Comparative Analysis of Machine Learning and Deep Learning Approaches for Phishing Email Detection using Natural language processing

Abstract

Abstract- One of the biggest threats to cybersecurity today is phishing emails that find and take advantage of human weaknesses, and they fool common detection methods. This paper reserves a contrast between Deep Learning (DL) and Machine Learning (ML) of identifying phishing email through Natural Language Processing (NLP). A publicly available dataset in Kaggle (82,797 emails of which 42,890 emails are phishing and 39,595 emails are non-phishing) was examined. To standardize the texts, preprocessing methods such as tokenization, stop-word elimination, and lemmatization were undertaken before the either Term Frequency – Inverse Document Frequency (TF-IDF) to create features in the ML models and bidirectional Encoder Representations from Transformers – Long Short-Term Memory model (BERT-LSTM). ML models that were used were Random Forest (RF) and Support Vector Machine (SVM) and the DL model was a BERT one. Analysis showed there were different trade-offs of the approaches. TF-IDF and ML performed well and have lesser CPU load, which can be used in a situation where resources are scarce. Specifically, the Random Forest performed well considering its power of ensemble, SVM with the linearity kernel in dealing with high dimensions. On the other hand, BERT-LSTM model has proven to be more accurate because it embraces contextual and semantics of email text, at the expense of greater computing burden. The results support the argument that the selection of the technique must favor accuracy and availability of resources. Though ML based on TF IDF will have a lightweight and practical solution, DL based on BERT- LSTM presents sophisticated context-related insight to phishing detection solutions when it comes to applications that involve high stakes.