Privacy-Preserving Phishing Detection Browser Extension
A browser extension that warns everyday users about likely phishing pages, such as fake bank and wallet logins, using features computed on the device so browsing history never leaves the browser. A security and machine learning final year project where the privacy constraint and the false positive rate shape every decision.
Intermediate
A small team, or one strong student willing to learn something new.1 semester · 2 students
6 to ship
3 optional extrasSuggested stack
What you should ship
- Feature extraction in the browser from URL structure, domain, page content, form targets and password fields
- A classifier trained on public phishing and legitimate datasets, small enough to run client-side, with the export pipeline documented
- A warning page that explains which signals triggered it (for example, a login form posting to a different domain) instead of a bare score
- A local allow list, a "report a mistake" path that sends no browsing history, and a settings page
- Evaluation on a held-out set and on a fresh set of recently reported phishing URLs, with the false positive rate reported first
- A performance budget: added page load time measured on 50 popular sites
If you have time left
- Visual similarity against a small set of known login pages to catch brand impersonation
- Signed model updates downloaded periodically without sending any user data
- A Firefox build from the same codebase
The problem: phishing pages are cheap and users have no reliable signal
A convincing copy of a bank, wallet, university portal or email login page takes minutes to make. Links arrive by SMS, messaging apps and email, and the page often goes live hours before any blocklist knows about it. Everyday users, parents, small office staff and students have no reliable way to tell the difference.
Most browser protection relies on reputation: lists of known bad URLs. That works for known pages and misses new ones, and the most accurate forms of real-time checking mean sending information about the pages you visit to a service.
What already exists and the gap
- Google Safe Browsing protects Chrome and other browsers; its standard mode checks hashed URL prefixes against locally stored lists and asks Google only about partial matches, while enhanced protection sends more data for real-time checks.
- Microsoft Defender SmartScreen provides reputation-based warnings in Edge and Windows.
- Netcraft's extension blocks known phishing sites using its reporting network.
- PhishTank and OpenPhish publish feeds of reported phishing URLs.
These are strong for known sites. The gap is a detector that can judge a page nobody has reported yet, using only what the browser can see, without sending history anywhere, and that explains its reasoning so users learn. That is a defensible, useful research question for an FYP.
What you build
- Everyday user: installs the extension, browses normally, sees a clear warning with reasons when a page looks like phishing, and can proceed or report a mistake.
- Power user or IT admin: manages an allow list and sensitivity setting.
- Model maintainer (you): retrains offline on public data and ships a new model file with an extension update.
The technically interesting part
Working only from local features. No history leaves the device, which rules out the easy approach of a lookup service. You work from what you can compute: URL length and structure, suspicious tokens, how the domain compares to well-known brands, whether the page asks for a password, where the form submits, how many resources load from other domains, and hidden or obfuscated elements. Engineering these features reliably across messy real pages is most of the work.
False positives are the primary metric. A tool that warns on legitimate sites gets uninstalled the same day and teaches users to click through warnings. Report the false positive rate on popular legitimate sites first, then detection rate.
Explanations. "This page asks for your password, and the form sends it to a different domain from the one in the address bar" both justifies the warning and teaches the user. It also makes the extension defensible when it is wrong.
How to evaluate it
- Held-out test: precision, recall and false positive rate on a held-out split of public datasets.
- Freshness test: collect newly reported phishing URLs over two weeks (screenshots and features only, handled carefully) and measure detection on pages the training data never saw.
- Legitimate sites: false positives on at least 200 popular legitimate sites, including local banks and universities.
- Performance: added page load and CPU time.
- Users: 8 or more participants rate whether warnings are understandable.
Suggested plan
- Weeks 1 to 2: datasets, feature list, ethics for handling live phishing URLs.
- Weeks 3 to 5: feature extraction in Python, first model, offline evaluation.
- Weeks 6 to 8: port features to TypeScript, export the model, extension skeleton.
- Weeks 9 to 11: warning page with explanations, allow list, reporting.
- Weeks 12 to 15: freshness test, performance, user study, report.
Path to a product
The first customers are organisations whose staff are phished often and who care about privacy: banks' own customers, universities and small companies without a security team. A free extension for individuals and a managed version with central policy for organisations is a realistic model. Publishing to the Chrome Web Store is itself good evidence for your portfolio.
Scope warning
Detection and warning only. Do not build enterprise reporting, email scanning or blocking of downloads. Be careful handling live phishing URLs: use a separate browser profile or VM and never enter real credentials.
Learn what you need on Sefism
- Machine learning roadmap : features, classifiers and evaluation for the detector.
- Machine learning cheat sheet : precision, recall and threshold tuning.
- Chrome DevTools Documentation : debugging extensions and measuring performance.
- Kaggle Datasets : public phishing URL datasets to start from.
- Where to start in cybersecurity or IT operations : where this project fits in a security career.
Get help with this idea
The two decisions that shape this project are which features you can compute locally and how you will measure false positives. Tauseef can help you choose datasets, plan the evaluation, and keep the extension small enough to finish. If you are new here, create a free account first.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.