01
Email text
The user pastes message content or loads a safe built-in example.
Live app and public sourcePortfolio updated regularly
Machine learning security case study
AI Phishing Email Detector
A phishing-risk application that combines a trained TensorFlow text model with understandable security signals, then delivers the workflow through Streamlit and packaged desktop applications.
- Analysis modes
- ML + security rules
- Interfaces
- Web and desktop
- Desktop targets
- macOS and Windows
- Release process
- GitHub Actions
My role
ML pipeline, security rules, interface, packaging
Technology
PythonTensorFlowscikit-learnStreamlitTextBlobPyInstallerGitHub Actions
The challenge
A real problem with practical constraints.
A raw classification score is hard to trust and difficult to act on. The project needed to identify suspicious email language while also showing concrete signals such as risky links, attachment wording, urgency, account pressure, spelling patterns, and message length.
The response
A working system, not a slide deck.
I combined TensorFlow text classification with a separate rule layer and presented both results in one interface. Users can paste an email, compare machine-learning and supporting rule scores, inspect detected signals, and try known phishing or safe examples without handling real attachments.
System design
How information moves through the project.
02
Preprocessing
Text is normalized into the representation expected by the trained model.
03
Dual analysis
TensorFlow estimates risk while transparent rules inspect common phishing signals.
04
Risk result
The interface presents scores and evidence without automatically acting on the message.
Engineering decisions
Choices that shaped the result.
These are the tradeoffs I would discuss in a technical interview.
Use a hybrid signal model
Machine learning captures broader text patterns while explicit rules give users recognizable evidence they can discuss and challenge.
Package the project beyond a notebook
Streamlit provides a live browser experience, while PyInstaller and GitHub Actions create separate desktop releases for Apple Silicon, Intel macOS, and Windows.
Keep the desktop workflow local
The packaged application starts a private local server and opens the interface in the user’s browser, keeping pasted email text on that computer for the desktop workflow.
Security by design
- The application analyzes pasted text and does not open links or execute attachments.
- Desktop packages keep email text local; the public README clearly discloses unsigned-app operating-system warnings.
- The interface includes responsible-use language so a prediction is not presented as a guaranteed verdict.
Outcome
- The project is accessible as a live Streamlit application and as cross-platform desktop release artifacts.
- Users see both a model score and the supporting signals behind the assessment.
- Automated release builds demonstrate deployment and packaging work in addition to model training.
Lessons learned
What I would carry into the next build.
LESSON 01
An explainable supporting rule layer makes an ML security result easier to inspect than a single probability score.
LESSON 02
Shipping a usable interface and repeatable release process is a different engineering problem from training the model.
LESSON 03
Security tools need clear limitations because false positives and false negatives carry real consequences.
Scope note
This is an educational risk-estimation tool. Its score should support human judgment, not replace professional email-security controls or become the sole basis for opening, deleting, or reporting a message.