Phishing Email Detection Using NLP

The problem is to identify potentially deceptive emails from message content and available metadata while reducing false positives and providing understandable reasons for the prediction. 1.2 Objectives

• Build a modular workflow for processing authorised email samples.
• Clean and represent text using reproducible NLP preprocessing.
• Compare baseline text-classification models using a held-out test set.
• Optionally combine text features with URL and header indicators.
• Present risk estimates and supporting signals for human review. 1.3 Scope The design is intended for an academic prototype and defensive email triage. It does not automatically delete, forward, or block messages. Any email data used for development must be obtained with permission and handled according to privacy and institutional requirements.

Research on spam and phishing classification has used keyword rules, sender reputation, URL analysis, traditional machine learning, and deep neural networks. Text classifiers based on bag-of-words or TF-IDF representations can provide strong, efficient baselines for email datasets. Logistic Regression and Support Vector Machines are commonly used for high - dimensional sparse text features, while more complex language models can capture contextual patterns at greater computational cost. 22AI-Based Cyber Threats Detection System | Page 2Phishing Email Detection Using NLP | Page 2 Public corpora such as Enron email data support email-processing research but are not, by themselves, a current labelled phishing benchmark. Phishing datasets may vary in collection period, class balance, language, and labelling process. Models can appear to perform well if duplicates, campaign-specific phrases, or dataset artefacts leak between training and testing sets. Evaluation should therefore use careful splitting and, where possible, a time -separated test set.

A practical prototype must balance classification quality with latency, privacy, explainability, and robustness to changing attack language. This proposal emphasises a transparent baseline, leakage -aware evaluation, optional multi-signal features, and human verification rather than unsupported claims of perfect detection.

The proposed system receives an authorised email sample, extracts the subject, body text, and permitted metadata, and removes or masks sensitive information where feasible. The NLP pipeline normalises text and converts it into numerical features. A trained classifier estimates whether the message resembles phishing examples. The system records the prediction, model version, and selected indicators and shows them to a reviewer.

Figure 1. Proposed processing flow (conceptual): Authorised Email Sample → Safe Parsing & Privacy Filtering → Text Cleaning / Tokenisation → TF-IDF Features + Optional URL/Header Features → Classifier → Risk Result → Human Review

A student implementation can use Python, Pandas, and scikit-learn for data processing and modelling; FastAPI for an inference API; SQLite or PostgreSQL for review metadata; and a simple web interface for reviewing results. The model and text vectoriser should be saved and versioned together so that inference uses the same feature transformation as training. 4. Methodology

Use a documented, legally accessible dataset containing labelled legitimate and phishing emails. Verify the licence, data provenance, and label definitions before use. Remove or mask personal identifiers where possible. Keep a record of dataset version and collection dates. The manuscript does not claim that any dataset has already been downloaded or that experiments have been completed.

Parse subject and body consistently; decode text safely and handle HTML content without executing it.

• Normalise whitespace and character encoding while preserving potentially meaningful indicators such as URLs and domain strings in separate features.
• Split data before fitting the vectoriser; fit vocabulary and IDF weights on training data only.
• Remove exact duplicates and check near-duplicates or campaign overlap across partitions.
• Use stratified splitting for class balance and a time-based split when timestamps permit.
• Do not place test examples in training-time oversampling or feature selection.

TF-IDF represents words or n-grams according to their frequency in a message and their relative rarity across the training corpus. Word n-grams can capture phrases such as requests for account verification; character n -grams can help identify obfuscated wording and spelling variations. Logistic Regression and Linear SVM are suitable baseline classifiers for sparse text. Optional features include the presence of a URL, mismatch between displayed link text and destination, sender -domain 33AI-Based Cyber Threats Detection System | Page 3Phishing Email Detection Using NLP | Page 3 characteristics, and authentication results when these are available and permitted. Features should not expose secrets or rel y on a single brittle heuristic.

The model should return a class estimate and, where supported, a calibrated probability or decision score. A configurable threshold maps the score to a review category such as low, medium, or high concern. The interface should show why a message was flagged—for example, suspicious wording or URL indicators—without claiming that these signals prove an attack. A user or analyst should be able to mark a result as correct or incorrect for later quality review.

1. Load authorised labelled email records. 2. Validate fields and anonymise where appropriate. 3. Split data into training, validation, and test partitions. 4. Fit preprocessing and TF-IDF on training data. 5. Train baseline classifiers and tune using validation data. 6. Evaluate once on held-out test data. 7. Save model, vectoriser, and version metadata. 8. Score new approved samples and route uncertain results to human review.

Require authentication for access to uploaded messages and predictions.

• Restrict who can view original email content; store only what is necessary.
• Do not execute attachments, scripts, or remote content during parsing.
• Keep credentials outside source code and use encrypted transport.
• Limit file size and validate file type before parsing.
• Provide retention and deletion controls for samples and review records.

No numeric results are reported because no controlled experiment has been performed for this manuscript. A completed study should compare at least two baseline models and include per-class results, error analysis, and a time-separated evaluation if feasible.

7.1 Advantages • TF-IDF and linear models are relatively lightweight and reproducible. 44AI-Based Cyber Threats Detection System | Page 4Phishing Email Detection Using NLP | Page 4 • Text features can identify suspicious patterns beyond fixed sender blocklists. • Optional metadata can provide complementary signals. • Human review and stored model versions support traceability. 7.2 Limitations • Attackers can alter wording, use images, or obfuscate links to evade text models. • Dataset bias and outdated samples can reduce performance on new campaigns. • Legitimate security notifications may resemble phishing and cause false positives. • Email content is sensitive and requires careful access and retention controls. • A model score is an estimate and should not be treated as proof of maliciousness.

The system should only process messages that the developer or organisation is authorised to analyse. Email content may include personal or confidential information, so collection should be minimised, access restricted, and retention limited. Predictions should support security awareness and human review, not be used as the sole basis for punitive decisions. The system must not be used to craft, distribute, or improve phishing campaigns.

Future improvements may include multilingual phishing detection, contextual language models, safe URL reputation enrichment, domain authentication signals, attachment metadata analysis in a sandbox, drift monitoring, and integration with an approved mail-security gateway. These extensions require separate testing, privacy review, and evaluation against current datasets. 10. Conclusion This paper proposed an NLP-based phishing email detection system using safe email parsing, text preprocessing, TF -IDF features, supervised classification, optional metadata, and human-reviewed alerts. It sets out a reproducible evaluation approach using precision, recall, F1-score, false-positive rate, and latency. The system is suitable as a starting point for an academic prototype, but its effectiveness must be demonstrated through controlled experiments and testing on data representative of the intended environment.