NLP-Based Phishing Email Detection System: Multi-Model Comparison and TF-IDF Feature Engineering Practice

This article introduces the Phishing-Email-Detector project, which uses natural language processing (NLP) technology to build a phishing email detection system. It compares four models: logistic regression, random forest, naive Bayes, and neural networks, and explores the combined application of TF-IDF text features and metadata features. The project covers the complete workflow from data preprocessing to model deployment, providing a benchmark reference for phishing email detection and having learning value for beginners in NLP security applications.

Phishing emails are one of the most common attack methods in the field of cybersecurity; over 90% of cyberattacks start with phishing emails. Traditional detection relies on rule engines and blacklists, which struggle to cope with evolving attack techniques. Machine learning and NLP technologies identify suspicious patterns by analyzing email content, structure, and metadata, bringing new possibilities to phishing detection.

Data Collection and Preprocessing: Legitimate and phishing email samples are required (e.g., Enron, SpamAssassin corpora). Preprocessing includes text cleaning (removing HTML/special characters), tokenization standardization, and stopword filtering.

Feature Engineering: Combine TF-IDF text features (measuring word importance, capturing suspicious words like "urgent") with metadata features (sender domain, link features, HTML structure, attachment information, time features) to build comprehensive detection features.

The project compares four models:

1. Logistic Regression: Fast training, strong interpretability, but difficult to capture non-linear relationships;
2. Naive Bayes: Extremely fast training, friendly to small samples, but relies on the feature independence assumption;
3. Random Forest: Captures non-linear interactions, strong robustness, but long training time;
4. Neural Network: Strong expressive power, automatic feature learning, but requires large amounts of data and has poor interpretability.

Evaluation Metrics: Due to data imbalance, comprehensive metrics such as precision, recall, F1 score, AUC-ROC, and confusion matrix are needed.

Deployment Key Points: Real-time performance (naive Bayes/logistic regression are the fastest), model updates (incremental learning, version management, A/B testing), adversarial defense (adversarial training, ensemble models, continuous monitoring).

Future exploration directions include:

• Advanced Deep Learning: Pretrained models such as CNN, LSTM/GRU, BERT;
• Multimodal Fusion: OCR for image text extraction, image classification, attachment analysis;
• Graph Neural Networks: Modeling sender relationship graphs and link relationship graphs;
• Federated Learning: Multi-party collaborative training to protect data privacy.

This project demonstrates a complete machine learning security application workflow, providing a benchmark reference for phishing detection. It is an excellent learning case for beginners, covering core text classification technologies and special challenges in the security field (such as imbalanced data and adversarial attacks). The efficiency and interpretability of traditional ML methods still have value, while pretrained models like Transformer are expected to further improve accuracy.