A Deep Phishing Email Detection Model Combing Multi-Features Based on Word Frequency and Contextual Semantics

Due to the ability to automatically extract phishing features without relying on expert knowledge, deep learning methods have been widely applied in the research of phishing email classification and detection. However, the unique structure of emails and the complexity of publishing strategies mean that current deep learning-based phishing email detection studies still require further performance enhancement. To effectively detect phishing emails, this paper proposes TFW-CNBL (Term Frequency and Word2Vec-CNN and BiLSTM), a deep detection model for phishing emails based on the fusion of term frequency and contextual semantic multi-features. The TFW-CNBL model generates a hybrid feature vector that comprehensively understands the characteristics of phishing emails by integrating term frequency and contextual information. The model combines a convolutional neural network (CNN) with an attention mechanism and a bidirectional long short-term memory network (BiLSTM), creating an underlying architecture capable of rapid text classification. The paper utilized a publicly available dataset from Kaggle containing 18,650 samples to train and test the TFW-CNBL model. Experimental results indicate that the TFW-CNBL model can effectively detect phishing emails, achieving an average accuracy, precision, recall, and F1 score of $0.984,0.986,0.989$, and 0.987, respectively.