Back to projects
Production Client ProjectBuiltML Cyber Threat Intelligence
PhishEye
Enterprise-grade cybersecurity platform combining a 30-dimension Random Forest ML classifier (96.98% CV accuracy, 99.56% ROC-AUC) with real-time heuristic forensic engines, terminal CLI, and REST API.
The Challenge
Modern phishing attacks utilize IDN homographs, combosquatting, and algorithmic domain generation (DGA) that easily evade traditional static blocklists and signature-based filters.
Engineering Solution
Engineered a dual-layer threat engine combining a 30-vector Random Forest classifier with IDN punycode decoders, Levenshtein brand impersonation checks, Shannon entropy DGA detection, and automated URL defanging.
Technologies Used
Python 3.11Scikit-LearnStreamlitDockerREST APIRandom Forest
Key Deliverables & Architecture
- 30-Dimension ML Vector Classification: Extracted structural, syntactic, and protocol indicators trained on the UCI Phishing dataset, achieving 96.98% cross-validation accuracy and 99.56% ROC-AUC score.
- Real-Time Forensic Heuristics: Built heuristic analyzers for IDN homographs / punycode glyph spoofing, Levenshtein typosquatting, Shannon entropy DGA calculations, and TLD reputation scoring.
- Automated Defanging Pipeline: Implemented automated defanging tools (
hxxps[://]) to safely handle, inspect, and document dangerous URLs without click-risk. - Multi-Channel Architecture: Delivered via an interactive Streamlit dark-glassmorphism dashboard, terminal CLI with ANSI reporting, and a lightweight REST API for SIEM/SOAR pipeline integrations.
- Production-Ready & Tested: Containerized with Docker and Docker Compose; covered by 40+ unit and integration test suites.