Phishing Website Detection using Machine Learning

Page 1⤢Page 2⤢Page 3⤢Page 4⤢Page 5⤢Page 6⤢Page 7⤢Page 8⤢Page 9⤢Page 10⤢Page 11⤢Page 12⤢

+45

more pages in the ZIP

Showing the first 12 pages of 57. Tap any page to read it full size — this is the actual Word file you get, not a mock-up.

result⤢home⤢check⤢model performance⤢batch check⤢admin panel⤢history⤢rest api⤢

Tap any screenshot to open it full size. These are from the project actually running — not mockups.

A complete machine learning web application that decides whether a web address belongs to a phishing site. The model is trained on 289,520 real hostnames and reaches 89.56% accuracy with 95.08% precision on 57,904 hostnames it has never seen. The trained model ships with the project, so it works the moment you run it.

The project never opens the site it is judging. Most phishing projects collect features from the page HTML or from a WHOIS lookup, which means they need a live internet connection and a round trip to the suspicious server before they can answer. Both are wrong for this problem: by the time a WHOIS query returns, the user has already clicked, and in a viva with no internet the whole project stops working. Here every feature is computed from the address string itself, using nothing but the Python standard library, so a verdict takes milliseconds and works offline.

What lifts this above a normal ML demo is that it proves the usual accuracy figures are wrong. Published phishing projects routinely report 96-99%. While preparing the data it became clear that such numbers are largely an artefact of how the datasets are collected: in the corpus used here, 100% of the legitimate addresses begin with https, 100% carry a www prefix and 0% have a path, while the phishing addresses show 48.74%, 41.37% and 28.42%. Those three marks have nothing to do with phishing - they record how each half of the dataset was gathered. Combine them and a single if statement, with no machine learning at all, scores 99.56%. A bundled script reproduces that number in front of the examiner.

The honest response was to throw the shortcut away. The scheme, the www prefix and the path are stripped before the model ever sees an address, and classification runs on the hostname alone. That costs about ten points of accuracy. The remaining 89.56% is real, and the report explains the trade in full - including the fact that 48.74% of phishing sites already use https, which is why the padlock in the address bar no longer means a site is safe.

Around the model sits a real application: user accounts with PBKDF2-hashed passwords, per-user scan history, batch checking of CSV files with a per-file accuracy score, a feedback loop where users correct wrong verdicts, an admin dashboard showing the disagreement rate between the model and its users, one-click retraining from the browser, and a REST API with per-user keys.

Four algorithms - Logistic Regression, Random Forest, Decision Tree and Bernoulli Naive Bayes - are trained on identical features and the same split, and compared inside the app itself, so the choice of model is evidence rather than assertion.

• ✓89.56% accuracy and 95.08% precision on 57,904 unseen hostnames
• ✓Trained model ships with the project - no training needed before the demo
• ✓Never opens or contacts the website being checked - works with the internet switched off
• ✓21 features computed from the address using only the Python standard library
• ✓Dataset leakage identified, measured and removed - a bundled script reproves it
• ✓Proves a one-line rule with no machine learning scores 99.56% on the raw data
• ✓Shows that 48.74% of phishing sites already use https - the padlock proves nothing
• ✓Every verdict explained by the features that moved it, from the model's own weights
• ✓Four algorithms compared side by side inside the app
• ✓Accuracy is always shown against the majority-class baseline, never on its own
• ✓Handles two-part domains correctly - sbi.co.in and bbc.co.uk are read properly
• ✓Says so plainly when it is not confident, instead of guessing
• ✓10 built-in sample addresses - one click to demo a fair test
• ✓Batch checking: upload a CSV of up to 500 addresses, download the results
• ✓Per-file accuracy if your CSV carries a label column
• ✓User accounts with PBKDF2-SHA256 hashed passwords and per-user salt
• ✓Feedback loop - users report wrong verdicts, admin sees the disagreement rate
• ✓Admin dashboard with a 7-day trend, phishing split and recent activity
• ✓Retrain the model from the browser, in the background, with a live log
• ✓REST API with per-user API keys, documented in the app
• ✓Confusion matrix, ROC curve and comparison charts generated as PNGs for the report
• ✓Every SQL query parameterised; a SQL injection attempt is part of the test suite
• ✓ON DELETE CASCADE with foreign keys enforced - deleting a user clears their data
• ✓32 automated self-tests you can run in front of the examiner
• ✓No CDN anywhere - the whole UI works with the internet switched off

• • Python 3.8+
• • Flask (web framework)
• • scikit-learn, pandas, NumPy, SciPy
• • SQLite (bundled with Python)
• • VS Code (or any editor)
• • Any web browser

Python 3.8 or newer, then one command: pip install -r requirements.txt (Flask, scikit-learn, pandas, NumPy, SciPy, joblib, matplotlib). The trained model is already inside the ZIP, so you do not have to train anything before the demo. SQLite ships with Python. Works on Windows, Linux and Mac. Roughly 350 MB of disk space is needed for the libraries.

1. Extract the ZIP.
2. Open CMD and go to the folder:  cd path\to\phishing-website-detection
3. Install the libraries:  pip install -r requirements.txt
4. Load the demo data:  python demo.py
5. Start the app:  python app.py
6. Open http://127.0.0.1:5000 in your browser.
7. Login:  admin / admin123   (or  student / student123)

Before a viva, also run 'python selftest.py' - 32 checks pass in front of the examiner.
To see the dataset leakage proved:  python -m ml.leakage_study
To train the model yourself:  python -m ml.train  (takes a few minutes).

The same steps are in README.md inside the ZIP, along with a troubleshooting table.

• 📁 Full source code — commented throughout, so you can explain it in the viva
• 🗄️ Database — the schema builds itself on first run, with sample data
• 📖 README.md — step-by-step run instructions, database design and troubleshooting
• 📄 Full project report (Word) — Written out and formatted for AKTU — not an outline you have to fill in
• 📊 Presentation (PPT) — Ready for the final viva presentation
• 📝 Synopsis (Word) — The short write-up your guide asks for before approval
• 🎓 IEEE format paper (Word) — For publication or when the department asks for a paper
• ❓ Viva questions with answers — The questions examiners actually ask about this project
• 📐 8 ready-made diagrams — DFD, ER, use case, sequence and architecture, as images you can paste straight into the report