Completed Case Study · 2026
AI Phishing Email Analyzer
A defensive email-analysis application that combines transparent Python detection rules with optional local-AI explanations while keeping scoring, evidence, URL counts, and analyst validation outside the generative model.
Objective
Build an explainable phishing-analysis workflow that accepts sanitized email content, extracts sender and URL evidence, assigns a transparent risk score, and produces findings suitable for analyst review.
Architecture
analyzer.py controls parsing, indicators, scoring, and classification. ai_explainer.py constrains the local Ollama model to potential-impact wording. app.py provides the Streamlit interface and downloadable JSON report.
Detection coverage
The engine checks suspicious language, multiline sender headers, sender-domain mismatches, Microsoft and HMRC impersonation, insecure HTTP, IP-based links, shorteners, punycode, and dangerous file extensions.
Evidence-led correction
Initial testing exposed three false negatives. Detection Engine v2 added expanded social-engineering phrases, corrected header parsing, sender-domain extraction, and brand-domain validation. HMRC, password-expiration, and Outlook-reactivation simulations were then classified High.
Why rule-based detection and AI were separated
A language model does not make the security decision because its output can be inconsistent. Python controls the evidence, score, classification, and URL count. The local AI is restricted to explaining possible impact. If its response times out, contains unsupported claims, or produces malformed wording, the application rejects it and displays a deterministic fallback.
Testing
The final suite contains seven analyzer tests and six AI-quality tests. All 13 tests passed locally and from a fresh clone. Detection Engine v2 classified the HMRC refund simulation High at 68/100, Microsoft password expiration High at 88/100, and Outlook account reactivation High at 70/100.
Privacy and safety
Testing uses sanitized content and reserved .test domains. URLs are extracted as text and are not visited. Raw email content is excluded from the downloadable JSON report.
Outcome
The completed project demonstrates Python application development, phishing analysis, regression testing, local-AI integration, guardrail design, privacy-aware reporting, Git/GitHub workflow, documentation, and reproducible validation.