EPAD: Email Phishing Attack Detection Powered by Machine Learning and Natural Language Processing

Abstract

Phishing is a form of social engineering attack which takes advantage of human vulnerability to exploit users. Email phishing is an emerging and prevalent form of cyber attack that impersonates a trusted entity. In today's world, email has become a de facto mechanism of communication for individuals and businesses. Phishing attacks on emails are growing constantly. Hence, the need for email phishing attack detection is increasingly becoming crucial. This paper presents an email phishing attack detection (EPAD) system using Machine Learning and Natural Language Processing (NLP) techniques to detect phishing emails. The proposed work makes use of algorithms which include Support Vector Classifier, Naive Bayes, Logistic Regression, Random Forest and eXtreme Gradient Boosting (XGBoost) for the prediction of benign or phishing emails. The EPAD system focuses on content based and textual features in detecting phishing emails. Readability scores, sentiments and attachments related information are also considered for the effective phishing email detection. The EPAD system uses NLP techniques which include Term Frequency-Inverse Document Frequency (TF-IDF) and Word2Vec for capturing the semantics of the email messages. Explainable AI is employed to provide interpretability of results of email phishing detection. Consequently, the EPAD system offers the reasoning about the prediction of phished or benign email and thereby enhances user trust. Experimental outcomes demonstrate that XGBoost with Word2Vec performs optimally in comparison with other algorithms in respect of accuracy, F1-score, Area under Receiver Operating Characteristic Curve (ROC-AUC) and Matthews Correlation Coefficient (MCC) for the detection of phishing emails. A thorough evaluation carried out in terms of ablation study, statistical performance analysis and sensitivity analysis validates the effectiveness of the proposed system.