GLiNER PII & Cyber Phishing Detection

The internship centred on named-entity recognition for cybersecurity: I fine-tuned the GLiNER model (a DeBERTa-v3-base backbone) with LoRA on a filtered subset of the Gretel PII Masking dataset for PII extraction, benchmarking it against BERT-BiLSTM-CRF and spaCy baselines.

I then extended the model into a full, explainable phishing detection system: because GLiNER predicts entity types zero-shot, new cyber-threat labels — impersonated brands, urgency phrases, credential-harvesting cues — could be added at inference time without any retraining.

An incoming email flows through five stages:

1. Email parsing. Each incoming .eml file is parsed into headers, body, and attachments, with header forensics built in: reply-to mismatch, display-name spoofing, and SPF/DKIM/DMARC failure detection.
2. Entity extraction. The fine-tuned GLiNER model extracts entities zero-shot — suspicious URLs, IPs, impersonated brands, urgency phrases, credential-harvesting cues, malware names, crypto addresses — backed by a regex safety net for machine-readable patterns like IPs, URLs, and file hashes.
3. Threat-intel enrichment. Extracted indicators are checked against VirusTotal and AbuseIPDB, and domain age is looked up via WHOIS (newly registered domains are a strong phishing signal). Without API keys the pipeline runs in stub mode.
4. Risk scoring. Every signal contributes a weighted score to a composite risk value, mapped to LOW / MEDIUM / HIGH / CRITICAL bands — and every point is attributed to a specific entity with a human-readable reason.
5. Dashboard. A Streamlit dashboard ranks the email queue by risk, highlights extracted entities inline, and shows a per-indicator score breakdown.

The zero-shot entity labels cover the vocabulary of a phishing email:

Each signal contributes a weighted score, and the total maps to an action band:

Every point is traceable to a specific indicator, so an analyst can see exactly why an email was flagged:

Risk score: 95 (CRITICAL). The following 7 indicator(s) were found:

  [HEADER    ] + 25  Reply-To domain 'attacker.xyz' differs from From domain 'paypal.com'
  [HEADER    ] + 20  Display name contains 'support@paypal.com' but actual sender is 'phisher@evil.ru'
  [HEADER    ] + 20  DMARC policy check failed (DMARC=fail)
  [ENRICHMENT] + 45  VirusTotal: 14/72 engines flagged as malicious
  [NER       ] + 30  Credential-harvesting language: "verify your account"
  [NER       ] + 25  Brand impersonation detected: "PayPal"
  [NER       ] + 10  Urgency language detected: "act now"

The system was exercised against 7,911 real phishing emails from the phishing_pot corpus, spanning brand impersonation, credential harvesting, malware delivery, and cryptocurrency scams in multiple languages. Since the corpus is entirely phishing, a well-calibrated scorer should push the bulk of the distribution into the HIGH and CRITICAL bands:

Reading the graph: 6,609 emails (83.5%) score in the HIGH or CRITICAL bands — they would be quarantined or blocked outright. The remaining 16.5% below the quarantine threshold are not a flaw in the chart but a property of real phishing data. The corpus is historical, so much of its malicious infrastructure is already taken down: VirusTotal and AbuseIPDB return nothing for dead URLs and IPs, and the strongest enrichment signals (+45/+50 points) never fire. Other misses come from non-English emails, where urgency and credential-harvesting phrasing is harder for the NER layer to catch; image-only phishing, which leaves a text-based extractor nearly blind; and well-forged headers that pass DMARC with no reply-to mismatch. A scorer that claimed 100% of the corpus as CRITICAL would be a red flag, not a result.

NER model:

GLiNER on a microsoft/deberta-v3-base backbone

Training data:

Gretel PII Masking EN v1 (synthetic)

Threat intel:

VirusTotal v3, AbuseIPDB v2, python-whois

Dashboard:

Streamlit