An image of Chloe Coursey

Chloe Coursey

View by specialty:

🔒 Security

🧠 AI

🖥 Software Programming

View by section:

👤 About

🧩 Projects

🏢 Professional Experience

🎓 Education & Certifications

PhishGuard

See the GitHub here.

Phishing attacks are a major threat, with Statistica reporting that 85% of companies worldwide experienced phishing in 2022, with numbers rising quarterly. Traditional methods of detection are not keeping up with current spoofers as they begin exploiting generative AI for their personal gains. Studies show that current user awareness training is insufficient with anywhere from 23% – 65% of trained users still falling victim to phishing attacks1 2. This independent study leveraged generative AI to analyze email content, sender information, and website characteristics to identify phishing attacks.3

This tool specifically combines entity recognition, sentiment analysis, and custom NLP pipelines to detect phishing attempts. I trained the AI model using preprocessed datasets from open-source email corpora, cybersecurity firms, and anonymized user samples. I then further enhanced its accuracy by addressing class imbalance through targeted oversampling, cost-sensitive learning, and validation on real-world test sets.

Security:

  • Encryption methods and refresh tokens

High-Level Design:

Low-Level Design:

Note: generated by pyVerse

Implementation Details:

Classes directly related to identifying phishing attempts are in red.

  1. Owner

The owner class is the basic login and signup feature. An owner has a first name, a last name and a 4-6 character PIN that gets hashed and stored.

  1. Owner Manager

The owner manager stores the owner’s name, hashedPIN and a unique ID into an owner table in SQL. It is then linked to an instance of an account manager via a unique Account Manager ID

  1. Account

An account is considered an email account. Its fields include the associated owner’s ID, the email address for the account, and credentials such as the access token, refresh token, redirect URI, and client ID. Currently, these are stored in the accounts database without hashing. Later implementations of the project would add hashing as well as other security features to protect users.

  1. Account Manager

An instance of an account manager is linked to the accounts and owner databases via a unique ID. Account manager is used to store a user’s credentials so that when they try to access their account for a second time, they do not have to sign in from scratch. This class also keeps track of the user’s accounts so that two of the same accounts are not added.

  1. Email

The email class creates an object to represent an email. Fields include the full header as a string, a Sender, Recipient, subject as a string and the body as a string. (See below for details about Sender and Recipient.) By creating this class with the separate fields, it decreases the time needed to feed input into the AI models. Information about the specifics of these models and their functionalities is found in (U.) and (V.).

  1. Email Data

The Email Data class is used to store the information gained during AI analysis of the email. This class includes fields:

  • Sender_mismatch, which is a dictionary object of counts. Each instance of a count: name mismatch and organization mismatch, is the number of times a mismatch was found. (Further Described in U)
  • Grammar Check, which is a dictionary object of grammatical errors including whitespace errors, spelling errors, spacing errors, subject-verb agreement errors, and capitalization errors.
  • Sender_Info, which is a dictionary object that includes the classification of the sender’s email (Organizational, Personal, School), the domain of the sender’s email if the sender’s classification evaluated to organizational or school, the sender’s name that was indicated in the header, no reply (if the email is a no reply address), and the email address of the sender that was found in the header.
  • RE_mismatch which evaluates to true or false
  • Email, this is the email object actually being evaluated. This way a whole email data instance can be passed into a method and not require multiple parameters. This helps provide uniformity.
  1. Credential Reader

This class is used to read the credential files for Yahoo/AOL, Gmail, and Outlook. It creates an instance of Credentials (further described below) and provides the information for re-authentication and authentication.

  1. Credentials

Credentials is a class used by all services but GmailService as gmail provides their own API for retrieving credentials. The credentials object includes the following information: token uri, refresh token, access token, client ID, client secret, expiry, and redirect uri.

  1. Query

This class creates a query for the user’s selected choice of emails to scan. For example, if the user chooses to scan yesterday’s emails or emails from the past x number of days, it develops a query to feed into the email service’s email to retrieve these emails. This query is then saved into a database using query manager so that they can be retrieved later if need be.

  1. Query Manager

This class saves the query used to retrieve a certain array of message ids (unique identifiers for emails)

  1. Token Manager

The token manager class saves the expiry, refresh, and access tokens to a database to maintain ease of access and avoid writing and rewriting to files.

  1. GmailService

This class provides the functionality for connecting to a gmail account, reconnecting to a gmail account, and retrieving messages from an established gmail account.

  1. OutlookService

OutlookService provides the functionality for connecting and reconnecting to an outlook account as well as retrieving messages from an account.

  1. YahooService

Since AOL uses Yahoo’s API, Yahoo service also works with AOL connections. Like GmailService and Outlook Service this class provides the functionality for connecting and reconnecting to a Yahoo or AOL account as well as retrieving messages from a connected account.

  1. Database

This class is used to connect to an SQL database so that the information from TokenManager, AccountManager, OwnerManager, etc can be successfully stored and retrieved from an SQL database.

  1. User

This is a file that is not fully implemented but exists for future development. The idea is to provide a database for users to connect to so that they can send information back to the developers to improve the AI models and continue training.

  1. GUI

The GUI folder includes the following files:

  • Main:This class doesn’t provide any major GUI aspects but rather calls the GUI screens below
  • returnUser: This screen is called when someone signs in as a returning user and they currently have accounts they can reconnect to. This provides them a menu of their connected accounts to choose from and an option to connect to a new account
  • Menu: This screen provides the user with the option to choose from the four potential email services and redirects to the proper sign in screen.
  • Scan: this screen provides the user with the options for choosing which emails to scan: a certain number of emails, emails from a certain number of days, today’s emails, or yesterday’s emails.
  • Results: This screen is not completed but will show the emails and their results (probability that it is a phishing email)
  • Initialscreen: This screen is the first screen the user sees. It is the interface where a user either signs in or signs up.
  1. OAuthHandler

This class is used for the website connection to the email accounts. When the user is actually connecting with an email account, the sign in process is provided through the application. In order to accomplish this without using a direct browser redirection required using an OAuthHandler. This file returns the tokens provided by the authentication process (access and refresh tokens). These tokens are then stored in the database using TokenManager.

  1. Email Parser

This file parses the emails into readable formats for the AI. If the email has a “text/plain” type charset, then the email parser returns the body of the email in plaintext. If the charset is “text/HTML” the email parser translates the text into the equivalent plaintext format.

  1. Grammar Check

The grammar check class uses the LanguageTool AI API to check for grammar anomalies. I later developments, the extracted errors will then be run through another AI model to determine if the most relevant issues such as tense errors and awkward phrasing are found in abundance and use the context to weight the specific errors accordingly.

  1. Sender Analysis

This class uses the results from the email_class file as well as the sender_info dictionary from Email Data to determine the number of mismatches of sender information. It checks name mismatches in the header, body, and signature as well as organization mismatches in the body, signature, and domain of the email if the classification was organizational or school.

  1. Email Class

This class uses the email classification AI model to determine if a provided email address is an organizational (work), school, or personal email address. Confidence scores range from 77% to 99%.

  1. Analyze Email

This class provides the main functionality for the analysis of emails. It calls the AI models and provides an object that returns all the relevant information determined. This returned information is then fed into the probability class to weight and calculate the formal probability that the email is a phishing email. It uses the sentiment analysis model to determine if the email is neutral/benign, urgent/threatening, or suspicious/scam. Further implementations will check the subject line for “RE” when the email is not part of an email string.

  1. Image Check

This class uses Dr. Crume’s patented idea to use Google Search API to determine if an Image or Logo is close to the claimed organization’s logo but either has visual discrepancies or redirects to a dangerous website via its link.

  1. Link Analysis

This class checks open phish API and google safe browsing API to determine if an email is dangerous and returns the number of counts that both evaluated to true, the number of counts open phish API evaluated to true and google safe browsing did not, and the number of counts that google safe browsing API evaluated to true but open phish did not. Future development will check against a dictionary of shortened URLs as well as commonly spoofed companies and their proper links. This has been started but not finished.

  1. Probability

This class takes the information returned by the analyze email class and returns the percentage that an email is weighted based on predetermined weights.

  1. Threat_PII_Promise

This file uses an NER model to extract the following information: follow link requests, threatening/urgent language, personal information requests, and promises to the recipient or benefits promised to the user.

  1. https://www.sciencedirect.com/science/article/pii/S0167404823006053?via%3Dihub ↩︎
  2. https://pmc.ncbi.nlm.nih.gov/articles/PMC6515532/ ↩︎
  3. https://parachute.cloud/cyber-attack-statistics-data-and-trends/ ↩︎

Contact Information

chloecoursey030@gmail.com