Phishing is one of the most common and effective cyber-attacks, with email being the main method used to deliver malicious links to users. These attacks often rely on deceptive URLs that appear legitimate but redirect users to fake websites designed to steal information. While spam filters exist and blacklist based systems can block known threats, they are less effective against new phishing URLs and often provide little explanation for why a message is flagged.

My project investigates the automated detection of phishing emails using publicly available datasets, with a particular focus on malicious URLs embedded within email messages. Python-based techniques are used to process email content, extract URL-level characteristics and classify messages as phishing or legitimate. Rather than relying on manual inspection, the project evaluates how different automated detection techniques can identify suspicious behaviour in emails.

A key focus of the project is explainability. Many phishing detection systems operate as black boxes, producing a decision without clearly stating the reasons behind it. To address this, the project identifies and reports clear indicators that contribute to an email being classified as suspicious. These may include abnormal URL structures, the use of shortened or redirected links or urgency related language commonly found in phishing messages. The aim is to make phishing detection behaviour easier to analyse.

My system experiments will be implemented using Python, with scripts developed to extract relevant URL-based features from real world email datasets. My project addresses a security problem that is highly relevant to modern cybersecurity and digital forensics.