Back to projects

Selected project

Real-time Indonesian phishing detection in the browser.

PHISHNET scans URLs from the browser, checks them through a FastAPI inference service, warns users when a phishing page is detected, and collects feedback to correct false positives or false negatives.

Role
ML system and extension builder
Stack
Chrome extension, FastAPI, IndoBERT
Contribution
Detection UI, API, feedback, metrics
Outcome
0.9669 hybrid F1
PHISHNET warning banner and extension popup showing a phishing detection result
01

Built around Indonesian URL patterns

The dataset focuses on Indonesian phishing and benign URLs, including local brand impersonation, suspicious paths, tracking parameters, and official domains.

02

Combined language and structure

The model pipeline uses URL token representation together with typosquatting, edit distance, domain structure, entropy, path, query, and Indonesian phishing keyword features.

03

Served predictions through an API

A FastAPI backend exposes prediction, feedback, statistics, and health endpoints while handling whitelist rules, cache hits, and user correction overrides.

04

Turned detection into a user workflow

The Chrome extension auto-scans active tabs, shows a warning banner for phishing results, stores scan history, displays statistics, and lets users report mistakes.

Interface evidence

Readable screens from the detection workflow.

Wide browser captures are shown full-width, while compact extension popup screens keep their natural size so the UI remains legible.

PHISHNET warning banner on a detected phishing site with extension details
Detected phishing page with top warning banner, confidence score, attack type, edit distance, and feedback controls. Open full-size
PHISHNET extension showing a safe result on anthropic.com
Safe classification view showing confidence, edit distance, and model source on a legitimate website. Open full-size
PHISHNET extension showing a whitelisted Shopee URL as safe
Whitelist handling for official domains, reducing friction on trusted brand pages. Open full-size
PHISHNET extension history tab listing recent scan URLs and confidence values
History tab keeps recent scan results visible inside the extension popup. Open full-size
PHISHNET extension statistics tab showing total scans, phishing, safe results, whitelist, feedback, and cache hits
Statistics tab summarizes total scans, phishing detections, safe results, whitelist matches, feedback, and cache hits. Open full-size

Detection pipeline

From active tab URL to user warning.

  1. Auto-scanThe extension watches active tabs and sends scannable URLs to the API.
  2. Normalize URLThe backend canonicalizes the URL and checks feedback overrides.
  3. Apply safeguardsWhitelist, denylist, cache, and feature extraction run before inference.
  4. Classify riskThe model returns label, confidence, attack type, edit distance, and source.
  5. Warn or clearThe extension shows a banner for phishing or clears warnings for safe pages.