CGL-FED: A Continual Graph-Based Learning Framework for Fraudulent Email Detection

Abstract

Email communication remains the primary vector for sophisticated cyber threats, including phishing and spam, resulting in billions of dollars in annual financial losses. While state-of-the-art deep learning (DL) models have demonstrated high precision in static environments, they frequently suffer from performance degradation when deployed in dynamic, streaming environments—a phenomenon known as concept drift. Furthermore, traditional approaches to model updating lead to catastrophic forgetting, where the model’s weights are overwritten, affecting the ability to identify historical threat patterns. This paper presents a novel continual graph-based learning framework for fraudulent email detection (CGL-FED) that integrates a domain-specific fine-tuned DistilBERT encoder with a graph neural network (GNN) architecture. Unlike traditional instance-based graphs, CGL-FED maps contextual embeddings into a fixed-topology feature graph, ensuring structural stability and computational efficiency. To mitigate the forgetting challenge, the framework employs a rehearsal-based replay memory enhanced by segment-based masking. The extensive evaluation conducted on a large-scale corpus utilizing five benchmark datasets (Trec07p, Enron, SpamAssassin, Ling-Spam, and Nazario), shows that CGL-FED achieves state-of-the-art accuracy, reaching up to 100%. Additionally, it maintains an average cumulative forgetting rate of less than 0.005%. The proposed framework offers a robust, scalable, and industrial-ready solution for maintaining high-fidelity persistent identification of fraudulent messages in real-time cybersecurity operations.