FhniX - Explainable, local-first phishing email triage wit

项目说明

<p align="center">
<img src="docs/assets/fhnix-hero.png" alt="FhniX email risk analysis banner" width="100%">
</p>

<h1 align="center">FhniX</h1>

<p align="center">
<img src="phishlens/src/phishlens/assets/fhnix-logo.png" alt="FhniX phoenix shield logo" width="96">
</p>

<p align="center">
Explainable, local-first phishing triage for exported emails and read-only IMAP mailbox scans.
</p>

<p align="center">
<img alt="Python 3.11+" src="
<img alt="License MIT" src="
<img alt="Status Alpha" src="
<img alt="Local first" src="
</p>

This GitHub repository is named FhniX. The primary product is the Python phishing-email triage tool in phishlens/. The repository root also contains a smaller, separate Rust desktop app (Cargo package safe-malware-simulator) that only renders synthetic telemetry.

| Path | What it is | How to run |
| --- | --- | --- |
| phishlens/ | Primary. FhniX: explainable local-first phishing triage (CLI + tkinter GUI). Package name fhnix 0.5.0. | cd phishlens then py -m pip install -e . |
| repository root (Cargo.toml, src/main.rs) | Secondary. Safe Malware Behavior Simulator: a tiny egui/eframe trainer. It does not implement FhniX. | cargo run |

> [!IMPORTANT]
> FhniX is a defensi aid, not a final security . unexpected requests through a trusted, independent channel before taking action.

Full FhniX documentation, including mailbox mode, local training, scoring, and platform notes, lives in phishlens/README.md.

Why FhniX?

FhniX helps analysts, blue teams, students, and e users inspect suspicious emails without opening links or executing attachments. It combines transparent detection rules with an optional locally trained Nai model and explains the signals behind every result.

| Capability | What it provides |
| --- | --- |
| Explainable analysis | Every warning includes a rule, se, score contribution, and e. |
| Safe inspection | URLs are defanged in reports; links are not and attachments are not executed. |
| Local-first workflow | .eml analysis, model training, and inference stay on your machine. |
| Flexible input | Analyze one email, scan folders recursively, or fetch recent messages through read-only IMAP. |
| Useful output | Review results in the GUI or export text, JSON, and Excel-friendly CS. |
| Hybrid detection | Combine deterministic security rules with an optional model trained on your own labeled data. |

Requirements

Installation

Use python instead of py on systems where the Python launcher is una. The legacy phishlens command remains a for compatibility.

Quick Start

Analyze an exported email:

Launch the terminal-style desktop interface:

You can also use the short form:

The GUI supports single-message analysis, folder scans, model loading, local training, e inspection, report saving, and CS.

<p align="center">
<img src="phishlens/docs/assets/fhnix-gui.png" alt="FhniX terminal-style desktop interface" width="100%">
</p>

A sample message is included at phishlens/examples/suspicious.eml.

De tests

From phishlens/:

Security

Please do not publish or sensiti emails in public issues. Read SECURITY.md for the supported and responsible disclosure process.

Also in this repository: Safe Malware Behavior Simulator

The files at the repository root (Cargo.toml, src/main.rs) are not FhniX. They are a separate defensi Rust desktop app for demonstrating suspicious telemetry patterns without creating or executing real malware.

Cargo package name: safe-malware-simulator 0.1.0. Window title: Safe Malware Behavior Simulator. Tech stack: Rust, egui, eframe.

It is intended for blue-team demos, malware-analysis training, SOC workflow practice, UI experiments for detection tooling, and classroom-safe behavior simulation. Profiles included in the UI:

Run the simulator

On Windows, Microsoft C++ build tools ( Studio Build Tools with the Desktop de with C++ workload, or Studio Community with C++ tooling) may be required so link.exe is on PATH.

Safe scope

This simulator stays on the safe side of cybersecurity work:

E shown in the interface is synthetic telemetry rendered inside the application. Contributions must keep all suspicious behavior synthetic and contained to generated UI output only.

License

Released under the MIT License.

项目信息

开发语言：Python

Star 数：4

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Explainable, local-first phishing email triage with a desktop GUI, folder reports, read-only IMAP scans, and optional local ML.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。