Aug 2026· International Journal of Innovative Research in Engineering· 0 citations
Abstract
Phishing email detection has been destabilised by Large Language Models (LLMs), which allow attackers to mass-produce fluent, contextually plausible messages. Detectors tuned on legacy corpora, notably the 2008 CEAS spam collection, consequently report benchmark accuracies that do not survive deployment. We present PhishingGAT, a detector that fuses word-level semantic features with structural ones and is hardened against adversarial perturbation. Each email is represented as an undirected graph whose nodes are unique tokens carrying 100-dimensional GloVe embeddings, and whose edges record co- occurrence inside a three-token sliding window. A two-layer Graph Attention Network (GAT) then learns per-edge importance over that graph. Robustness comes from Projected Gradient Descent (PGD) adversarial training, applied to continuous node features during optimisation only. Training uses a hybrid corpus of 70,716 emails assembled from the CEAS collection, the Enron collection, and curated LLM-generated samples. Evaluation follows two protocols. The first is strictly zero-shot: 1,186 unseen LLM-generated adversarial emails, on which the model reaches 77.40 per cent accuracy and an area under the receiver operating characteristic curve (AUC) of 0.8700. The second is domain-adapted: 401 held-out hard samples, on which accuracy rises to 90.27 per cent and AUC to 0.9717. The 12.87 percentage-point difference between the two is, to our knowledge, the first such measurement reported for graph-based phishing detection, and it quantifies a degradation that same-distribution benchmarks systematically hide. An ablation separates the contribution of attention from that of adversarial defence, and repeated runs across independent random seeds confirm that the reported figures are reproducible rather than seed artefacts.
Phishing remains a prevalent cyberattack vector, and the widespread adoption of large language models (LLMs) has enabled adversaries to generate grammatically correct and contextually coherent phishing emails at scale, against which conventional detection systems are less effective. Although stylometric methods achieve over 95% accuracy within a single generator, their performance has not been systematically evaluated when the source model changes between training and deployment. This represents a significant gap, as adversaries can switch generators rapidly. A balanced corpus of 9,986 phishing emails was assembled, comprising 4,986 emails generated by three modern LLMs (GPT-4.1, DeepSeek 3.2, and Llama 3.3 70B) across five thematic categories, and 5,000 human phishing emails sampled in a stratified manner from five public sources. Seventeen stylometric features were extracted, and Logistic Regression and XGBoost classifiers were evaluated under intra-model, cross-model, threshold-recalibrated, cross-dataset, and aggregated-pool settings. Intra-model F1 scores reached 0.96 under stratified cross-validation and 0.999 on held-out splits used for the cross-model matrix. However, cross-model F1 dropped by 28.0 percentage points under the default decision threshold of 0.5. Notably, the area under the receiver operating characteristic curve remained above 0.96 in every off-diagonal cell, indicating that discriminative information is preserved even though the decision threshold is generator-specific. Recalibrating the threshold on a small target subset reduced the gap to 4.0 percentage points (an 86% reduction), and an aggregated-pool detector achieved F1 = 0.997 on each generator. This work reframes cross-model phishing detection from a problem of model incompatibility to one of practical calibration, and provides two deployable solutions, threshold recalibration on a small target slice and aggregated-pool training, along with a publicly released multi-LLM corpus.
Rommel Gutierrez, W. Villegas-Ch., Jaime Govea· Frontiers in Big Data· 0 citations
The Adversarial-Resilient Lightweight Random Forest (AR-LRF) model is proposed, combining controlled ensemble complexity with simulated adversarial perturbations applied during training to mitigate adversarial vulnerabilities.
A. Chaudhuri, M. B· Scientific Reports· 0 citations
Phishing email attacks remain among the most common and damaging forms of cybercrimes. With the emergence of generative artificial intelligence (Gen-AI), adversaries can automatically generate tailored, well-crafted phishing emails for each potential victim rather than relying on mass-distributed templates, thereby reducing the effectiveness of traditional detection systems. In this study, we propose a novel hybrid framework for detecting AI-generated phishing emails that leverages natural language processing (NLP), machine learning (ML), and deep learning (DL). The uniqueness of the proposed approach lies in the dual application of bidirectional encoder representations from transformers (BERT): (1) as an embedding model to extract deep contextual representations of email content; (2) as a fine-tuned classifier. Additionally, we integrate high-impact common-word features, derived from the best-performing classifier, to enhance contextual interpretation and improve discrimination between human-crafted and AI-generated emails. The framework was evaluated on a balanced dataset combining real and Gen-AI phishing emails and benchmarked across six ML/DL models—support vector machine (SVM), random forest (RF), logistic regression (LR), long short-term memory (LSTM) networks, BERT, and generative pre-trained transformer (GPT)—using standardized preprocessing, hybrid feature engineering, and optimized hyperparameters. Experimental results show that the BERT fine-tuned classifier, enhanced with the integrated common-word features, achieved the highest accuracy of 98%, outperforming all other models and demonstrating strong generalizability. This study demonstrates how integrating contextual cues and custom lexical signals can significantly improve the detection of AI-generated phishing content. Cybersecurity professionals, policymakers, and researchers can develop sophisticated and resilient defenses against emerging AI-enabled threats.
Raghad Ghawa, A. Alhogail· Electronics· 0 citations
Phishing attacks remain a major cybersecurity threat, causing financial loss, data breaches, and reputational damage to individuals and organizations. Conventional detection methods, such as rule-based filters and blacklist-based systems, often fail to identify newly generated or highly obfuscated phishing URLs. Recent advances in artificial intelligence, particularly large language models (LLMs), provide new opportunities to detect complex structural and contextual patterns in malicious web addresses. This study evaluates the effectiveness of transformer-based LLMs for phishing URL detection by comparing LLaMA-3 and GEMMA-7B with traditional machine learning models, including Support Vector Machines, Random Forest, and XGBoost. The models were fine-tuned and tested on a publicly available dataset containing 247,950 labeled URLs, each described by 42 structural and lexical features. To support transformer-based classification, structured URL attributes were converted into textual representations, enabling the models to exploit contextual embeddings. Experimental results showed that LLMs outperformed conventional machine learning baselines. GEMMA-7B achieved the best performance, with an accuracy of approximately 94.8%, followed by LLaMA-3 at 94%. These findings suggest that transformer-based models can effectively identify deceptive domain structures, abnormal URL patterns, and obfuscation techniques. Overall, the proposed LLM-based framework offers a promising approach for improving phishing detection and strengthening modern cybersecurity defenses.
L. Eliyan, M. Alshraideh, Bayan Alfayoumi· Journal of integrated scienc...· 0 citations
Email communication remains the primary vector for sophisticated cyber threats, including phishing and spam, resulting in billions of dollars in annual financial losses. While state-of-the-art deep learning (DL) models have demonstrated high precision in static environments, they frequently suffer from performance degradation when deployed in dynamic, streaming environments—a phenomenon known as concept drift. Furthermore, traditional approaches to model updating lead to catastrophic forgetting, where the model’s weights are overwritten, affecting the ability to identify historical threat patterns. This paper presents a novel continual graph-based learning framework for fraudulent email detection (CGL-FED) that integrates a domain-specific fine-tuned DistilBERT encoder with a graph neural network (GNN) architecture. Unlike traditional instance-based graphs, CGL-FED maps contextual embeddings into a fixed-topology feature graph, ensuring structural stability and computational efficiency. To mitigate the forgetting challenge, the framework employs a rehearsal-based replay memory enhanced by segment-based masking. The extensive evaluation conducted on a large-scale corpus utilizing five benchmark datasets (Trec07p, Enron, SpamAssassin, Ling-Spam, and Nazario), shows that CGL-FED achieves state-of-the-art accuracy, reaching up to 100%. Additionally, it maintains an average cumulative forgetting rate of less than 0.005%. The proposed framework offers a robust, scalable, and industrial-ready solution for maintaining high-fidelity persistent identification of fraudulent messages in real-time cybersecurity operations.
Mohammed Abdulwahab, Muneer Almekhlafi, Raeed Al-sabri· 2026 6th International Confe...· 0 citations
Experimental results show that the proposed stacking ensemble consistently achieves the best overall performance, while a moderate augmentation ratio of 25% provides the highest robustness under temporal and cross-dataset evaluation; higher augmentation levels reduce performance.
I. Mamatov· Международный Журнал Теорети...· 0 citations