Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

Enhancing Phishing Email Identification with Large Language Models

T0 review · 4 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that an open-source large language model, Llama-3.1-70b, can identify phishing emails with 97.21% accuracy while also generating a human-readable explanation for each decision.

desk verdict A clean but narrow LLM-phishing benchmark whose 500–2000-character filter likely inflates the headline accuracy and precision. read the letter →

arxiv 2502.04759 v1 pith:KL7BAXOQ submitted 2025-02-07 cs.CR cs.AI

Catherine Lee This is my paper · ORCID
classification cs.CRcs.AI
keywords phishingdetectionlargelanguagemodelsLlama-3.1promptengineeringhybridfeatureselectionemailclassificationinterpretabilityfalsepositiveanalysis
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that large language models, used with a prompt that asks for a verdict, a risk level, and the social-engineering cues behind the verdict, can detect phishing emails accurately enough for real deployment. Across a combined, cleaned dataset of 6,867 emails, the strongest open model, Llama-3.1-70b, reaches 97.21% accuracy with 98.10% precision and 98.00% recall, while also producing a human-readable explanation for every decision. The author presents this as evidence that an open-source LLM can match the accuracy of dedicated machine-learning detectors while adding interpretability that traditional classifiers lack. The study also examines false positives and false negatives to identify where LLM judgment fails, such as personalized spear-phishing and shortened URLs.

What carries the argument

The machinery is a prompt-engineered LLM classifier built on four hybrid text features: email subject, sender information, body content, and embedded URLs. Each email is normalized into a single 'SUBJECT: ... FROM: ... EMAIL: ...' string, cleaned by stripping HTML and emojis, filtered to 500–2000 characters, and fed to the LLM with a role prompt plus a JSON output schema. The model returns Is_Phishing, Risk, Social_Engineering_Elements, Actions, and Reason; the structured output is what turns a general-purpose language model into an auditable phishing detector. The dataset is assembled from six public sources covering traditional, spear, and GenAI phishing, which gives the evaluation a wider range of attack styles than earlier LLM studies.

What would settle it

Re-run Llama-3.1-70b with the same prompt on an unfiltered corpus that includes emails under 500 and over 2000 characters, or on a test set with every label manually verified; if accuracy drops well below 97.21%, the reported result is an artifact of the filtering or the noisy labels.

Watch

Extended reading notes

Core claim

The central discovery is that an open-source LLM, Llama-3.1-70b, when given a structured prompt containing the email's subject, sender, body, and links, classifies phishing emails with 97.21% accuracy, 98.10% precision, and 98.00% recall on a filtered test set of 6,867 emails drawn from six public datasets. The model outperforms three other open LLMs—Gemma2-9b at 95.29%, Llama-3-8b at 92.39%, and Mistral-large-latest at 87.95%—and, unlike a black-box classifier, returns a JSON explanation listing the social engineering elements, a risk score, recommended actions, and a written reason. The paper's error analysis shows that LLMs are fooled by highly personalized spear-phishing and by shortened URLs, and that some dataset labels are likely incorrect, which qualifies the headline accuracy as a measure on that particular filtered corpus.

Load-bearing premise

The accuracy numbers assume the filtered, six-dataset test set fairly represents phishing emails, but the filter drops short and long emails and the paper itself says some labels are likely incorrect.

Editorial extensions

If this is right

  • The strongest open-weight model, Llama-3.1-70b, can be embedded in an email pipeline that filters trusted senders, classifies the rest, and moves flagged messages to spam with an explanation for the user.
  • With a false-positive rate of 4.7%, an LLM detection layer can be added to existing filters without burying legitimate mail in the spam folder.
  • The structured JSON output gives security teams an audit trail: each alert lists the specific social-engineering cues the model found, so a human can verify the decision.
  • The error analysis implies that adding a URL-reputation layer and training on spear-phishing examples would close the gaps that personalized emails and shortened links currently exploit.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the dataset labels are as noisy as the paper's own analysis suggests, the true accuracy on a clean, manually verified corpus may be lower than 97.21%, and the ranking between models could shift.
  • The 500–2000 character filter removes one-line lures and long newsletters, so deploying this system would require separate handling for very short and very long emails.
  • The prompting and JSON-schema recipe is model-agnostic and could be used as a benchmark for comparing future open-weight LLMs on phishing detection without fine-tuning.
  • A balanced evaluation set would clarify whether the high recall of the smaller models reflects genuine detection strength or a bias toward the majority phishing class.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes using large language models (LLMs) to identify phishing emails. It combines six public datasets, applies a custom HTML-to-text pipeline and a 500–2000 character length filter, and evaluates four open-weight LLMs (Llama-3.1-70b, Gemma2-9b, Llama-3-8b, Mistral-large-latest) with a prompt that asks for a JSON output containing a phishing label, risk level, social engineering elements, actions, and reasoning. The central result is reported in Section IV: Llama-3.1-70b achieves 97.21% accuracy, 98.10% precision, 98.00% recall, and a 4.7% false positive rate on the filtered test set. The paper also analyzes false positives and false negatives, proposes a reliability score, and sketches an integration framework for email services.

Significance. If the headline result is robust, the paper provides useful evidence that open-weight LLMs can classify phishing emails with high accuracy while producing interpretable explanations, and it extends prior work by evaluating multiple open models on a larger combined dataset than many earlier studies. The paper's strengths include the use of several heterogeneous public datasets, a concrete prompt schema, and a candid discussion of labeling problems and URL-analysis limitations. However, the external validity of the central claim is substantially weakened by the class-dependent length filter, the absence of uncertainty quantification, and the lack of a strong non-LLM baseline evaluated on the same filtered data. These issues are fixable, but they are load-bearing for the claim that LLMs 'enhance' phishing identification.

major comments (4)
  1. [Section III.B] The 500–2000 character length filter is strongly class-dependent. From Table 1, the raw datasets contain approximately 12,279 legitimate and 13,912 phishing emails; the final counts of 1,962 legitimate and 4,904 phishing imply that only about 16% of legitimate emails survive the filter versus about 35% of phishing emails, shifting the prevalence from roughly 53% phishing in the raw data to about 71% in the final set. Since the final set is the only test set, the reported 97.21% accuracy, 98.10% precision, and 4.7% FPR in Section IV are conditional on this unvalidated preprocessing choice; short transactional notices and long newsletters are discarded without analysis. The paper should quantify what the filter removes (for example, length distributions by class and dataset, and metrics on the unfiltered data or on length-stratified subsets) before the headline numbers can be taken as representative of real email streams.
  2. [Section IV, Table 2] The results are reported from a single evaluation pass per model, with no confidence intervals, repeated trials, or significance tests, and the decoding parameters (such as temperature and number of samples) are not specified. The headline claim that 'Llama-3.1-70b stands out' rests on a 1.92 percentage point accuracy gap over Gemma2-9b, which may be within run-to-run variability for stochastic LLM inference. The authors should report multiple runs with standard deviations and, ideally, paired statistical tests, or temper the ranking claims accordingly.
  3. [Section II vs. Section IV] The paper reviews classical ML and NLP baselines but never trains or evaluates any of them on the Section III.B dataset. The final test set is 71% phishing, so a trivial always-phishing classifier already achieves 71.4% accuracy, and the reported 87.95–97.21% accuracy range should be compared against an in-scope baseline (for example, TF-IDF with logistic regression or random forest, or a fine-tuned BERT-style model) under identical filtering and label conditions. Without such a comparison, the central claim that LLMs enhance phishing identification is not established.
  4. [Section V.B] The paper itself notes that some emails 'may have been incorrectly annotated' and that malicious URLs may have been lost during conversion to plain text. This is presented only as a limitation, but it directly threatens the ground truth used for every metric in Table 2. The authors should validate a sample of labels (for example, through human review with inter-annotator agreement) or perform a label-noise sensitivity analysis; otherwise the reported 98.10% precision figure is based on labels taken on trust.
minor comments (6)
  1. [Section III.B] The length criterion 'between 500 to 2000 characters' is not precisely defined: it should state whether the count applies to the concatenated SUBJECT/FROM/EMAIL string or to the body alone, and whether it is measured before or after HTML tag removal.
  2. [Section IV, Table 2] Every confusion matrix in Table 2 sums to 6,866 examples rather than the 6,867 emails stated in Section III.B; this one-instance discrepancy should be reconciled because all metrics depend on the denominator.
  3. [Throughout] There are several typographical errors: 'Mistrial' should be 'Mistral', 'mythological steps' in Section III should be 'methodological steps', and 'CONCUSSION' in Section VI should be 'CONCLUSION'.
  4. [Section IV, reliability score] The half-credit rule for medium-risk correct predictions is ad hoc and not justified; since it is not needed for the main accuracy claim, the authors should either provide a principled justification or remove it from the analysis.
  5. [Section III.C] The JSON schema uses 'List' as a type, which is not a standard JSON Schema primitive; it should be 'array' with an 'items' definition, and the prompt should ensure that models do not emit extra prose outside the structured output.
  6. [Section II] The related work cites ChatSpamDetectors with 99.70% precision, recall, and accuracy on GPT-4; the discussion should explicitly position the current results against that prior result rather than only claiming the current study uses larger datasets.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: classification performance is measured against external public datasets, and no reported result reduces to its inputs by construction.

full rationale

This paper is an empirical evaluation, not a derivation. The central claim (Section IV: Llama-3.1-70b accuracy 97.21%, precision 98.10%, recall 98.00%) is a measurement of a pre-trained model on held-out ground-truth labels from six public datasets. The labels enter only as evaluation targets; they are not used to construct the prompt, select the models, or compute a fitted parameter that is then re-reported as a prediction. The custom prompt (Section III.C) and the reliability score (Section V, Figure 3) are defined independently of the accuracy results: the reliability score is a weighted accuracy-like aggregate based on predicted risk and true class, and it is not used to generate the classifications. The 500-2000 character length filter (Section III.B) is a preprocessing choice that may affect external validity, and the paper's own Section V.B acknowledges possible label noise; these are correctness or representativeness concerns, not circularity, because the filter and labels are not derived from the reported metrics. There are no load-bearing self-citations, no imported uniqueness theorem, and no ansatz smuggled in via the author's prior work. A minor inconsistency (Table 2 rows sum to 6866 rather than the stated 6867) is an arithmetic issue, not a circular step. The derivation chain therefore contains no step that is equivalent to its inputs by definition.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the assembled dataset's label quality, the representativeness of the length-filtered subset, and the determinism of single-shot LLM inference. Three hand-chosen thresholds affect the test distribution, and the reliability metric is defined ad hoc. No new entities are introduced.

free parameters (3)
  • Length filter bounds = 500 to 2000 characters
    Section III.B discards emails outside this range; this is a hand-chosen threshold that changes the test distribution and is not justified.
  • URL token limit = 10 tokens
    Section III.B limits preserved URL paths to the first ten tokens; this could hide malicious links and is a hand-chosen value.
  • Reliability half-credit rule = 0.5 for medium risk with true phishing
    Section IV defines a custom reliability score that assigns half a mark in one case; this ad hoc scoring is not a standard metric.
assumptions (4)
  • domain assumption Source dataset class labels are correct.
    The combined dataset uses labels from six public sources; Section V.B admits some emails 'may have been incorrectly annotated.'
  • domain assumption Concatenated SUBJECT/FROM/EMAIL text preserves the features needed for detection.
    Section III.B formats all emails into one string; URLs are truncated and hidden text handling may remove evidence, acknowledged in Section V.B.
  • domain assumption The length-filtered subset is representative of phishing email distribution.
    Section III.B keeps only emails of 500 to 2000 characters; no analysis of excluded emails is provided.
  • domain assumption LLM outputs are deterministic and a single run suffices.
    Section IV reports a single set of numbers per model without repeated trials or temperature settings.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enhancing Phishing Email Identification with Large Language Models." pith.science (2026). https://pith.science/paper/KL7BAXOQ

@misc{pith2026250204759,
  author       = {Pith},
  title        = {Pith review of: Enhancing Phishing Email Identification with Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KL7BAXOQ}},
  note         = {Machine review of arXiv:2502.04759}
}
read the original abstract

Phishing has long been a common tactic used by cybercriminals and continues to pose a significant threat in today's digital world. When phishing attacks become more advanced and sophisticated, there is an increasing need for effective methods to detect and prevent them. To address the challenging problem of detecting phishing emails, researchers have developed numerous solutions, in particular those based on machine learning (ML) algorithms. In this work, we take steps to study the efficacy of large language models (LLMs) in detecting phishing emails. The experiments show that the LLM achieves a high accuracy rate at high precision; importantly, it also provides interpretable evidence for the decisions.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Evaluating Large Language Models for Phishing Detection, Self-Consistency, Faithfulness, and Explainability

    cs.CR 2025-06 conditional novelty 5.0 of 10

    Fine-tuned LLMs for phishing detection show a dissociation between self-consistent explanations and classification accuracy, with Llama models scoring high on CC-SHAP but low on phishing detection while Wizard scores ...

Reference graph

Works this paper leans on

42 extracted references · 30 canonical work pages · cited by 1 Pith paper

  1. [1]

    Phishing activity trends report, 2nd quarter 2024, https://docs.apwg.org/reports/apwg_trends_report_q2_2024.pdf

    work page 2024

  2. [2]

    Hybrid Feature Selection for Phishing Email Detection,

    A. Hamid and J. H. Abawajy, “Hybrid Feature Selection for Phishing Email Detection,” pp. 266 –275, Jan. 2011, doi: https://doi.org/10.1007/978-3-642-24669-2_26

    work page doi:10.1007/978-3-642-24669-2_26 2011

  3. [3]

    Generative Adversarial Networks for Synthetic Training Data Replacement in Phishing Email Detection Using Natural Language Processing,

    L. Jovanovic, Nebojsa Bacanin, R. Ravikumar, Milos Antonijevic, G. Radic, and M. Zivkovic, “Generative Adversarial Networks for Synthetic Training Data Replacement in Phishing Email Detection Using Natural Language Processing,” Algorithms for intelligent systems, pp. 607–618, Jan. 2024, doi: https://doi.org/10.1007/978-981- 97-3191-6_46

    doi:10.1007/978-981- 2024

  4. [4]

    Phishing email detection technique by using hybrid features,

    Lew May Form, Kang Leng Chiew, San Nah Sze and Wei King Tiong, "Phishing email detection technique by using hybrid features," 2015 9th International Conference on IT in Asia (CITA), Sarawak, Malaysia, 2015, pp. 1-5, doi: 10.1109/CITA.2015.7349818

    work page arXiv 2015

  5. [5]

    A Comparison of Natural Language Processing and Machine Learning Methods for Phishing Email Detection,

    P. Bountakas, K. Koutroumpouchos, and C. Xenakis, “A Comparison of Natural Language Processing and Machine Learning Methods for Phishing Email Detection,” The 16th International Conference on Availability, Reliability and Security , Aug. 2021, doi: https://doi.org/10.1145/3465481.3469205

    work page arXiv 2021

  6. [6]

    Large Language Models in Cybersecurity: State -of-the- Art,

    F. N. Motlagh, M. Hajizadeh, M. Majd, P. Najafi, F. Cheng, and C. Meinel, “Large Language Models in Cybersecurity: State -of-the- Art,” arXiv.org, Jan. 30, 2024. https://arxiv.org/abs/2402.00891

    arXiv 2024

  7. [7]

    Extended Abstract: Assessing Language Models for Semantic Textual Similarity in Cybersecurity,

    A. Soltani, DJeff Kanda Nkashama, J. F. Masakuna, M. Frappier, P. - M. Tardif, and Froduald Kabanza, “Extended Abstract: Assessing Language Models for Semantic Textual Similarity in Cybersecurity,” Lecture notes in computer science , pp. 370–380, Jan. 2024, doi: https://doi.org/10.1007/978-3-031-64171-8_19

    work page doi:10.1007/978-3-031-64171-8_19 2024

  8. [8]

    A machine learning approach towards phishing email detection CEN - Security@IWSPA 2018,

    N.B. Harikrishnan, R. Vinayakumar, K. P. Soman, and Das, “A machine learning approach towards phishing email detection CEN - Security@IWSPA 2018,” CEUR Workshop Proceedings , vol. 2124, Jan. 2018

    work page 2018

Show all 42 references
  1. [9]

    Cyber Threat Hunting Using Large Language Models,

    Vinayak Tanksale, “Cyber Threat Hunting Using Large Language Models,” Lecture notes in networks and systems , pp. 629 –641, Jan. 2024, doi: https://doi.org/10.1007/978-981-97-3289-0_50

    2024 doi

  2. [10]

    GitHub - rf-peixoto/phishing_pot: A collection of phishing samples for researchers and detection developers.,

    rf-peixoto, “GitHub - rf-peixoto/phishing_pot: A collection of phishing samples for researchers and detection developers.,” GitHub, 2022. https://github.com/rf-peixoto/phishing_pot

    2022

  3. [11]

    A Systematic Review of Deep Learning Techniques for Phishing Email Detection,

    P. H. Kyaw, J. Gutierrez, and A. Ghobakhlou, “A Systematic Review of Deep Learning Techniques for Phishing Email Detection,” Electronics, vol. 13, no. 19, p. 3823, Sep. 2024, doi: https://doi.org/10.3390/electronics13193823

    2024 doi

  4. [12]

    How Spammers are Abusing Twitter’s t.co URL Shortener | Cloudmark EN,

    “How Spammers are Abusing Twitter’s t.co URL Shortener | Cloudmark EN,” Cloudmark.com, Aug. 06, 2014. https://www.cloudmark.com/en/blog/how-spammers-are-abusing- twitters-tco-url-shortener

    2014

  5. [13]

    HELPHED: Hybrid Ensemble Learning PHishing Email Detection,

    P. Bountakas and C. Xenakis, “HELPHED: Hybrid Ensemble Learning PHishing Email Detection,” Journal of Network and Computer Applications, vol. 210, p. 103545, Jan. 2023, doi: https://doi.org/10.1016/j.jnca.2022.103545

    2023

  6. [14]

    Phishing Email Detection Using Natural Language Processing Techniques: A Literature Survey,

    S. Salloum, T. Gaber, S. Vadera, and K. Shaalan, “Phishing Email Detection Using Natural Language Processing Techniques: A Literature Survey,” Procedia Computer Science, vol. 189, pp. 19 –28, 2021, doi: https://doi.org/10.1016/j.procs.2021.05.077

    2021 doi

  7. [15]

    From ChatGPT to ThreatGPT: Impact of Generative AI in Cybersecurity and Privacy,

    M. Gupta, C. Akiri, K. Aryal, E. Parker, and L. Praharaj, “From ChatGPT to ThreatGPT: Impact of Generative AI in Cybersecurity and Privacy,” IEEE Access , vol. 11, pp. 80218 –80245, Aug. 2023, doi: https://doi.org/10.1109/ACCESS.2023.3300381

    2023

  8. [16]

    Phishing Attacks: A Recent Comprehensive Study and a New Anatomy,

    Z. Alkhalil, C. Hewage, L. Nawaf, and I. Khan, “Phishing Attacks: A Recent Comprehensive Study and a New Anatomy,” Frontiers in Computer Science , vol. 3, no. 1, pp. 1 –23, Mar. 2021, doi: https://doi.org/10.3389/fcomp.2021.563060

    2021

  9. [17]

    How effective are large language models in detecting phishing emails?

    J. Hua, P. Wang, and P. Lutchkus, "How effective are large language models in detecting phishing emails?" Issues in Information Systems , vol. 25, no. 3, pp. 327 -341, 2024. doi: https://doi.org/10.48009/3_iis_2024_125

    2024 doi

  10. [18]

    A Systematic Review on Deep -Learning-Based Phishing Email Detection,

    K. Thakur, M. L. Ali, M. A. Obaidat, and A. Kamruzzaman, “A Systematic Review on Deep -Learning-Based Phishing Email Detection,” Electronics, vol. 12, no. 21, p. 4545, Jan. 2023, doi: https://doi.org/10.3390/electronics12214545

    2023 doi

  11. [19]

    A Systematic Literature Review on Phishing Email Detection Using Natural Language Processing Techniques,

    S. Salloum, T. Gaber, S. Vadera, and K. Shaalan, “A Systematic Literature Review on Phishing Email Detection Using Natural Language Processing Techniques,” IEEE Access, vol. 10, pp. 65703 – 65727, 2022, doi: https://doi.org/10.1109/access.2022.3183083

    2022

  12. [20]

    Phishing and Social Engineering in the Age of LLMs,

    S. Gallagher et al. , “Phishing and Social Engineering in the Age of LLMs,” pp. 81–86, Jan. 2024, doi: https://doi.org/10.1007/978-3-031- 54827-7_8

    2024 doi

  13. [21]

    Large Multimodal Agents for Accurate Phishing Detection with Enhanced Token Optimization and Cost Reduction,

    F. Trad and A. Chehab, “Large Multimodal Agents for Accurate Phishing Detection with Enhanced Token Optimization and Cost Reduction,” arXiv.org, 2024. https://arxiv.org/abs/2412.02301

    2024 arXiv

  14. [22]

    Large Language Models Meet NLP: A Survey,

    L. Qin et al. , “Large Language Models Meet NLP: A Survey,” arXiv.org, 2024. https://arxiv.org/abs/2405.12819

    2024 arXiv

  15. [23]

    GPT -4 Technical Report,

    OpenAI, “GPT -4 Technical Report,” arXiv:2303.08774 [cs] , Mar. 2023, doi: https://doi.org/10.48550/arXiv.2303.08774

    2023 doi arXiv

  16. [24]

    Enhancing phishing email detection with stylometric features and classifier stacking,

    Ilias Chanis and Avi Arampatzis, “Enhancing phishing email detection with stylometric features and classifier stacking,” International Journal of Information Security , vol. 24, no. 1, Nov. 2024, doi: https://doi.org/10.1007/s10207-024-00928-7

    2024 doi

  17. [25]

    How Good Are We at Detecting a Phishing Attack? Investigating the Evolving Phishing Attack Email and Why It Continues to Successfully Deceive Society,

    F. Carroll, J. A. Adejobi, and R. Montasari, “How Good Are We at Detecting a Phishing Attack? Investigating the Evolving Phishing Attack Email and Why It Continues to Successfully Deceive Society,” SN Computer Science , vol. 3, no. 2, Feb. 2022, doi: https://doi.org/10.1007/s4...

    2022 doi

  18. [26]

    Improving Phishing Email Detection Using the Hybrid Machine Learning Approach,

    Naveen Palanichamy and Yoga Shri Murti, “Improving Phishing Email Detection Using the Hybrid Machine Learning Approach,” Australian Journal of Telecommunications and the Digital Economy, vol. 11, no. 3, pp. 120 –142, Sep. 2023, doi: https://doi.org/10.18080/jtde.v11n3.778

    2023 doi

  19. [27]

    Detecting Scams Using Large Language Models,

    L. Jiang, “Detecting Scams Using Large Language Models,” arXiv.org, Feb. 05, 2024. https://arxiv.org/abs/2402.03147

    2024 arXiv

  20. [28]

    ChatSpamDetector: Leveraging Large Language Models for Effective Phishing Email Detection,

    T. Koide, N. Fukushi, H. Nakano, and D. Chiba, “ChatSpamDetector: Leveraging Large Language Models for Effective Phishing Email Detection,” arXiv.org, 2024. https://arxiv.org/abs/2402.18093

    2024 arXiv

  21. [29]

    Detecting Phishing URLs Based on a Deep Learning Approach to Prevent Cyber -Attacks,

    Qazi, M. H. Faheem, and I. Ahmad, “Detecting Phishing URLs Based on a Deep Learning Approach to Prevent Cyber -Attacks,” Applied Sciences, vol. 14, no. 22, pp. 10086 –10086, Nov. 2024, doi: https://doi.org/10.3390/app142210086

    2024 doi

  22. [30]

    Prompted Contextual Vectors for Spear-Phishing Detection,

    D. Nahmias, G. Engelberg, D. Klein, and A. Shabtai, “Prompted Contextual Vectors for Spear-Phishing Detection,” arXiv.org, Feb. 14,

  23. [31]

    Phishing Email Data by Type,

    “Phishing Email Data by Type,” www.kaggle.com. https://www.kaggle.com/datasets/charlottehall/phishing-email-data- by-type

  24. [32]

    Email Spam,

    khashayar Ahmadi, “Email Spam,” Kaggle.com, 2024. https://www.kaggle.com/datasets/khashayarahmadi/email-spam

    2024

  25. [33]

    (2008), CLAIR collection of fraud email, ACL Data and Code Repository, ADCR2008T001, http://aclweb.org/aclwiki

    Radev, D. (2008), CLAIR collection of fraud email, ACL Data and Code Repository, ADCR2008T001, http://aclweb.org/aclwiki

    2008

  26. [34]

    Human -LLM generated phishing -legitimate emails,

    F. Greco, “Human -LLM generated phishing -legitimate emails,” Kaggle.com, 2024. https://www.kaggle.com/datasets/francescogreco97/human-llm- generated-phishing-legitimate-emails

    2024

  27. [35]

    Microsoft Ignite: Redefining email security with LLMs to tackle a new era of social engineering,

    Ramya_Chitrakar, “Microsoft Ignite: Redefining email security with LLMs to tackle a new era of social engineering,” TECHCOMMUNITY.MICROSOFT.COM, Nov. 19, 2024. https://techcommunity.microsoft.com/blog/microsoftdefenderforoffic e365blog/microsoft-ignite-redefining-email-securit...

    2024

  28. [36]

    Devising and Detecting Phishing: Large Language Models vs. Smaller Human Models,

    F. Heiding, B. Schneier, A. Vishwanath, and J. Bernstein, “Devising and Detecting Phishing: Large Language Models vs. Smaller Human Models,” arXiv.org, Aug. 23, 2023. https://arxiv.org/abs/2308.12287

    2023 arXiv

  29. [37]

    From ML to LLM: Evaluating the Robustness of Phishing Webpage Detection Models against Adversarial Attacks,

    A. Kulkarni, V. Balachandran, D. D. Mon, and T. Das, “From ML to LLM: Evaluating the Robustness of Phishing Webpage Detection Models against Adversarial Attacks,” arXiv.org, 2024. https://arxiv.org/abs/2407.20361

    2024 arXiv

  30. [38]

    Novel Interpretable and Robust Web -based AI Platform for Phishing Email Detection,

    A. Al-Subaiey, M. Al-Thani, N. A. Alam, K. F. Antora, A. Khandakar, and S. A. U. Zaman, “Novel Interpretable and Robust Web -based AI Platform for Phishing Email Detection,” arXiv.org, May 19, 2024. https://arxiv.org/abs/2405.11619

    2024 arXiv

  31. [39]

    Anomaly Detection in Emails using Machine Learning and Header Information

    C. Beaman, C. Beaman@unb, and Ca, “Anomaly Detection in Emails using Machine Learning and Header Information.” Available: https://arxiv.org/pdf/2203.10408

    arXiv

  32. [40]

    Machine learning based phishing detection from URLs,

    O. K. Sahingoz, E. Buber, O. Demir, and B. Diri, “Machine learning based phishing detection from URLs,” Expert Systems with Applications, vol. 117, pp. 345 –357, Mar. 2019, doi: https://doi.org/10.1016/j.eswa.2018.09.029

    2019 doi

  33. [41]

    Machine Learning Algorithms Evaluation for Phishing URLs Classification,

    H. BOUIJIJ and A. BERQIA, “Machine Learning Algorithms Evaluation for Phishing URLs Classification,” 2021 4th International Symposium on Advanced Electrical and Communication Technologies (ISAECT), Dec. 2021, doi: https://doi.org/10.1109/isaect53699.2021.9668489

    2021

  34. [2024]

    https://arxiv.org/abs/2402.08309

    arXiv

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.