PhishGuard
catches what
filters miss.
A Chrome extension that runs a three-stage AI pipeline inside Gmail — rule-based signal extraction, real-time brand-policy retrieval, and local LLM reasoning — to detect Business Email Compromise attacks that score zero on traditional filters.
View Project DocumentsThe three-layer pipeline
Filters tell you what was detected. The AI tells you why it's dangerous — using the company's own published policies as evidence.
Signal Extraction
The rule engine scores emails across five weighted categories — urgency language, invoice keywords, bank account change requests, credential phishing cues, and domain anomalies. WHOIS queries flag freshly-registered or freemail sender domains. Output: a structured signal set and a risk level (LOW / MEDIUM / HIGH / CRITICAL).
Policy Retrieval
When a brand is detected, SerpAPI fetches real fraud-warning and payment-policy pages from that brand's actual domain — not the spoofed one. An earlier version searched the fraud domain itself and returned nothing useful. The fix: always look up paypal.com, not paypal-secure-verify.net. Results are shown to the user as clickable evidence cards.
LLM Reasoning
Llama 3.2 3B runs locally via Ollama — no email content ever leaves the device. The model receives the extracted signals and policy snippets, then returns a plain-English verdict explaining what the attack is trying to do, with three recommended actions. The pre-computed risk level is deliberately withheld from the prompt to stop the model echoing the filter.
The toggle makes the difference visible
Same email. Two layers. Flip it to see what changes.
- Urgent payment request detected
- Mismatched sender domain
- Invoice keyword match
- Domain registered 12 days ago
No interpretation. The filter found patterns — it doesn't know what they mean together.
Project documents
Background Research
BEC, rule-based vs. ML detection, and LLM applications in phishing detection. Literature foundation for the project.
Project Spec
System requirements, component design, and technical implementation details. The formal specification document.
Final Report
Full project report covering system design, implementation, evaluation, setup guide, and AI usage declaration.