PHISHING EMAIL ANALYSIS TOOL
Master Project Artefact

Student ID: 2023511
Programme: MSc Cybersecurity and Digital Forensics
University of Wales Trinity Saint David


PROJECT OVERVIEW

The Phishing Email Analysis Tool is a desktop-based application developed in Python using Tkinter.

The application analyses email content for three predefined suspicious textual characteristics:

- Urgent Language
- Action Requests
- Promotional Language

A transparent rule-based approach is used to generate a risk score and corresponding risk level (Low, Medium or High Risk). The application also provides characteristic-specific recommendations and allows the analysis results to be exported as a text report.

The tool provides a risk indication based on predefined suspicious characteristics and does not definitively classify an email as phishing.


PACKAGE CONTENTS

phishing_email_analysis_tool.py
    Python source code for the desktop application.

phishing_email.csv
    Publicly available Phishing Email Dataset by N. A. Alam, obtained from
    Kaggle and used by the application. The included consolidated file
    contains 82,486 email records.

Exported Reports/
    Contains the eight exported reports produced during functional testing.
    These represent all possible combinations of the three suspicious
    characteristic categories.

Screenshots/
    Contains screenshots demonstrating the application interface,
    analysis results, recommendations and other implemented functionality.

README.txt
    Instructions and information about the artefact.


REQUIREMENTS

- Python 3.x
- pandas
- Tkinter

Tkinter is normally included with standard Python installations.


DATASET

The application uses the publicly available Phishing Email Dataset by 
N. A. Alam, obtained from Kaggle. The consolidated phishing_email.csv file 
included in this artefact contains 82,486 email records. The application 
analyses email content from the text_combined field. The dataset label is 
not used to determine the rule-based risk score.

Dataset source:
N. A. Alam, “Phishing Email Dataset,” Kaggle. [Online].
Available: https://www.kaggle.com/datasets/naserabdullahalam/phishing-email-dataset
[Accessed: Sep. 8, 2026].


HOW TO RUN THE APPLICATION

1. Extract the complete ZIP file to a folder.
2. Open phishing_email_analysis_tool.py in Visual Studio Code or another
   Python environment.
3. Run the Python file.
4. The Phishing Email Analysis Tool desktop interface will open.


HOW TO USE THE APPLICATION

1. Select "Load Dataset".
2. Choose the included phishing_email.csv file.
3. Select "Browse Emails" to navigate through the email records or enter
   a specific email number.
4. Select "Analyse Email" to analyse the selected email.
5. The application will display the detected suspicious characteristics,
   risk score and risk level.
6. Select "View Recommendations" to display recommendations associated
   with the detected characteristics.
7. Select "Export Report" to save the analysis result as a .txt file.


RISK ASSESSMENT

The risk score is based on the number of suspicious characteristic
categories detected:

0 categories = Low Risk
1 category   = Medium Risk
2 categories = Medium Risk
3 categories = High Risk

Each detected category contributes a maximum of one point to the risk
score, regardless of how many individual keywords from that category
are present.


FUNCTIONAL TESTING

The artefact was functionally tested using all eight possible
combinations of the three suspicious characteristic categories:

- No suspicious characteristics
- Urgent Language only
- Action Requests only
- Promotional Language only
- Urgent Language + Action Requests
- Urgent Language + Promotional Language
- Action Requests + Promotional Language
- Urgent Language + Action Requests + Promotional Language

All eight test cases produced the expected functional results.

The evaluation focused on functional correctness rather than predictive
classification accuracy.