Gone Phish'n - Phishing and Spam Detector Application

The purpose of this project was to create and train a naive Bayes classifer to determine if an email is spam or not. Gone Phish'n is a desktop application that uses custom trained multinomial naive Bayes classifiers to detect malicious phishing URLS and spam emails in real time and output the spam percentage.

Project Goal

Design, train, and implement two independent naive Bayes models:

• One trained on URL structure and domain patterns to detect phishing links
• One trained on email bodies to identify spam and scam content

Key Features

• Dual mode architecture (URL + Email classification)
• Custom feature extraction via tokenization and TD-IDF style probability scoring
• Real time prediction
• Multiline email input with full text analysis
• Automatic model training and persistence using 'joblib'

Datasets Trained On

• URL: Phishing and legit dataset consisting of 96,018 URLS - 48,009 spam and 48,009 legit. Built and used for evaluation in the paper "PhishStorm: Detecting Phishing with Streaming Analytics" published in IEEE TNSM
• Email: Combined CEAS_08, Enron, and SpamAssassin corpora

Built With

• Python3 + PyQt6
• scikit-learn, pandas, numpy
• NLTK for text processing
• Custom naive Baye implementation

Requirements

• Runs on Windows and MacOS
• All required packages to run on MacOS are in requirements.txt file

Run on Windows

Created an executable to run on Windows

• Double click Gone-Phish-n.exe to run application

Installation + Running on MacOS

Created a bash file that bundles requirement downloads and running the application in one.

FOR MAC YOU MUST HAVE PIP INSTALLED ON YOUR SYSTEM TO RUN

• First open the terminal and navigate to where the Gone Phish'n folder is located

• Once in the folder run:

        chmod +x run_app.sh
  
        ./run_app.sh
  

• Installs all required Python packages listed in requirements.txt

• Automatically downloads necessary NLTK language data (stopwords, punkt, punkt_tab) required for email preprocessing

• Checks for existing trained models, if not found, automatically trains both the URL phishing and email spam classifiers using the provided datasets

• Launches the application

How to use

This application has two main areas:

• Area to type or paste a URL
• Area to type or paste Email body

It can only run one check at a time, so you can only test for URL or Email individually. Once you have input into URL or Email simply hit the Check URL or Check Email and your results will appear below giving you malicious percentage