Phishing Email Detection Using Subject and Body Text: A Comparative Study of Transformers, Bi-LSTM, and Traditional Classifiers
Loading...
Files
Size: 555.45 KB, File format: Adobe PDF
Size: 419.88 KB, File format: Microsoft Word 2007+
Date
Authors
Htet Kyaw, Phyo
Gutierrez, Jairo
Ghobakhlou, Akbar
Supervisor
Item type
Degree name
Journal Title
Journal ISSN
Volume Title
Publisher
AIS Electronic Library
Abstract
Phishing emails continue to bypass blacklist, signature, and rule-based defenses, motivating the development of detectors that can learn robust patterns from message content. This Research-in-Progress paper reports completed results for the subject+body text module of a planned multi-segment phishing email detector covering headers, URLs, and attachments. We compare Transformer-based models (BERT, DistilBERT, DeBERTa-v3-base, DeBERTa-v3-small) with recurrent neural models (LSTM, Bi-LSTM) and traditional classifiers (Logistic Regression, SVM, Random Forest, Decision Tree, Naïve Bayes) under consistent preprocessing and evaluation settings. DeBERTa-v3-small achieves the strongest overall performance on the text module (F1 = 0.9972, Matthews correlation coefficient (MCC) = 0.9950), followed closely by BERT (F1 = 0.9969, MCC = 0.9944). DistilBERT provides a strong efficiency–effectiveness trade-off (F1 = 0.9957, MCC = 0.9922), and a linear SVM remains competitive among traditional classifiers (F1 = 0.9963, MCC = 0.9933). At batch size 1, the model-only inference time is 4.84 ms/message for DistilBERT, compared with 8.98 ms/message for BERT and 12.27 ms/message for DeBERTa-v3-small. These results provide a strong baseline for the text module, and future work will implement the remaining modules and measure their added value through controlled ablation and fusion studies.
Description
Keywords
4604 Cybersecurity and privacy, 4611 Machine learning, Phishing detection, Phishing email, Email security, Deep learning
Source
International Conference on Information Resources Management (CONF-IRM) 2026 Proceedings. 11. ISSN 2744-6220
DOI
Publisher's version
Rights statement
This is the Authors' Manuscript of a conference paper published in the Proceedings of the International Conference on Information Resources Management (CONFIRM) 2026. The publisher's version is available at https://aisel.aisnet.org/confirm2026/11/