Model Card for OmniPhish-Ensemble
OmniPhish is a Tri-Modal Stacking Ensemble designed to detect highly evasive, zero-day phishing websites. It mathematically outperforms traditional machine learning baselines by fusing Deep Semantic representations with Structural Sequence modeling and explicit heuristic feature extraction.
This modelcard aims to be a base template for new models. It has been generated using this raw template.
Model Details
Model Description
OmniPhish processes live web pages through three distinct modalities to catch advanced phishing kits that evade standard visual (e.g., logo matching) or simple text-based detection systems. It utilizes a Semantic Engine (CodeBERT fine-tuned via LoRA) to analyze underlying JavaScript logic, a Structural Engine (1D-CNN or GNN) to process the raw HTML DOM sequence, and a Meta-Classifier (XGBoost) to fuse these latent spaces into a final zero-day classification.
- Developed by: Sulaiman Eksambi
- Model type: Stacking Ensemble (CodeBERT + 1D-CNN/GNN + XGBoost)
- Language(s) (NLP): English (as well as HTML and JavaScript semantics)
- License: MIT
- Finetuned from model: microsoft/codebert-base
Model Sources
- Repository: https://github.com/sulaimanxmb/OmniPhish-Ensemble
- Demo: https://huggingface.co/spaces/XMB480/Omniphish
Uses
Direct Use
The model is intended to be used by cybersecurity researchers, threat intelligence analysts, and enterprise security teams to evaluate suspicious URLs in real-time. It takes a raw URL, renders the JavaScript via a headless browser, and classifies the resulting DOM structure as Safe or Phishing.
Downstream Use
The latent embeddings generated by the CodeBERT and CNN/GNN layers can be extracted and used as high-fidelity features for downstream enterprise SIEM (Security Information and Event Management) platforms or custom web application firewalls (WAFs).
Out-of-Scope Use
This model evaluates the structure and semantics of the rendered DOM. It is not designed to evaluate network-level IOCs (Indicators of Compromise) such as IP reputation, DNS sinkholes, or raw TLS certificate authority validity on its own.
Bias, Risks, and Limitations
Because the model looks for highly complex DOM structures and obfuscated JavaScript to identify sophisticated phishing kits, it may occasionally flag legitimate, highly complex enterprise Single Page Applications (SPAs) that utilize heavy anti-bot obfuscation as false positives.
Recommendations
Users should implement a safelist/allowlist for known, highly trafficked enterprise domains (e.g., standard login portals for major tech companies) to prevent expected false positives caused by proprietary obfuscation techniques triggering the AI's heuristic thresholds.
How to Get Started with the Model
Use the Hugging Face Space Live Inference Engine linked in the Demo section for immediate interactive testing. For programmatic use, clone the GitHub repository and execute the master pipeline script:
python run_pipeline.py