Zero-Day Phishing Threat Intelligence Platform
Enterprise-grade automated threat intelligence platform combining a FastText NLP classifier, structured ML models, and algorithmic distance rules to identify deceptive URLs and brand spoofing for client security teams at NetSTAR Global.
Problem
Client security teams were drowning in zero-day phishing URLs. Attackers rotate domains faster than blocklist-based tools can react, and brand spoofing sites often evade signature detection entirely — forcing analysts to triage deceptive links by hand. NetSTAR needed a platform that could score a URL as a potential zero-day threat in near real time and feed that signal into a dashboard their security teams actually watched.
Approach
Built a hybrid detection architecture instead of betting on a single model: a FastText NLP classifier for URL semantics, structured ML models over hand-engineered features, and algorithmic distance rules to catch brand-spoofing variants.
Analyzed 1B+ phishing URLs with SQL to train and validate the ensemble (XGBoost, LightGBM, Random Forest, Logistic Regression) against real threat telemetry rather than synthetic samples.
Integrated the NetSTAR and PhishStats APIs so zero-day evaluations are dynamically enriched with fresh threat context instead of relying on a static corpus.
Orchestrated the whole platform in a containerized environment (Docker) so the pipeline and its Power BI telemetry layer deploy identically across client environments.
Quantized the FastText classifier to int8 (per-row scale) and shipped it as an edge endpoint (POST /api/classify), so the model itself is testable live from a browser — the demo on this page runs that exact artifact.
Outcome
~96%
Detection accuracy
on zero-day phishing threats with the ML ensemble (XGBoost, LightGBM, Random Forest, Logistic Regression)
1B+
URLs analyzed
phishing URLs processed through SQL pipelines to train models and drive live telemetry
Real-time
Response mode
containerized pipeline feeding a live Power BI dashboard for enterprise client security teams
Live Demo
The classifier below is the FastText model from this project, retrained from the NetSTAR-labeled URL corpus and quantized to int8 so it runs entirely on the edge. Type a URL — the verdict, confidence, and latency you see are computed live on this request.
Paste any URL — or pick an example — and hit Classify. The result comes from a FastText model retrained on the NetSTAR-labeled corpus and served from the edge.
Pipeline
Evaluation
The ~96% accuracy figure comes from evaluating the ensemble against held-out zero-day phishing samples during training. The strongest gains came from the hybrid combination: FastText caught semantically deceptive URLs that structured models missed, while distance rules closed the gap on domain typo-squatting that neither model was explicitly trained on. The live demo on this page runs the FastText component retrained from the same corpus and measured on the deployed artifact: 96.7% accuracy, 94.1% phishing recall, and 99.3% precision on a held-out 4,409-URL split (stratified by class, unseen during training). The int16 quantization that lets the model run on the edge costs nothing measurable in accuracy — you are interacting with the deployed artifact, not a screenshot of it. It is still a URL-text-only model: it sees structure and brand tokens, never page content, so treat edge cases as signals, not verdicts.
What I'd Do Differently
I would instrument the pipeline with explicit offline evaluation harnesses earlier. Accuracy on zero-day samples was measured retrospectively rather than continuously, which made it harder to prove which component contributed each gain. I would also push harder on explainability artifacts — security teams trust a verdict more when they can see the rule or feature that triggered it, and that would have shortened the path from detection to analyst action.
Tech Stack
Related Projects
Distributed Medallion Lakehouse integrating cross-ministry CSR, groundwater, and education datasets using Apache Spark and Iceberg for panel regression analysis of Indian state-level policy outcomes.
Led the team migration of Ericsson's Citrix virtual infrastructure — 2,000+ production servers — from on-prem to Google Cloud Platform, one of the company's largest public cloud modernization initiatives, with hardened hybrid security and automated database operations.
End-to-end ELT streaming pipeline that ingests real-time Twitch viewership data through Apache Kafka, warehouses in Snowflake, and transforms with dbt for Looker Studio dashboards.