Abstract

Phishing attacks carried out through deceptive emails sustain a relationship of critical risk and threat to personal and organizational cybersecurity. To assess techniques used to target and identify phishing emails, this study integrates the analysis of emails, URLs, NLP, and the associated metadata. In addition to Random Forest and XGBoost, the outreach of the analysis to deep learning neural networks, specifically Convolutional Neural Networks (CNN), was examined in detail. The analyses were carried out on a public Phishing Email Dataset from Kaggle. CNN model performance results indicate an accuracy of 91.2% with a 92.1% precision, 89.7% recall, and an F1 score of 90.9%. The performance results are indicative of the model detecting phishing emails based on structural and linguistic features; however, the results are also indicative of the simplicity and potential bias of the dataset rather than an actual reflection of real-world performance, given the 80:20 train-test split without a separate validation set, potential redundancy in the dataset, and manual feature fusion with embeddings without clearly detailed methodology. Although the potential is clear, the approach captures better than a false-positive single-detection method. This paper proposes a multi-layered phishing detection framework that includes Natural Language Processing (NLP) for content analysis, metadata in emails, and URL tokens, aiming to uncover advanced phishing attacks by approaching the problem from many different angles, and compares the efficacy of CNN with standard machine learning frameworks to find the optimal detection method.