BERT Phishing Email Detection

Model Description

This repository contains a BERT-based phishing email detection model fine-tuned to classify email messages as phishing or legitimate.
The model leverages the contextual understanding capabilities of Transformer architectures to detect phishing patterns such as urgency, social engineering cues, and financial manipulation.

The model is trained on a real-world phishing email dataset and is designed for reliable and high-accuracy email security applications.

Intended Use

Primary Use Cases

• Phishing email detection
• Email security filtering
• Cybersecurity research and education
• NLP-based text classification demonstrations

Out-of-Scope Use

• Spam detection unrelated to phishing
• Multilingual phishing detection (English only)
• Legal or forensic decision-making without human review

Model Details

• Model Architecture: BERT (Transformer Encoder)
• Base Model: bert-base-uncased
• Task: Binary Text Classification
• Language: English
• Labels:
  • LABEL_0 → Legitimate
  • LABEL_1 → Phishing

Training Details

Dataset

• Source: Kaggle – Phishing Email Dataset
• Type: Real-world labeled email texts
• Classes: Legitimate, Phishing

Preprocessing

• Text cleaning and normalization
• URL and email masking
• Length-based truncation (max 256 tokens)
• Dynamic padding during training

Training Configuration

• Epochs: 3
• Batch Size: 16
• Learning Rate: 2e-5
• Optimizer: AdamW
• Hardware: NVIDIA Tesla T4 GPU
• Precision: FP16 (Mixed Precision)

Evaluation Results

The model achieved strong performance on the held-out test set:

• Accuracy: ~99%
• Precision: ~99.5%
• Recall: ~99.3%
• F1-score: ~99.4%

High recall ensures that phishing emails are detected with minimal false negatives, which is critical for security-focused applications.

Example Inference

from transformers import BertTokenizer, BertForSequenceClassification
import torch

model = BertForSequenceClassification.from_pretrained(
    "divyanshu-chauhan-7786/bert-phishing-email-detection"
)
tokenizer = BertTokenizer.from_pretrained(
    "divyanshu-chauhan-7786/bert-phishing-email-detection"
)

def predict_email(text):
    inputs = tokenizer(text, return_tensors="pt", truncation=True)
    with torch.no_grad():
        logits = model(**inputs).logits
    return "Phishing" if logits.argmax().item() == 1 else "Legitimate"

predict_email("Urgent! Verify your bank account immediately.")
---

Limitations

• Emails longer than 256 tokens are truncated, which may result in the loss of some contextual information.
• Only English-language emails are supported.
• The model relies solely on the email body text and does not consider email headers or metadata.

Ethical Considerations

• False positives may lead to legitimate emails being incorrectly flagged as phishing.
• False negatives may allow phishing emails to bypass detection.
• The model should be used as a decision-support system and not as a standalone authority for security-critical decisions.

Future Improvements

• Support for long-context Transformer models such as Longformer and BigBird.
• Incorporation of email metadata and header information for improved detection accuracy.
• Extension to multilingual phishing email detection.
• Deployment as a web-based or API-driven service for real-time use.

Author

Divyanshu Chauhan
AI Engineer | Data Analyst | Machine Learning & Deep Learning

AI and Machine Learning practitioner with hands-on experience in building real-world deep learning and Transformer-based solutions. His work focuses on applying NLP and modern AI techniques to solve practical problems in cybersecurity, data analytics, and intelligent systems.

🔗 Portfolio: https://divyanshu-chauhan-7786.github.io/divyanshu-chauhan/