Spaces:
Running
Running
| from parse_email import parse_email | |
| from header_analyzer import analyze_headers | |
| from body_analyzer import analyze_body | |
| from url_analyzer import analyze_urls | |
| def analyze(file_path): | |
| # Parse | |
| headers, body, urls = parse_email(file_path or "") | |
| # Analyze | |
| header_findings, header_score = analyze_headers(headers or {}) | |
| body_findings, body_score, highlighted_body, body_verdict = analyze_body(body or "") | |
| url_findings, url_score = analyze_urls(urls or []) | |
| # Score | |
| total_score = (header_score or 0) + (body_score or 0) + (url_score or 0) * 1.5 | |
| try: | |
| total_score = float(total_score) | |
| except Exception: | |
| total_score = 0.0 | |
| total_score = max(0.0, min(total_score, 100.0)) | |
| total_score_rounded = round(total_score) | |
| # Verdict | |
| if total_score >= 70: | |
| verdict = "🚨 Malicious" | |
| elif 50 <= total_score < 70: | |
| verdict = "⚠️ Suspicious" | |
| elif 30 <= total_score < 50: | |
| verdict = "📩 Spam" | |
| else: | |
| verdict = "✅ Safe" | |
| # Attack type | |
| body_lower = (body or "").lower() | |
| attack_type = "General Phishing" | |
| if any(word in body_lower for word in ["invoice", "payment", "wire transfer", "bank details"]): | |
| attack_type = "Invoice/Payment Fraud (BEC)" | |
| elif any(word in body_lower for word in ["password", "verify", "account", "login", "credentials"]): | |
| attack_type = "Credential Harvesting (Phishing)" | |
| elif any("reply-to mismatch" in f.lower() for f in header_findings): | |
| attack_type = "Business Email Compromise (BEC)" | |
| elif any("spam" in f.lower() for f in body_findings): | |
| attack_type = "Spam / Marketing" | |
| elif verdict == "✅ Safe": | |
| attack_type = "Benign / Normal Email" | |
| # Tags | |
| tags = [] | |
| for finding in (header_findings + body_findings + url_findings): | |
| fl = finding.lower() | |
| if "domain" in fl: | |
| tags.append("Suspicious Sender Domain") | |
| if "phishing" in fl or "malicious url" in fl or "urlhaus" in fl: | |
| tags.append("Phishing / Malicious URL") | |
| if "urgent" in fl or "suspicious phrase" in fl: | |
| tags.append("Urgent Language") | |
| if "spam" in fl or "marketing" in fl: | |
| tags.append("Spam Tone") | |
| if "spf" in fl or "dkim" in fl or "dmarc" in fl: | |
| tags.append("Auth Failures (SPF/DKIM/DMARC)") | |
| summary = { | |
| "Final Verdict": verdict, | |
| "Attack Type": attack_type, | |
| "Attack Score": total_score_rounded, | |
| "Main Tags": ", ".join(sorted(set(tags))) if tags else "No special tags", | |
| } | |
| details = { | |
| "Header Findings": header_findings or [], | |
| "Body Findings": body_findings or [], | |
| "URL Findings": url_findings or [], | |
| "Highlighted Body": highlighted_body or "", | |
| } | |
| return summary, details | |