max_iter=400, class_weight="balanced")),
])
pipe.fit(df["text"], df["label"])
joblib.dump(pipe, "model.pkl")
print("Saved model.pkl")
PY

python score_email.py "Please reset your password at http://fake.com/reset"

deactivate || true
rm -rf .venv-phish emails.csv make_dataset.py train_and_eval.py score_email.py model.pkl