Recorded sample and campaign-held-out metrics on the organization card

index.html

@@ -21,7 +21,10 @@
     .card { background:#fff; border:1px solid #e2e8f0; border-radius:18px; padding:16px 18px; }
     .card strong { display:block; font-size:1.4rem; color:var(--indigo); }
     .note { background:#eef2ff; border:1px solid #c7d2fe; border-radius:16px; padding:14px 16px; color:#3730a3; }
-    iframe { width:100%; height:86vh; min-height:720px; border:1px solid #c7d2fe; border-radius:20px; background:#fff; margin:16px 0 28px; }
+    table { width:100%; border-collapse:collapse; font-size:.95rem; }
+    th, td { text-align:left; padding:8px 10px; border-bottom:1px solid #e2e8f0; vertical-align:top; }
+    th { color:#3730a3; font-size:.8rem; text-transform:uppercase; letter-spacing:.04em; }
+    .ltr { direction:ltr; unicode-bidi:isolate; }
     footer { padding:12px 0 40px; color:var(--muted); font-size:.92rem; }
     .fa { direction:rtl; text-align:right; }
   </style>
@@ -36,9 +39,9 @@
       opened, and the demo never returns a safe verdict.
     </p>
     <div class="actions">
-      <a class="btn primary" href="https://huggingface.co/spaces/alirezaaminzadeh/phish" target="_blank" rel="noreferrer">Open live demo</a>
-      <a class="btn ghost" href="https://huggingface.co/datasets/AriaAICompany/phish-messages" target="_blank" rel="noreferrer">Dataset</a>
+      <a class="btn primary" href="https://huggingface.co/datasets/AriaAICompany/phish-messages" target="_blank" rel="noreferrer">Dataset</a>
       <a class="btn ghost" href="https://huggingface.co/AriaAICompany/phish-structural" target="_blank" rel="noreferrer">Model</a>
+      <a class="btn ghost" href="https://huggingface.co/collections/AriaAICompany/aria-ai-cybersecurity-6ab01faa3995a3bb737b58a7" target="_blank" rel="noreferrer">Collection</a>
       <a class="btn ghost" href="https://huggingface.co/AriaAICompany" target="_blank" rel="noreferrer">Organization</a>
     </div>
   </header>
@@ -50,14 +53,42 @@
       <article class="card"><strong>CPU</strong>Rules + TF-IDF + LightGBM · no paid API</article>
     </section>
     <p class="note">
-      Organization Gradio hosting needs Team/Enterprise. This page is the AriaAICompany project card;
-      the iframe is the live workstation on the personal PRO account when org compute is unavailable.
+      Organization Gradio hosting needs Team/Enterprise. Personal PRO has a daily Space-creation cap (20/day),
+      so the interactive workstation is queued for <span class="ltr">alirezaaminzadeh/phish</span> when that cap resets.
+      Dataset, model, and this card already live under AriaAICompany.
     </p>
-    <section class="fa card">
+    <article class="card">
+      <h2>Recorded sample · bank_otp_fa-00</h2>
+      <p>Decision <strong>suspicious</strong> · severity high · confidence high · hash <span class="ltr">d9ff859335fe256e</span> · 738 ms</p>
+      <table>
+        <thead><tr><th>Kind</th><th>Finding</th></tr></thead>
+        <tbody>
+          <tr><td>Observed</td><td>Reply-To domain does not match the From domain.</td></tr>
+          <tr><td>Observed</td><td>Return-Path domain does not match the From domain.</td></tr>
+          <tr><td>Observed</td><td>Visible link text and actual href host do not match. Host defanged: <span class="ltr">hxxp://bmi-secure-login[.]example/otp/003</span></td></tr>
+          <tr><td>Observed</td><td>Host resembles the brand «bmi» but is not on the known-owner list.</td></tr>
+          <tr><td>Observed</td><td>Message asks for a login or account update.</td></tr>
+          <tr><td>Observed</td><td>Copied Authentication-Results is not proof of SPF/DKIM/DMARC.</td></tr>
+          <tr><td>Inference</td><td>rule 1.00 · TF-IDF 0.86 · LightGBM 0.93 (calibrated lab scores, not a safe/unsafe certificate)</td></tr>
+        </tbody>
+      </table>
+    </article>
+    <article class="card" style="margin-top:12px">
+      <h2>Held-out campaign test (96 messages)</h2>
+      <table>
+        <thead><tr><th>Method</th><th>PR-AUC</th><th>Recall @ FPR 0.10</th><th>Brier</th></tr></thead>
+        <tbody>
+          <tr><td>rule-structural</td><td>1.00</td><td>1.00</td><td>0.10</td></tr>
+          <tr><td>tfidf-lr</td><td>1.00</td><td>1.00</td><td>0.15</td></tr>
+          <tr><td>lightgbm-structural</td><td>1.00</td><td>1.00</td><td>0.16</td></tr>
+        </tbody>
+      </table>
+      <p>Hard-negative invoices and login notices were never labeled suspicious (0.00). Lab PR-AUC on synthetic fixtures is not operational accuracy.</p>
+    </article>
+    <section class="fa card" style="margin-top:12px">
       <h2>فیش</h2>
-      <p>ایمیل مشکوک را با شاهد قابل‌کلیک بررسی می‌کند. واژه «فوری» به‌تنهایی فیشینگ نیست. نتیجه «امن» وجود ندارد. لینک فقط تجزیه و خنثی می‌شود.</p>
+      <p>ایمیل مشکوک را با شاهد قابل‌کلیک بررسی می‌کند. واژه «فوری» به‌تنهایی فیشینگ نیست. نتیجه «امن» وجود ندارد. لینک فقط تجزیه و خنثی می‌شود. دیتاست و م��ل کوچک روی حساب سازمانی آریا ای آی منتشر شده‌اند.</p>
     </section>
-    <iframe title="Phish live demo" src="https://alirezaaminzadeh-phish.hf.space" loading="lazy"></iframe>
   </main>
   <footer>Aria AI · Cybersecurity · Roadmap project 03 · Apache-2.0 / CC-BY-4.0</footer>
 </body>