Find phishing signals
Explore patterns in email subjects and message content.
-
Introduction
Organization
Deloitte Morocco Cyber Centre
Year
2024
Role
Cybersecurity & AI Intern
Platform
Chrome Extension + Flask API
An AI-based phishing email detection system designed to help users identify suspicious messages through machine learning, natural language processing, and a direct Chrome extension experience.
-
Internship Context
The project was developed during my internship at Deloitte Morocco Cyber Centre, where the focus was to translate a cybersecurity problem into an applied AI system that could be tested inside an everyday email workflow.
-
Challenge & Approach
Phishing remains one of the most persistent cybersecurity threats, while manual email review is slow, inconsistent, and difficult to scale. The project needed to detect suspicious content accurately without making the user experience feel like a security specialist’s workflow.
The approach combined curated phishing datasets, feature engineering, model training, and a web-based deployment layer. Several machine learning and NLP models were evaluated before selecting the most suitable model for a practical browser extension.
- Cleaning and combining phishing-email datasets for model-ready data
- Feature extraction from email content, subject lines, URLs, and text patterns
- Comparative evaluation across Random Forest, Gradient Boosting, Logistic Regression, and DistilBERT
- A simple Chrome extension flow to bring detection directly to the inbox
-
Model Evaluation & Selection
The dataset was split into training, validation, and test sets. Traditional classifiers used engineered inputs such as email length, URL count, special-character ratio, and phishing keywords. DistilBERT received the combined subject and body text, then used its contextual language representation alongside the extracted signals.
Each candidate was evaluated on the held-out test set using accuracy, precision, recall, and F1-score. The comparison below explains the deployment decision: DistilBERT was the only model to achieve strong and balanced performance across all four measures.
| Model | Accuracy | Precision | Recall | F1-score |
|---|---|---|---|---|
| Random Forest | 84.69% | 85.23% | 82.17% | 83.67% |
| Gradient Boosting | 83.56% | 83.94% | 80.69% | 82.28% |
| Logistic Regression | 64.85% | 64.79% | 56.30% | 60.25% |
| DistilBERT | 98.08% | 98.05% | 98.10% | 98.07% |
Test-set metrics reported in the internship report. DistilBERT used raw email text alongside extracted phishing signals.
-
Inference Architecture
The deployment separated the user interaction from model inference. A Chrome extension captured the open email’s subject and body; a Flask service prepared the input, ran prediction, and returned a phishing probability to the browser.
Chrome extension
HTML, CSS, and JavaScript expose a “Detect Phishing” action within Gmail and Outlook, then send email content as JSON.
Flask API
POST /detect tokenizes the email, extracts engineered signals, runs inference, and returns a JSON probability response.
Server-side processing
- Checks urgent-action language, “too good to be true” offers, HTML tags, URL count, suspicious attachments, and special-character ratio.
- Tokenizes email text and combines model output with the extracted phishing signals before producing a softmax probability.
- Enables CORS for the extension-to-API request path and does not retain analyzed email content after a response is returned.
-
Outcome
The internship produced an end-to-end phishing detection proof of concept: curated data, engineered features, tuned models, a DistilBERT deployment decision, a Flask inference API, and a Chrome extension that brought the result into the email workflow.
The technical decision was not just to chase accuracy; it was to pair contextual NLP with interpretable email signals and a delivery mechanism that users could act on.
Internship outcome
Deloitte Morocco Cyber Centre
