Lion Cipher Lab
Detect phishing URLs with machine learning
- AI Security
- Beginner
- ~45 min
- Free · no account required
Why it matters
Most phishing links are caught, or missed, in the half-second before anyone loads the page, and the only thing you have in that half-second is the URL string itself. Learning to read that string as structure rather than as content is one of the highest-leverage skills in defensive security: the length, the pile of subdomains, an IP address where a brand name should be, an @ buried in the middle, a throwaway top-level domain, plain http instead of https. Teaching a model to weigh those signals is the cleanest possible introduction to feature engineering, the craft of turning messy real-world…
What you'll learn
- reading a URL as structure, not content
- feature engineering: turning a raw URL string into numbers a model can learn from
- naming the features that lean phishing (length, dots, subdomains, embedded IP, @ trick, hyphens, throwaway TLD, http vs https)
- writing your own reusable url_to_features function
- training a RandomForest (and knowing where a LogisticRegression would fit instead)
- reading accuracy, a confusion matrix, and per-class precision and recall
- explaining why a false negative -- a phishing link waved through -- is the dangerous error
- inspecting feature_importances_ to see which signals the model leaned on
- naming the real limits: attackers adapt, shorteners hide the URL, small and biased data misleads, and a model is a signal not a verdict
Steps in this lab
- Reading a link before it loads
- Install scikit-learn, offline after this
- Build your own labeled URL set
- Engineer the features from the URL string
- Train the detector
- Evaluate, and why a false negative is the dangerous one
- Inspect what the model leaned on
- The honest limits: adaptation, shorteners, and small data
- What you can now do that most people can't