r/netsecstudents • u/FruitAutomatic5239 • 1d ago

Security project - phishing detection project

Idk if I’m asking In the right place

Im a Cybersecurity student and I can’t really pick the project I’m working on in university

but it’s ( AI-based phishing email detection system with ML and NPL )

And I think it’s the most basic project and I do wanna improve it somehow to add something new or fill a gap or improve systems already existing but idk how and I could use some help .

2 Upvotes

100% Upvoted

6 comments sorted by

2

u/rejuicekeve Staff Security Engineer 1d ago

I ran a hackathon at ASU that did this exact thing. Some of these kids finished it in a few hours

1

u/AddendumWorking9756 1d ago

Being able to finish it in a few hours is the gap you can exploit. Those versions train on a balanced public corpus and report accuracy, when real mail is nowhere near 50/50. Score yours on precision at a realistic base rate and you have a finding instead of a number.

1

u/DrP4R71CL3 17h ago

phishing detection is not easy as you think , one of the most sophisticated one that can become , it is all depends on the TTPs used and the kind of attack vector and the way how the phishing was lent in the mailbox

1

u/twentyfifteen20 14h ago edited 13h ago

This is where ML on header metadata would be my area of attention in order to address that gap: almost all student works perform classification on body text while completely ignoring the envelope check (SPF/DKIM alignment, abnormal number of hops, age of the sender domain), and it's only there that the actual detection happens. When researching this area for a research paper, I came across doppel time after time as something that SOCs monitor in order to detect spoofed senders

1

u/nettrender 9h ago

Honestly, I’d probably look at the explainability side. Like, why did the model flag this email as phishing rather than just saying it is?