SafeBrowse is a full-stack hybrid machine learning application for phishing and malicious URL detection. Seven independently trained models power its classification: six classical statistical classifiers (Random Forest, XGBoost, Logistic Regression, Decision Tree, SVM, Naive Bayes) trained on lexical URL features from a ~651,000-row public dataset, and a hybrid model, DeepTrace, combining a fine-tuned BERT encoder, 20 handcrafted lexical features, and a further signal from an XGBoost model's internal leaf structure, all fused and classified by a Random Forest for the final verdict and confidence score.
Key features
- Real-time URL classification with confidence score and human-readable reasoning
- Choice of a recommended hybrid "Default" model or six selectable "Experiment" statistical models, for direct side-by-side comparison
- Fast reputation allowlist checked ahead of any model inference
- Optional accounts (JWT auth) with full guest access always available, no login required for the core workflow
- Per-user history and dashboard with summary statistics
- Minimal admin API for monitoring registered users
- Deployed via CI/CD (GitHub → Render), with a shared, model-agnostic explanation layer across every classifier
Six independently trained statistical classifiers, Random Forest, XGBoost, Logistic Regression, Decision Tree, SVM, and Naive Bayes, were trained on lexical URL features extracted from a ~651,000-row public dataset (benign, phishing, malware, and defacement, collapsed to binary Safe/Unsafe). The best individual performers were XGBoost (83.7% accuracy) and Random Forest (82.4%).
The hybrid model, DeepTrace, combines a fine-tuned BERT encoder producing a 768-dimensional embedding of the raw URL, 20 handcrafted lexical features (length, entropy, keyword presence, and similar signals), and a further 150-dimensional signal extracted from an XGBoost model's internal leaf-index output rather than its predictions. These are concatenated into a 938-dimensional vector and classified by a Random Forest to produce the final verdict and confidence score.
Several limitations are disclosed directly to users rather than hidden: the hybrid model's BERT weights (~440MB) exceed free-hosting memory limits, so the live deployment transparently falls back to a statistical model when unavailable; lexical-features-only statistical models plateau around 80–84% accuracy and can disagree on adversarial inputs like typosquatted domains; collapsing phishing, malware, and defacement into a single label was found, via feature-importance analysis, to dilute phishing-specific signal; and confidence scores reflect performance on a class-balanced evaluation set rather than real-world URL prevalence.
Building SafeBrowse surfaced real engineering problems, each traced to a root cause: a data-leakage bug where models learned a URL-scheme formatting artefact instead of genuine phishing signal, fixed by normalising URLs before feature extraction; a compound-TLD bug (e.g. .com.au) in the reputation allowlist, root-caused via embedding inspection and per-tree vote analysis; and two separate environment-parity incidents caused by scikit-learn version drift between training and serving environments, resolved by pinning exact package versions.
Stack: React, Vite, Tailwind CSS · Python, FastAPI, Uvicorn · SQLAlchemy ORM (SQLite dev / MySQL-ready) · bcrypt + JWT auth · scikit-learn, XGBoost · PyTorch, Hugging Face Transformers · Render (CI/CD from GitHub)
My role
I designed and built the full application solo, frontend, backend, database, and authentication, trained and integrated all seven classification models (including DeepTrace, the hybrid model from my Master's research), and diagnosed and fixed each of the engineering issues described above.