Deep learning for email threat intelligence: Feature importance and model performance in phishing detection

Abstract

Phishing emails remain among the most widespread and insidious vectors for cyberattacks, leveraging social engineering tactics and psychological manipulation to deceive recipients and compromise information systems. This study examines the effectiveness of advanced deep learning architectures, including Feedforward Neural Networks (FNN), Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM) networks, and Bidirectional Encoder Representations from Transformers (BERT), in the automated classification of phishing emails versus legitimate ones. Utilizing a large, feature-enriched dataset that integrates linguistic, structural, and behavioral attributes, the models were evaluated using comprehensive performance metrics, including Accuracy, Precision, Recall, F1 Score, Mean Squared Error (MSE), and Root Mean Squared Error (RMSE). Experimental findings indicate that BERT achieves superior performance, attaining a classification accuracy of 97% and the lowest error rates, which can be attributed to its ability to model deep semantic and contextual nuances within email content. Feature importance analysis further demonstrates the significance of attributes such as hyperlink count, urgency-inducing keywords, and orthographic anomalies as discriminative indicators of phishing attempts. These results affirm the critical value of deep contextual representation in combating sophisticated phishing strategies. The study positions BERT as a state-of-the-art benchmark for high-fidelity email threat detection. Future research will focus on adapting cross-lingual models, enhancing adversarial resilience, and integrating real-time detection capabilities into enterprise-level security infrastructures.