README.md

metadata

title: Desant Phishing Detection
emoji: 🛡️
colorFrom: red
colorTo: green
sdk: gradio
sdk_version: 5.50.0
python_version: '3.10'
app_file: app.py
pinned: true
license: mit
short_description: CLIP-based phishing screenshot classifier by Desant.ai
tags:
  - image-classification
  - clip
  - openclip
  - phishing-detection
  - cybersecurity
  - security

Erna Phishing Detection.

AI-powered phishing detection using CLIP vision models — by Desant.ai

What it does

Upload a screenshot of any web page and our deep learning model will classify it as safe or malicious (phishing). The model was trained on thousands of real phishing and legitimate login page screenshots.

How it works

1. You upload a screenshot (PNG, JPEG) of a web page.
2. Our CLIP-based model extracts visual features from the screenshot using a frozen OpenCLIP vision encoder (ViT-B/32).
3. A custom classifier head (3-layer MLP with dropout) produces a phishing probability score.
4. The verdict is returned: SAFE or MALICIOUS, with a confidence score and detailed timing metrics.

Model Architecture

Input Image (screenshot)
    │
    ▼
┌─────────────────────────┐
│   OpenCLIP ViT-B/32     │  ← Frozen pre-trained encoder
│   Vision Encoder        │
└────────┬────────────────┘
         │ 512-dim features
         ▼
┌─────────────────────────┐
│   Classifier Head       │
│   Dropout(0.5)          │
│   Linear(512 → 512)     │
│   ReLU                  │
│   Dropout(0.3)          │
│   Linear(512 → 128)     │
│   ReLU                  │
│   Dropout(0.2)          │
│   Linear(128 → 2)       │  ← [safe, malicious]
└────────┬────────────────┘
         │
         ▼
    Softmax → Probability

Training Data

• Malicious class: Real phishing login form screenshots collected from PhishTank, OpenPhish, URLhaus, and AlienVault OTX
• Safe class: Legitimate login pages, search engines, and normal web pages
• Resolution: 1920×941 screenshots, preprocessed to 224×224 for CLIP
• Augmentation: Horizontal flip + color jitter

Performance

Metric	Score
Accuracy	92–96%
Malicious Recall	90–95%
False Positive Rate	3–8%

API

This Space connects to the Erna inference API at api.ernacyberops.com running on GPU. No local model loading is required — inference happens on our servers.

Built by

Desant.ai — Advanced cybersecurity through AI.