Upload folder using huggingface_hub

README.md

@@ -0,0 +1,32 @@
+---
+library_name: xgboost
+tags:
+- fraud-detection
+- phishing
+- xgboost
+- nexus
+license: mit
+---
+
+# NEXUS Fraud Detection — model artifacts
+
+Trained heads for [NEXUS Fraud Detection](https://github.com/Deepnar/NEXUS-Fraud-Detection)
+(forked from [Rishit1769/NEXUS-Fraud-Detection](https://github.com/Rishit1769/NEXUS-Fraud-Detection)).
+Each folder is a drop-in `ml/artifacts/<task>/<version>/` directory: copy it into the
+repo's `ml/artifacts/` (or point `MODEL_ARTIFACT_ROOT` at this repo) and the
+FastAPI model service (`ml/service.py`) picks it up with no code changes.
+
+| Head | Folder | Model | Unseen-data result |
+|---|---|---|---|
+| Transaction fraud (XGBoost + isotonic, Optuna-tuned) | `transaction/` | `model.json` + `calibration_model.joblib` | Fresh-seed PR-AUC 0.689; future-years slice 0.847 |
+| Message phishing (TF-IDF char+word + lexical, XGB) | `message-tfidf/` | `model.json` + `vectorizer.joblib` | 18/18 hand-crafted probes |
+| Message count baseline (XGB, fallback) | `message/` | `model.json` | advisory-only fallback |
+| URL phishing (lexical XGB) | `url/` | `model.json` | 19/20 probes |
+
+`eval_unseen.json` is the full unseen-data ledger. Per-head `metrics.json`,
+`thresholds.json` (recall>=0.80 operating points), `feature_manifest.json`,
+`split_manifest.json`, and `training_manifest.json` document provenance.
+
+**Note:** deterministic rules stay authoritative in NEXUS — these heads are
+advisory and never override a critical rule. Transaction data is synthetic
+(IBM); retrain on real adjudicated cases before production use.

eval_unseen.json

@@ -0,0 +1,327 @@
+{
+  "created_at": "2026-09-23T18:02:04.813737+00:00",
+  "transaction_fresh": {
+    "artifact": "20260923T173528Z",
+    "n": 200000,
+    "seed": 123,
+    "fraud": 244,
+    "raw": {
+      "threshold": 0.5,
+      "precision": 0.4940828402366864,
+      "recall": 0.6844262295081968,
+      "f1": 0.5738831615120275,
+      "confusion_matrix": [
+        [
+          199585,
+          171
+        ],
+        [
+          77,
+          167
+        ]
+      ],
+      "pr_auc": 0.6889825876513987,
+      "roc_auc": 0.9883624004892526
+    },
+    "calibrated": {
+      "threshold": 0.5,
+      "precision": 0.7311320754716981,
+      "recall": 0.6352459016393442,
+      "f1": 0.6798245614035089,
+      "confusion_matrix": [
+        [
+          199699,
+          57
+        ],
+        [
+          89,
+          155
+        ]
+      ],
+      "pr_auc": 0.619499090899653,
+      "roc_auc": 0.8279988471180743
+    },
+    "op_recall80_raw": {
+      "mode": "recall>=0.8",
+      "threshold": 0.1666218638420105,
+      "precision": 0.15030674846625766,
+      "recall": 0.8032786885245902,
+      "f1": 0.2532299741602067,
+      "max_f1": 0.6984924623115578,
+      "max_f1_threshold": 0.8513908982276917,
+      "pr_auc": 0.6889825876513987
+    },
+    "future_2015+": {
+      "n": 73031,
+      "fraud": 95,
+      "raw": {
+        "threshold": 0.5,
+        "precision": 0.5785714285714286,
+        "recall": 0.8526315789473684,
+        "f1": 0.6893617021276596,
+        "confusion_matrix": [
+          [
+            72877,
+            59
+          ],
+          [
+            14,
+            81
+          ]
+        ],
+        "pr_auc": 0.8467382384273724,
+        "roc_auc": 0.998987432384845
+      },
+      "calibrated": {
+        "threshold": 0.5,
+        "precision": 0.7623762376237624,
+        "recall": 0.8105263157894737,
+        "f1": 0.7857142857142857,
+        "confusion_matrix": [
+          [
+            72912,
+            24
+          ],
+          [
+            18,
+            77
+          ]
+        ],
+        "pr_auc": 0.7654057891294648,
+        "roc_auc": 0.911895937606438
+      }
+    }
+  },
+  "url_probes": [
+    {
+      "url": "http://192.168.1.1/verify-login",
+      "expected": 1,
+      "p": 0.9995,
+      "correct": true
+    },
+    {
+      "url": "http://10.0.0.5/secure/update",
+      "expected": 1,
+      "p": 0.9996,
+      "correct": true
+    },
+    {
+      "url": "https://hdfc-bank-verify.tk/login",
+      "expected": 1,
+      "p": 0.9013,
+      "correct": true
+    },
+    {
+      "url": "https://xn--sbi-bank.com/login",
+      "expected": 1,
+      "p": 0.9062,
+      "correct": true
+    },
+    {
+      "url": "https://amaz0n-gift-winner.ml/claim-prize",
+      "expected": 1,
+      "p": 0.7169,
+      "correct": true
+    },
+    {
+      "url": "http://bit.ly/3xK9mQ2",
+      "expected": 1,
+      "p": 0.9998,
+      "correct": true
+    },
+    {
+      "url": "https://support-microsoft.tk/verify?user=admin@x",
+      "expected": 1,
+      "p": 0.4697,
+      "correct": false
+    },
+    {
+      "url": "https://login form.ga/secure@phish.com",
+      "expected": 1,
+      "p": 0.9955,
+      "correct": true
+    },
+    {
+      "url": "https://paytm-kyc-update%bank.com",
+      "expected": 1,
+      "p": 0.9991,
+      "correct": true
+    },
+    {
+      "url": "http://sbi--online.surge.sh/login",
+      "expected": 1,
+      "p": 0.9997,
+      "correct": true
+    },
+    {
+      "url": "https://income-tax-refund-goi.ml/claim",
+      "expected": 1,
+      "p": 0.8181,
+      "correct": true
+    },
+    {
+      "url": "https://flipkart-big-billion-day.ga/winner",
+      "expected": 1,
+      "p": 0.7265,
+      "correct": true
+    },
+    {
+      "url": "https://www.google.com/search?q=hello",
+      "expected": 0,
+      "p": 0.0386,
+      "correct": true
+    },
+    {
+      "url": "https://github.com/anomalyco/opencode",
+      "expected": 0,
+      "p": 0.1533,
+      "correct": true
+    },
+    {
+      "url": "https://www.hdfcbank.com/personal/payments",
+      "expected": 0,
+      "p": 0.1051,
+      "correct": true
+    },
+    {
+      "url": "https://en.wikipedia.org/wiki/Phishing",
+      "expected": 0,
+      "p": 0.1002,
+      "correct": true
+    },
+    {
+      "url": "https://www.amazon.in/gp/your-account/order-history",
+      "expected": 0,
+      "p": 0.0989,
+      "correct": true
+    },
+    {
+      "url": "https://stackoverflow.com/questions/12345",
+      "expected": 0,
+      "p": 0.0924,
+      "correct": true
+    },
+    {
+      "url": "https://www.rbi.org.in/Scripts/FAQView.aspx",
+      "expected": 0,
+      "p": 0.3015,
+      "correct": true
+    },
+    {
+      "url": "https://mail.google.com/mail/u/0/#inbox",
+      "expected": 0,
+      "p": 0.0762,
+      "correct": true
+    }
+  ],
+  "message_probes": [
+    {
+      "text": "URGENT: Your HDFC account will be BLOCKED in 2 hours. Share your OTP now to veri",
+      "expected": 1,
+      "p": 0.9827,
+      "correct": true
+    },
+    {
+      "text": "Dear customer your SBI netbanking password expired. Login immediately at https:/",
+      "expected": 1,
+      "p": 0.8327,
+      "correct": true
+    },
+    {
+      "text": "Congratulations! You won a Rs.50000 Flipkart gift voucher. Claim FREE prize now,",
+      "expected": 1,
+      "p": 0.9979,
+      "correct": true
+    },
+    {
+      "text": "Income Tax Dept: you have a refund of Rs.18,450. Share bank details + OTP confid",
+      "expected": 1,
+      "p": 0.9764,
+      "correct": true
+    },
+    {
+      "text": "Your parcel is held at customs. Pay Rs.250 fee via UPI and share screenshot, do ",
+      "expected": 1,
+      "p": 0.9179,
+      "correct": true
+    },
+    {
+      "text": "Hi mom this is my new number, I lost my phone. Please transfer Rs.20000 urgently",
+      "expected": 1,
+      "p": 0.9464,
+      "correct": true
+    },
+    {
+      "text": "KYC expired! Your Paytm wallet will be suspended today. Install this APK to veri",
+      "expected": 1,
+      "p": 0.9089,
+      "correct": true
+    },
+    {
+      "text": "Bank manager here, share the OTP you just received to stop the fraudulent transa",
+      "expected": 1,
+      "p": 0.9421,
+      "correct": true
+    },
+    {
+      "text": "Part-time job offer: earn Rs.5000/day from home, pay Rs.500 registration fee fir",
+      "expected": 1,
+      "p": 0.9627,
+      "correct": true
+    },
+    {
+      "text": "Your electricity bill is overdue, connection cut tonight. Call now and share car",
+      "expected": 1,
+      "p": 0.9249,
+      "correct": true
+    },
+    {
+      "text": "Hey, are we still on for lunch tomorrow? Let me know what time works for you",
+      "expected": 0,
+      "p": 0.0007,
+      "correct": true
+    },
+    {
+      "text": "Your OTP for Swiggy login is 482913. Do not share it with anyone.",
+      "expected": 0,
+      "p": 0.0043,
+      "correct": true
+    },
+    {
+      "text": "Meeting moved to 3pm in conference room B. Agenda attached in the calendar invit",
+      "expected": 0,
+      "p": 0.0358,
+      "correct": true
+    },
+    {
+      "text": "Happy birthday! Hope you have a wonderful day. Dinner at our place on Sunday?",
+      "expected": 0,
+      "p": 0.0099,
+      "correct": true
+    },
+    {
+      "text": "Your Amazon order #402-1234567 has shipped and will arrive Thursday. Track in th",
+      "expected": 0,
+      "p": 0.0339,
+      "correct": true
+    },
+    {
+      "text": "Reminder: dentist appointment tomorrow at 10am. Reply YES to confirm.",
+      "expected": 0,
+      "p": 0.0464,
+      "correct": true
+    },
+    {
+      "text": "The bill for dinner was Rs.2400, your share is Rs.800. UPI me when free, no rush",
+      "expected": 0,
+      "p": 0.1077,
+      "correct": true
+    },
+    {
+      "text": "Photos from the trek are uploaded, check the shared album when you get time!",
+      "expected": 0,
+      "p": 0.0112,
+      "correct": true
+    }
+  ]
+}

message-tfidf/feature_manifest.json

@@ -0,0 +1,24 @@
+{
+  "feature_version": "message-tfidf-1",
+  "lexical_columns": [
+    "message_length",
+    "word_count",
+    "url_count",
+    "email_count",
+    "phone_count",
+    "digit_count",
+    "uppercase_ratio",
+    "special_ratio",
+    "urgency_terms",
+    "credential_terms",
+    "payment_terms",
+    "impersonation_terms",
+    "secrecy_terms",
+    "reward_terms",
+    "attachment_terms",
+    "share_request_terms",
+    "code_receipt_terms",
+    "no_share_advice_terms"
+  ],
+  "n_tfidf_features": 50000
+}

message-tfidf/metrics.json

@@ -0,0 +1,55 @@
+{
+  "task": "message-tfidf",
+  "method": "tfidf char_wb(3,5)+word(1,2) + 18 lexical, XGB",
+  "rows": 12843,
+  "class_balance": {
+    "0": 10249,
+    "1": 2594
+  },
+  "validation": {
+    "threshold": 0.5,
+    "precision": 0.9945205479452055,
+    "recall": 0.9355670103092784,
+    "f1": 0.9641434262948207,
+    "confusion_matrix": [
+      [
+        1535,
+        2
+      ],
+      [
+        25,
+        363
+      ]
+    ],
+    "pr_auc": 0.9859947462223423,
+    "roc_auc": 0.9930913749505329
+  },
+  "test": {
+    "threshold": 0.5,
+    "precision": 0.9945945945945946,
+    "recall": 0.9460154241645244,
+    "f1": 0.9696969696969697,
+    "confusion_matrix": [
+      [
+        1534,
+        2
+      ],
+      [
+        21,
+        368
+      ]
+    ],
+    "pr_auc": 0.996182276471391,
+    "roc_auc": 0.998712979327335
+  },
+  "operating_recall80": {
+    "mode": "recall>=0.8",
+    "threshold": 0.5573006272315979,
+    "precision": 1.0,
+    "recall": 0.9357326478149101,
+    "f1": 0.9667994687915007,
+    "max_f1": 0.9781771501925547,
+    "max_f1_threshold": 0.12930667400360107,
+    "pr_auc": 0.996182276471391
+  }
+}

message-tfidf/split_manifest.json

@@ -0,0 +1,9 @@
+{
+  "strategy": "grouped_stratified",
+  "groups": "normalized-text-hash",
+  "sizes": {
+    "train": 8993,
+    "validation": 1925,
+    "test": 1925
+  }
+}

message-tfidf/thresholds.json

@@ -0,0 +1,10 @@
+{
+  "mode": "recall>=0.8",
+  "threshold": 0.5573006272315979,
+  "precision": 1.0,
+  "recall": 0.9357326478149101,
+  "f1": 0.9667994687915007,
+  "max_f1": 0.9781771501925547,
+  "max_f1_threshold": 0.12930667400360107,
+  "pr_auc": 0.996182276471391
+}

message-tfidf/training_manifest.json

@@ -0,0 +1,46 @@
+{
+  "task": "message-tfidf",
+  "created_at": "20260923T180128Z",
+  "python": "3.12.13",
+  "platform": "Linux-7.2.6-1-cachyos-x86_64-with-glibc2.44",
+  "config": {
+    "seed": 42,
+    "output_dir": "ml/artifacts",
+    "data": {
+      "url_dataset": "PhiUSIIL_Phishing_URL_Dataset.csv",
+      "phishtank_dataset": "verified_online.csv",
+      "benign_domains": "top-1m.csv",
+      "message_dataset": "Dataset_5971.csv",
+      "sms_collection": "SMSSpamCollection",
+      "transaction_n_sample": 1000000,
+      "transaction_cache": "ml/.txn-cache"
+    },
+    "split": {
+      "train": 0.7,
+      "validation": 0.15,
+      "test": 0.15
+    },
+    "model": {
+      "n_estimators": 300,
+      "max_depth": 5,
+      "learning_rate": 0.04,
+      "min_child_weight": 3,
+      "subsample": 0.85,
+      "colsample_bytree": 0.85,
+      "reg_alpha": 0.2,
+      "reg_lambda": 2.0,
+      "tree_method": "hist"
+    },
+    "transaction_model": {
+      "n_estimators": 200,
+      "max_depth": 6,
+      "learning_rate": 0.1,
+      "min_child_weight": 3,
+      "subsample": 0.9,
+      "colsample_bytree": 0.9,
+      "reg_alpha": 0.2,
+      "reg_lambda": 2.0,
+      "tree_method": "hist"
+    }
+  }
+}

message-tfidf/vectorizer.joblib

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:64c191b6d964b6a167db275470fdbd1b52e0e968fd7d1cf83202967ff66c2d9b
+size 1799782

message/feature_defaults.json

@@ -0,0 +1,20 @@
+{
+  "message_length": 64.0,
+  "word_count": 12.0,
+  "url_count": 0.0,
+  "email_count": 0.0,
+  "phone_count": 0.0,
+  "digit_count": 0.0,
+  "uppercase_ratio": 0.05,
+  "special_ratio": 0.044444444444444446,
+  "urgency_terms": 0.0,
+  "credential_terms": 0.0,
+  "payment_terms": 0.0,
+  "impersonation_terms": 0.0,
+  "secrecy_terms": 0.0,
+  "reward_terms": 0.0,
+  "attachment_terms": 0.0,
+  "share_request_terms": 0.0,
+  "code_receipt_terms": 0.0,
+  "no_share_advice_terms": 0.0
+}

message/feature_manifest.json

@@ -0,0 +1,43 @@
+{
+  "feature_version": "message-features-1",
+  "columns": [
+    "message_length",
+    "word_count",
+    "url_count",
+    "email_count",
+    "phone_count",
+    "digit_count",
+    "uppercase_ratio",
+    "special_ratio",
+    "urgency_terms",
+    "credential_terms",
+    "payment_terms",
+    "impersonation_terms",
+    "secrecy_terms",
+    "reward_terms",
+    "attachment_terms",
+    "share_request_terms",
+    "code_receipt_terms",
+    "no_share_advice_terms"
+  ],
+  "dtypes": {
+    "message_length": "float64",
+    "word_count": "float64",
+    "url_count": "float64",
+    "email_count": "float64",
+    "phone_count": "float64",
+    "digit_count": "float64",
+    "uppercase_ratio": "float64",
+    "special_ratio": "float64",
+    "urgency_terms": "float64",
+    "credential_terms": "float64",
+    "payment_terms": "float64",
+    "impersonation_terms": "float64",
+    "secrecy_terms": "float64",
+    "reward_terms": "float64",
+    "attachment_terms": "float64",
+    "share_request_terms": "float64",
+    "code_receipt_terms": "float64",
+    "no_share_advice_terms": "float64"
+  }
+}

message/metrics.json

@@ -0,0 +1,100 @@
+{
+  "task": "message",
+  "rows": 12143,
+  "class_balance": {
+    "0": 9969,
+    "1": 2174
+  },
+  "train": {
+    "threshold": 0.5,
+    "precision": 0.9905341446923597,
+    "recall": 0.9619172685489166,
+    "f1": 0.9760159893404398,
+    "confusion_matrix": [
+      [
+        6966,
+        14
+      ],
+      [
+        58,
+        1465
+      ]
+    ],
+    "pr_auc": 0.996749294134677,
+    "roc_auc": 0.999207189851127
+  },
+  "validation": {
+    "threshold": 0.5,
+    "precision": 0.9737704918032787,
+    "recall": 0.9138461538461539,
+    "f1": 0.9428571428571428,
+    "confusion_matrix": [
+      [
+        1487,
+        8
+      ],
+      [
+        28,
+        297
+      ]
+    ],
+    "pr_auc": 0.981019973792235,
+    "roc_auc": 0.9938893748392076
+  },
+  "test": {
+    "threshold": 0.5,
+    "precision": 0.976897689768977,
+    "recall": 0.9079754601226994,
+    "f1": 0.9411764705882353,
+    "confusion_matrix": [
+      [
+        1487,
+        7
+      ],
+      [
+        30,
+        296
+      ]
+    ],
+    "pr_auc": 0.9829470354932671,
+    "roc_auc": 0.9945220555021723
+  },
+  "baseline_logistic": {
+    "validation": {
+      "threshold": 0.5,
+      "precision": 0.841225626740947,
+      "recall": 0.9292307692307692,
+      "f1": 0.8830409356725147,
+      "confusion_matrix": [
+        [
+          1438,
+          57
+        ],
+        [
+          23,
+          302
+        ]
+      ],
+      "pr_auc": 0.9541509594868397,
+      "roc_auc": 0.9820097761770002
+    },
+    "test": {
+      "threshold": 0.5,
+      "precision": 0.8559077809798271,
+      "recall": 0.911042944785276,
+      "f1": 0.8826151560178306,
+      "confusion_matrix": [
+        [
+          1444,
+          50
+        ],
+        [
+          29,
+          297
+        ]
+      ],
+      "pr_auc": 0.9653032775140513,
+      "roc_auc": 0.9904238631417285
+    }
+  }
+}

message/split_manifest.json

@@ -0,0 +1,9 @@
+{
+  "strategy": "grouped_stratified",
+  "groups": "domain-or-normalized-text",
+  "sizes": {
+    "train": 8503,
+    "validation": 1820,
+    "test": 1820
+  }
+}

message/training_manifest.json

@@ -0,0 +1,46 @@
+{
+  "task": "message",
+  "created_at": "20260923T175009Z",
+  "python": "3.12.13",
+  "platform": "Linux-7.2.6-1-cachyos-x86_64-with-glibc2.44",
+  "config": {
+    "seed": 42,
+    "output_dir": "ml/artifacts",
+    "data": {
+      "url_dataset": "PhiUSIIL_Phishing_URL_Dataset.csv",
+      "phishtank_dataset": "verified_online.csv",
+      "benign_domains": "top-1m.csv",
+      "message_dataset": "Dataset_5971.csv",
+      "sms_collection": "SMSSpamCollection",
+      "transaction_n_sample": 1000000,
+      "transaction_cache": "ml/.txn-cache"
+    },
+    "split": {
+      "train": 0.7,
+      "validation": 0.15,
+      "test": 0.15
+    },
+    "model": {
+      "n_estimators": 300,
+      "max_depth": 5,
+      "learning_rate": 0.04,
+      "min_child_weight": 3,
+      "subsample": 0.85,
+      "colsample_bytree": 0.85,
+      "reg_alpha": 0.2,
+      "reg_lambda": 2.0,
+      "tree_method": "hist"
+    },
+    "transaction_model": {
+      "n_estimators": 200,
+      "max_depth": 6,
+      "learning_rate": 0.1,
+      "min_child_weight": 3,
+      "subsample": 0.9,
+      "colsample_bytree": 0.9,
+      "reg_alpha": 0.2,
+      "reg_lambda": 2.0,
+      "tree_method": "hist"
+    }
+  }
+}

transaction/calibration.json

@@ -0,0 +1,9 @@
+{
+  "method": "isotonic",
+  "fit_on": "validation",
+  "calibrated": true,
+  "X_min": [
+    1.2015421816613525e-05
+  ],
+  "n_thresholds": 28
+}

transaction/calibration_model.joblib

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:65853c1509299376d124f05dee740b1fb3431cbc1737ca5ab1122d1a821cf689
+size 775

transaction/feature_defaults.json

@@ -0,0 +1,19 @@
+{
+  "Amount": 30.15,
+  "LogAmount": 3.4388142452334622,
+  "Hour": 12.0,
+  "Minute": 30.0,
+  "Year": 2013.0,
+  "Month": 7.0,
+  "Day": 16.0,
+  "Zip": 40906.0,
+  "MCC": 5499.0,
+  "IsOnline": 0.0,
+  "StateMissing": 0.0,
+  "StateRisky": 0.0,
+  "HasError": 0.0,
+  "IsNight": 0.0,
+  "CreditLimit": 13325.0,
+  "CardOnDarkWeb": 0.0,
+  "FicoScore": 700.0
+}

transaction/feature_manifest.json

@@ -0,0 +1,41 @@
+{
+  "feature_version": "transaction-features-1",
+  "columns": [
+    "Amount",
+    "LogAmount",
+    "Hour",
+    "Minute",
+    "Year",
+    "Month",
+    "Day",
+    "Zip",
+    "MCC",
+    "IsOnline",
+    "StateMissing",
+    "StateRisky",
+    "HasError",
+    "IsNight",
+    "CreditLimit",
+    "CardOnDarkWeb",
+    "FicoScore"
+  ],
+  "dtypes": {
+    "Amount": "float64",
+    "LogAmount": "float64",
+    "Hour": "float64",
+    "Minute": "float64",
+    "Year": "float64",
+    "Month": "float64",
+    "Day": "float64",
+    "Zip": "float64",
+    "MCC": "float64",
+    "IsOnline": "float64",
+    "StateMissing": "float64",
+    "StateRisky": "float64",
+    "HasError": "float64",
+    "IsNight": "float64",
+    "CreditLimit": "float64",
+    "CardOnDarkWeb": "float64",
+    "FicoScore": "float64"
+  }
+}

transaction/metrics.json

@@ -0,0 +1,70 @@
+{
+  "task": "transaction",
+  "method": "xgboost-optuna-isotonic (Person2 Tuning4 family)",
+  "rows": 1000000,
+  "n_sample_requested": 1000000,
+  "trials": 10,
+  "best_params": {
+    "n_estimators": 401,
+    "max_depth": 8,
+    "learning_rate": 0.030392898611614688,
+    "subsample": 0.9875376798995805,
+    "colsample_bytree": 0.6856947435981403,
+    "min_child_weight": 4,
+    "reg_alpha": 0.9715538656755343,
+    "reg_lambda": 2.009496629328365,
+    "scale_pos_weight": 50,
+    "tree_method": "hist"
+  },
+  "best_val_pr_auc": 0.6350730656911171,
+  "class_balance": {
+    "0": 998780,
+    "1": 1220
+  },
+  "test_calibrated": {
+    "threshold": 0.5,
+    "precision": 0.7515923566878981,
+    "recall": 0.6483516483516484,
+    "f1": 0.6961651917404129,
+    "confusion_matrix": [
+      [
+        149727,
+        39
+      ],
+      [
+        64,
+        118
+      ]
+    ],
+    "pr_auc": 0.6088987134136661,
+    "roc_auc": 0.8276938764399203
+  },
+  "test_raw": {
+    "threshold": 0.5,
+    "precision": 0.48314606741573035,
+    "recall": 0.7087912087912088,
+    "f1": 0.5746102449888643,
+    "confusion_matrix": [
+      [
+        149628,
+        138
+      ],
+      [
+        53,
+        129
+      ]
+    ],
+    "pr_auc": 0.7071943534022936,
+    "roc_auc": 0.9920050003279842
+  },
+  "operating_recall80": {
+    "mode": "max-F1 (min-recall unreachable)",
+    "threshold": 0.5333333611488342,
+    "precision": 0.8014184397163121,
+    "recall": 0.6208791208791209,
+    "f1": 0.6996904024767802,
+    "max_f1": 0.6996904024767802,
+    "max_f1_threshold": 0.5333333611488342,
+    "pr_auc": 0.6088987134136661
+  }
+}

transaction/split_manifest.json

@@ -0,0 +1,9 @@
+{
+  "strategy": "grouped_stratified",
+  "groups": "User-Card",
+  "sizes": {
+    "train": 700009,
+    "validation": 150043,
+    "test": 149948
+  }
+}

transaction/thresholds.json

@@ -0,0 +1,10 @@
+{
+  "mode": "max-F1 (min-recall unreachable)",
+  "threshold": 0.5333333611488342,
+  "precision": 0.8014184397163121,
+  "recall": 0.6208791208791209,
+  "f1": 0.6996904024767802,
+  "max_f1": 0.6996904024767802,
+  "max_f1_threshold": 0.5333333611488342,
+  "pr_auc": 0.6088987134136661
+}

transaction/training_manifest.json

@@ -0,0 +1,58 @@
+{
+  "task": "transaction",
+  "created_at": "20260923T173528Z",
+  "python": "3.12.13",
+  "platform": "Linux-7.2.6-1-cachyos-x86_64-with-glibc2.44",
+  "config": {
+    "seed": 42,
+    "output_dir": "ml/artifacts",
+    "data": {
+      "url_dataset": "PhiUSIIL_Phishing_URL_Dataset.csv",
+      "phishtank_dataset": "verified_online.csv",
+      "benign_domains": "top-1m.csv",
+      "message_dataset": "Dataset_5971.csv",
+      "sms_collection": "SMSSpamCollection",
+      "transaction_n_sample": 1000000,
+      "transaction_cache": "ml/.txn-cache"
+    },
+    "split": {
+      "train": 0.7,
+      "validation": 0.15,
+      "test": 0.15
+    },
+    "model": {
+      "n_estimators": 300,
+      "max_depth": 5,
+      "learning_rate": 0.04,
+      "min_child_weight": 3,
+      "subsample": 0.85,
+      "colsample_bytree": 0.85,
+      "reg_alpha": 0.2,
+      "reg_lambda": 2.0,
+      "tree_method": "hist"
+    },
+    "transaction_model": {
+      "n_estimators": 200,
+      "max_depth": 6,
+      "learning_rate": 0.1,
+      "min_child_weight": 3,
+      "subsample": 0.9,
+      "colsample_bytree": 0.9,
+      "reg_alpha": 0.2,
+      "reg_lambda": 2.0,
+      "tree_method": "hist"
+    }
+  },
+  "best_params": {
+    "n_estimators": 401,
+    "max_depth": 8,
+    "learning_rate": 0.030392898611614688,
+    "subsample": 0.9875376798995805,
+    "colsample_bytree": 0.6856947435981403,
+    "min_child_weight": 4,
+    "reg_alpha": 0.9715538656755343,
+    "reg_lambda": 2.009496629328365,
+    "scale_pos_weight": 50,
+    "tree_method": "hist"
+  }
+}

url/feature_defaults.json

@@ -0,0 +1,17 @@
+{
+  "lex_url_length": 30.0,
+  "lex_host_length": 19.0,
+  "lex_path_ratio": 0.0,
+  "lex_query_ratio": 0.0,
+  "lex_has_ip_host": 0.0,
+  "lex_has_punycode": 0.0,
+  "lex_dot_density": 0.07142857142857142,
+  "lex_hyphen_density": 0.0,
+  "lex_digit_density_host": 0.0,
+  "lex_at_count": 0.0,
+  "lex_percent_count": 0.0,
+  "lex_has_https": 1.0,
+  "lex_subdomain_count": 1.0,
+  "lex_uses_shortener": 0.0,
+  "lex_has_query": 0.0
+}

url/feature_manifest.json

@@ -0,0 +1,37 @@
+{
+  "feature_version": "url-features-1",
+  "columns": [
+    "lex_url_length",
+    "lex_host_length",
+    "lex_path_ratio",
+    "lex_query_ratio",
+    "lex_has_ip_host",
+    "lex_has_punycode",
+    "lex_dot_density",
+    "lex_hyphen_density",
+    "lex_digit_density_host",
+    "lex_at_count",
+    "lex_percent_count",
+    "lex_has_https",
+    "lex_subdomain_count",
+    "lex_uses_shortener",
+    "lex_has_query"
+  ],
+  "dtypes": {
+    "lex_url_length": "float64",
+    "lex_host_length": "float64",
+    "lex_path_ratio": "float64",
+    "lex_query_ratio": "float64",
+    "lex_has_ip_host": "float64",
+    "lex_has_punycode": "float64",
+    "lex_dot_density": "float64",
+    "lex_hyphen_density": "float64",
+    "lex_digit_density_host": "float64",
+    "lex_at_count": "float64",
+    "lex_percent_count": "float64",
+    "lex_has_https": "float64",
+    "lex_subdomain_count": "float64",
+    "lex_uses_shortener": "float64",
+    "lex_has_query": "float64"
+  }
+}

url/metrics.json

@@ -0,0 +1,100 @@
+{
+  "task": "url",
+  "rows": 265795,
+  "class_balance": {
+    "0": 164850,
+    "1": 100945
+  },
+  "train": {
+    "threshold": 0.5,
+    "precision": 0.9934578065274919,
+    "recall": 0.9563131527553707,
+    "f1": 0.9745316623642578,
+    "confusion_matrix": [
+      [
+        114950,
+        445
+      ],
+      [
+        3087,
+        67575
+      ]
+    ],
+    "pr_auc": 0.9950598196654774,
+    "roc_auc": 0.9954755812752186
+  },
+  "validation": {
+    "threshold": 0.5,
+    "precision": 0.9940553467714384,
+    "recall": 0.9606444796619124,
+    "f1": 0.977064374223446,
+    "confusion_matrix": [
+      [
+        24641,
+        87
+      ],
+      [
+        596,
+        14548
+      ]
+    ],
+    "pr_auc": 0.9958790243223578,
+    "roc_auc": 0.9963766503274593
+  },
+  "test": {
+    "threshold": 0.5,
+    "precision": 0.9918386941910706,
+    "recall": 0.955281062157342,
+    "f1": 0.9732166890982503,
+    "confusion_matrix": [
+      [
+        24608,
+        119
+      ],
+      [
+        677,
+        14462
+      ]
+    ],
+    "pr_auc": 0.9949988385310375,
+    "roc_auc": 0.9956094566805189
+  },
+  "baseline_logistic": {
+    "validation": {
+      "threshold": 0.5,
+      "precision": 0.8875435144543666,
+      "recall": 0.774432118330692,
+      "f1": 0.8271387262853517,
+      "confusion_matrix": [
+        [
+          23242,
+          1486
+        ],
+        [
+          3416,
+          11728
+        ]
+      ],
+      "pr_auc": 0.933550849183027,
+      "roc_auc": 0.9421230430293426
+    },
+    "test": {
+      "threshold": 0.5,
+      "precision": 0.8950725450339946,
+      "recall": 0.8435167448312306,
+      "f1": 0.8685302319254573,
+      "confusion_matrix": [
+        [
+          23230,
+          1497
+        ],
+        [
+          2369,
+          12770
+        ]
+      ],
+      "pr_auc": 0.946916161484859,
+      "roc_auc": 0.9527697172724541
+    }
+  }
+}

url/split_manifest.json

@@ -0,0 +1,9 @@
+{
+  "strategy": "grouped_stratified",
+  "groups": "domain-or-normalized-text",
+  "sizes": {
+    "train": 186057,
+    "validation": 39872,
+    "test": 39866
+  }
+}

url/training_manifest.json

@@ -0,0 +1,46 @@
+{
+  "task": "url",
+  "created_at": "20260923T174835Z",
+  "python": "3.12.13",
+  "platform": "Linux-7.2.6-1-cachyos-x86_64-with-glibc2.44",
+  "config": {
+    "seed": 42,
+    "output_dir": "ml/artifacts",
+    "data": {
+      "url_dataset": "PhiUSIIL_Phishing_URL_Dataset.csv",
+      "phishtank_dataset": "verified_online.csv",
+      "benign_domains": "top-1m.csv",
+      "message_dataset": "Dataset_5971.csv",
+      "sms_collection": "SMSSpamCollection",
+      "transaction_n_sample": 1000000,
+      "transaction_cache": "ml/.txn-cache"
+    },
+    "split": {
+      "train": 0.7,
+      "validation": 0.15,
+      "test": 0.15
+    },
+    "model": {
+      "n_estimators": 300,
+      "max_depth": 5,
+      "learning_rate": 0.04,
+      "min_child_weight": 3,
+      "subsample": 0.85,
+      "colsample_bytree": 0.85,
+      "reg_alpha": 0.2,
+      "reg_lambda": 2.0,
+      "tree_method": "hist"
+    },
+    "transaction_model": {
+      "n_estimators": 200,
+      "max_depth": 6,
+      "learning_rate": 0.1,
+      "min_child_weight": 3,
+      "subsample": 0.9,
+      "colsample_bytree": 0.9,
+      "reg_alpha": 0.2,
+      "reg_lambda": 2.0,
+      "tree_method": "hist"
+    }
+  }
+}