What you build
A classifier that decides whether a URL is likely to be phishing, using features such as length, special characters, domain age signals and use of IP addresses, and a page where a user can check a link.
Modules
- Dataset of legitimate and phishing URLs
- Feature extraction from URLs
- Training and comparing classifiers (logistic regression, random forest)
- URL checker page with the prediction and the features that triggered it
What you will understand
- How phishing links try to look real
- Feature engineering for security data
- Why false negatives matter more than false positives here
How it is tested
- Accuracy, precision, recall and F1
- Testing on recent phishing URLs not in the training set
What goes in the report
- Background on phishing attacks
- Feature list with reasons
- Model comparison and limitations
Viva questions to prepare
- Which feature mattered most and why?
- How can attackers get around your model?
- Why is recall important here?