yhile-spam-lr-v1

yhile-spam-lr-v1

A logistic regression classifier that detects spam, phishing, and crypto scam messages (including giveaway scams, pig-butchering/investment scams, and wallet phishing). Built with scikit-learn using TF-IDF text features combined with hand-engineered structural and keyword features.

This README was written with AI assistance.

Model details

• Algorithm: Logistic Regression (scikit-learn)
• Features: TF-IDF word 1-2-grams (8,000 features) + character 3-5-grams (4,000 features), combined with engineered features covering URL structure, cryptocurrency wallet address detection (BTC/ETH/TRON), urgency/money keyword signals, crypto scam category keywords (giveaway, investment/pig- butchering, wallet phishing, sextortion), and a cautionary-language counter-signal to reduce false positives on legitimate financial discussion
• Format: saved with skops (not pickle) for safe loading
• License: MIT

Training data

Combined and deduplicated from three public datasets, plus a small handcrafted supplement:

Final combined dataset: ~41,000 rows (~59% ham / 41% spam) after HTML stripping, boilerplate removal, and deduplication.

Performance

Evaluated on a held-out 20% stratified test split (~8,235 rows):

• Accuracy: 97.1%
• ROC-AUC: 0.995
• Precision (spam): 96% · Recall (spam): 97%
• False positive rate: ~3.1–3.6% (legitimate messages misflagged as spam)

The classification threshold was tuned for ≥95% precision on the spam class rather than using the default 0.5 cutoff, to reduce false positives.

Usage

from skops.io import load, get_untrusted_types

untrusted = get_untrusted_types(file="yhile-spam-lr-v1.skops")
saved = load("yhile-spam-lr-v1.skops", trusted=untrusted)

model = saved["model"]
word_vectorizer = saved["word_vectorizer"]
char_vectorizer = saved["char_vectorizer"]
threshold = saved["threshold"]

# see train.py for the full extract_features() implementation used at
# both training and inference time — the two must stay in sync

The full training pipeline, feature engineering, and text cleaning code is included as train.py in this repository for transparency.

Limitations

• Base public datasets are from the 2000s–2010s; fluent, grammatically correct AI-generated scam text is underrepresented and relies on a small handcrafted supplement rather than a large real-world corpus
• ~3.6% false positive rate — legitimate marketing and transactional email can share vocabulary with spam and get misflagged
• Wallet address detection checks format only, not cryptographic checksum validity
• Scores a single message in isolation — no multi-turn conversation context and no email header/metadata analysis (sender reputation, SPF/DKIM)
• English only
• The precision/recall tradeoff is real: tuning for fewer false positives necessarily reduces recall on spam

Ethical note

The Enron-Spam dataset contains real people's private email correspondence, released publicly through legal proceedings rather than by consent of the individuals involved. It is included here as it is widely used for spam research, but this context is worth being aware of.

Attribution

If you use the SMS Spam Collection portion of this training data, please cite:

Almeida, T.A., Gómez Hidalgo, J.M., Yamakami, A. Contributions to the study of SMS Spam Filtering: New Collection and Results. 2011.