Development of an Email Phishing Detection System Using TF–IDF Feature Extraction and Machine Learning Algorithms

Abstract

- The rapid expansion of digital communication has established email as a primary medium for information exchange among individuals, businesses, and organisations. This widespread reliance has contributed to a marked increase in phishing attacks, in which cybercriminals impersonate legitimate entities to obtain sensitive information, including login credentials, financial data, and personal details. Traditional phishing detection methods, including rule-based filters and blacklist mechanisms, have proven increasingly insufficient against sophisticated and evolving phishing strategies. As a result, there is a critical need for intelligent and adaptive detection systems capable of accurately identifying phishing emails. This study presents the development of an intelligent Email Phishing Detection System utilising supervised machine learning algorithms to enhance email security and protect users from phishing threats. A publicly available dataset containing both phishing and legitimate email messages was employed for model training and evaluation. The dataset underwent preprocessing steps including text cleaning, tokenisation, stop-word removal, and feature extraction using the Term Frequency – Inverse Document Frequency (TF – IDF) technique. Five supervised machine learning algorithms — Logistic Regression, Naïve Bayes, Decision Tree, Random Forest, and Support Vector Machine (SVM) — were trained and evaluated using standard performance metrics: accuracy, precision, recall, and F1-score. Experimental results indicated that the Support Vector Machine (SVM) outperformed the other classification models, achieving an accuracy of 99.1%, precision of 99.0%, recall of 99.1%, and an F1-score of 99.0%. Due to its superior performance, the SVM model was selected for deployment in the developed system. The proposed phishing detection system was implemented as a desktop application using Python's Tkinter graphical user interface (GUI), allowing users to input email content and receive real-time predictions regarding the legitimacy of emails. The findings demonstrate that machine learning techniques, particularly the Support Vector Machine algorithm, offer a highly accurate, reliable, and efficient approach to phishing email detection. Integrating the trained SVM model into a user-friendly desktop application provides a practical, lightweight, and scalable solution that enhances email security, reduces false detections, and assists users in more effectively identifying phishing attempts.