Why Phishing Emails Escape Detection: A Closer Look at the Failure Points

This research uncovers why phishing emails often escape machine learning (ML) detection algorithms. For training and testing ML algorithms in detecting phishing emails, we produce and publicly release 11 curated datasets consisting of 217,470 emails categorized and labeled as phishing and legitimate emails. Then, we perform a quantitative analysis to assess the effectiveness of five ML algorithms and confirm the suitability of our curated datasets. Through an in-depth analysis of mis-classified emails, we identify patterns indicating when ML fails to detect phishing emails. These findings inform the design and development of better phishing email filtering systems while our datasets will allow further studies in this direction.