Spam Detection

The Story That Explains Spam Detection

Spam detection is one of the oldest and most impactful applications of Natural Language Processing (NLP). It is a binary text classification problem: given a message, decide whether it is spam (unwanted) or ham (legitimate). The techniques behind it now power email filters, SMS blockers, social media moderation, and fraud alert systems worldwide.

What Is Spam? Categories and Real Examples

Not all spam is the same. Before building a detector, you need to know what you are detecting. Spam comes in many flavours — each with its own linguistic fingerprints.

The NLP Pipeline for Spam Detection

Raw text cannot be fed directly into a machine learning model. It must be cleaned, transformed, and numerically represented. This journey is called the NLP preprocessing pipeline.

Text Vectorisation — Turning Words into Numbers

Method 1 — Bag of Words (BoW)

Create a vocabulary of all unique words in the dataset. Each message becomes a vector where each position is the count of a word from the vocabulary.

Method 2 — TF-IDF (Term Frequency–Inverse Document Frequency)

TF-IDF fixes BoW's weakness. It rewards words that appear often in a message but rarely across all messages — these are the truly discriminative words.

Building a Spam Detector — Step-by-Step with Python

We will use the famous UCI SMS Spam Collection dataset — 5,574 SMS messages labelled as "spam" or "ham". Below is a complete, production-ready pipeline.

import pandas as pd
import numpy as np
import re
import string

# Load the SMS spam dataset
df = pd.read_csv('spam.csv', encoding='latin-1')[['v1', 'v2']]
df.columns = ['label', 'text']

# Check class distribution
print(df['label'].value_counts())
print(df['label'].value_counts(normalize=True).round(3))

# Check average text length by class
df['length'] = df['text'].apply(len)
print(df.groupby('label')['length'].mean())

import nltk
from nltk.corpus import stopwords
from nltk.stem import PorterStemmer

nltk.download('stopwords', quiet=True)
nltk.download('punkt', quiet=True)

ps = PorterStemmer()
stop_words = set(stopwords.words('english'))

# ── Engineer features BEFORE cleaning ────────────────────
df['num_exclamation'] = df['text'].str.count('!')
df['has_url']         = df['text'].str.contains(r'http|www|\.com', case=False).astype(int)
df['num_digits']      = df['text'].apply(lambda x: sum(c.isdigit() for c in x))
df['upper_ratio']     = df['text'].apply(
    lambda x: sum(c.isupper() for c in x) / (len(x) + 1))

# ── Clean text ────────────────────────────────────────────
def preprocess(text):
    text = text.lower()
    text = re.sub(r'http\S+|www\S+', ' url ', text)  # replace URLs with token
    text = re.sub(r'[^a-z\s]', '', text)              # remove non-alpha
    tokens = text.split()
    tokens = [ps.stem(w) for w in tokens if w not in stop_words]
    return ' '.join(tokens)

df['clean_text'] = df['text'].apply(preprocess)
print(df[['text', 'clean_text']].head(3))

from sklearn.model_selection import train_test_split
from sklearn.feature_extraction.text import TfidfVectorizer
from sklearn.naive_bayes import MultinomialNB
from sklearn.pipeline import Pipeline
from sklearn.metrics import classification_report, roc_auc_score, confusion_matrix

# Encode label
df['label_enc'] = (df['label'] == 'spam').astype(int)

X_train, X_test, y_train, y_test = train_test_split(
    df['clean_text'], df['label_enc'],
    test_size=0.2, random_state=42, stratify=df['label_enc']
)

# Build pipeline: TF-IDF + Naive Bayes
model = Pipeline([
    ('tfidf', TfidfVectorizer(
        ngram_range=(1, 2),  # unigrams + bigrams
        max_features=10000,
        sublinear_tf=True    # dampens very high frequencies
    )),
    ('clf', MultinomialNB(alpha=0.1))
])

model.fit(X_train, y_train)
y_pred = model.predict(X_test)
y_prob = model.predict_proba(X_test)[:, 1]

print(classification_report(y_test, y_pred, target_names=['Ham', 'Spam']))
print(f"ROC-AUC: {roc_auc_score(y_test, y_prob):.4f}")
print("Confusion Matrix:")
print(confusion_matrix(y_test, y_pred))

Understanding the Confusion Matrix for Spam

In spam detection, the two types of errors have very different real-world consequences. Understanding this is critical to tuning your classifier correctly.

The Naive Bayes Algorithm — Why It Dominates Spam Filtering

Naive Bayes applies Bayes' Theorem to compute the probability that a message is spam given the words it contains:

Beyond Naive Bayes — Other Algorithms Compared

As datasets grow and requirements become more sophisticated, you have several powerful alternatives to Naive Bayes. Here is a practical comparison for spam detection:

Trying Logistic Regression and SVM

from sklearn.linear_model import LogisticRegression
from sklearn.svm import LinearSVC
from sklearn.model_selection import cross_val_score

tfidf = TfidfVectorizer(ngram_range=(1, 2), max_features=10000, sublinear_tf=True)
X_all = tfidf.fit_transform(df['clean_text'])
y_all = df['label_enc']

models = {
    'Naive Bayes':          MultinomialNB(alpha=0.1),
    'Logistic Regression':  LogisticRegression(max_iter=1000, C=1.0),
    'LinearSVC':            LinearSVC(C=1.0)
}

for name, clf in models.items():
    scores = cross_val_score(clf, X_all, y_all, cv=5, scoring='f1')
    print(f"{name:25s}: F1 = {scores.mean():.4f} ± {scores.std():.4f}")

Feature Engineering — The Secret Weapon

TF-IDF captures word content. But spam has structural signals too — signals that exist in the formatting, not just the words. Feature engineering extracts these.

Combining TF-IDF + Engineered Features

from scipy.sparse import hstack
from sklearn.preprocessing import StandardScaler

# TF-IDF matrix (sparse)
tfidf = TfidfVectorizer(ngram_range=(1,2), max_features=10000, sublinear_tf=True)
X_text = tfidf.fit_transform(df['clean_text'])

# Engineered features (dense)
eng_features = ['num_exclamation', 'has_url', 'num_digits', 'upper_ratio', 'length']
X_eng = df[eng_features].values

# Combine: sparse + dense
from scipy.sparse import csr_matrix
X_combined = hstack([X_text, csr_matrix(X_eng)])

# Evaluate with combined features
svm = LinearSVC(C=1.0)
scores = cross_val_score(svm, X_combined, df['label_enc'], cv=5, scoring='f1')
print(f"Combined Features F1: {scores.mean():.4f} ± {scores.std():.4f}")

Advanced: Deep Learning with LSTM

For large-scale or high-stakes spam detection (e.g., detecting sophisticated phishing), deep learning models capture sequential context that TF-IDF misses — understanding that "you won" is more suspicious than "you" and "won" independently.

import tensorflow as tf
from tensorflow.keras.preprocessing.text import Tokenizer
from tensorflow.keras.preprocessing.sequence import pad_sequences
from tensorflow.keras.models import Sequential
from tensorflow.keras.layers import Embedding, LSTM, Dense, Dropout

# Tokenise text
MAX_VOCAB = 8000
MAX_LEN   = 120

tokenizer = Tokenizer(num_words=MAX_VOCAB, oov_token='<OOV>')
tokenizer.fit_on_texts(X_train)

X_tr_seq = pad_sequences(tokenizer.texts_to_sequences(X_train), maxlen=MAX_LEN)
X_te_seq = pad_sequences(tokenizer.texts_to_sequences(X_test),  maxlen=MAX_LEN)

# Build LSTM model
model_lstm = Sequential([
    Embedding(MAX_VOCAB, 64, input_length=MAX_LEN),
    LSTM(64, return_sequences=False),
    Dropout(0.3),
    Dense(32, activation='relu'),
    Dense(1,  activation='sigmoid')
])

model_lstm.compile(optimizer='adam', loss='binary_crossentropy', metrics=['accuracy'])
model_lstm.fit(X_tr_seq, y_train, epochs=5, batch_size=32, validation_split=0.1, verbose=1)

# Evaluate
loss, acc = model_lstm.evaluate(X_te_seq, y_test, verbose=0)
print(f"LSTM Test Accuracy: {acc:.4f}")

Handling Adversarial Spam — The Arms Race

Handling Character-Level Tricks with Character N-grams

# Character n-grams catch obfuscated spam like "fr33" and "w!nn3r"
char_tfidf = TfidfVectorizer(
    analyzer='char_wb',   # character n-grams within word boundaries
    ngram_range=(2, 4),   # bi-grams to 4-grams of characters
    max_features=20000,
    sublinear_tf=True
)

# Combine word + character n-gram features
X_char = char_tfidf.fit_transform(df['text'])   # use RAW text for char n-grams
X_word = tfidf.transform(df['clean_text'])

X_robust = hstack([X_word, X_char])

scores = cross_val_score(
    LinearSVC(C=1.0), X_robust, df['label_enc'],
    cv=5, scoring='f1'
)
print(f"Robust (word + char n-gram) F1: {scores.mean():.4f} ± {scores.std():.4f}")

Model Deployment — Saving and Using Your Spam Filter

import joblib

# Save the final trained pipeline
final_pipeline = Pipeline([
    ('tfidf', TfidfVectorizer(ngram_range=(1,2), max_features=10000, sublinear_tf=True)),
    ('clf',   LinearSVC(C=1.0))
])
final_pipeline.fit(df['clean_text'], df['label_enc'])

joblib.dump(final_pipeline, 'spam_detector.pkl')
print("Model saved!")

# ── Load and predict on new messages ─────────────────────
loaded_model = joblib.load('spam_detector.pkl')

new_messages = [
    "Congratulations! You have won a free holiday. Call 0800-123456 NOW!",
    "Hey, are we still on for the team meeting tomorrow at 10am?",
    "URGENT: Your bank account has been compromised. Click here to verify.",
    "Thanks for sending the report. I'll review it this evening."
]

cleaned_new = [preprocess(m) for m in new_messages]
predictions = loaded_model.predict(cleaned_new)
labels      = ['🚨 SPAM' if p == 1 else '✅ HAM ' for p in predictions]

for msg, label in zip(new_messages, labels):
    print(f"{label} → {msg[:60]}...")

Golden Rules of Spam Detection