---

SafeLink Analyzer

Overview

SafeLink Analyzer is a lightweight, high-precision phishing detection tool built using XGBoost. It analyzes lexical and structural patterns in URLs to identify malicious links with strong performance and fast inference speeds. Tailored for cybersecurity workflows, it supports both CLI and API usage for seamless integration into enterprise systems and personal security audits.

Features

• URL-Based Threat Detection
  Identifies phishing attempts by analyzing domain structure, token patterns, and entropy measures.

• Fast Inference with XGBoost
  Delivers near-instant predictions using optimized gradient boosting trees.

• Explainability Support
  Optional SHAP integration for visualizing model decisions and feature importance.

• Flexible Interfaces
  Classify URLs individually or in bulk via CLI or REST API.

• Modular Design
  Customize feature logic, model parameters, and input pipelines easily.

Architecture

SafeLink Analyzer is built on a robust detection pipeline composed of:

• Feature Extraction — Transforms raw URLs into numerical vectors using lexical, structural, and statistical heuristics
• XGBoost Classifier — Trained for binary classification of phishing and safe URLs
• Prediction Engine — Supports real-time and batch inference modes
• Flask Interface — Lightweight API for deployment and integration
• Explainability Layer (Optional) — SHAP visualizations to interpret model decisions

Tech Stack

• XGBoost — Core ML model for phishing classification
• Scikit-learn — Utilities for preprocessing and evaluation
• Pandas — Batch input handling and feature pipelines
• Flask — REST API for real-time classification
• SHAP / Matplotlib — Interpretability and visualization of model output

Getting Started

Prerequisites

• Python 3.9+
• pip (Python package manager)
• 4GB+ RAM (recommended)

Installation

git clone https://github.com/yourusername/safelink-analyzer.git
cd safelink-analyzer
python -m venv venv
source venv/bin/activate   # On Windows: venv\Scripts\activate
pip install -r requirements.txt

Usage

• Classify Single URL
  Example:

  python classify_url.py --url "http://example.phishtracker.biz/login"

• Classify Batch URLs from CSV
  Example:

  python classify_batch.py --input data/urls.csv --output results.csv

• Run REST API
  Example:

  python app.py

  Then send a POST request to /predict with a JSON body:

  { "url": "http://malicious-site.biz/verify" }

Customization

• Tune Model Parameters
  Modify config/model_params.json for different classification behavior

• Extend Feature Logic
  Update features.py with new heuristics or indicators

• Retrain with Custom Data
  Example:

  python train_model.py --data data/my_dataset.csv

• Enable Explainability
  Use SHAP via explain_model.py for visual breakdown of predictions

License

Licensed under the MIT License. See the LICENSE file for details.

Acknowledgments

Built using XGBoost, Flask, and supporting Python ML libraries. Special thanks to the open-source cybersecurity community and dataset providers who contributed to phishing defense research.

---