AI-Based Phishing Email Detection Using NLP and Classical Machine Learning Classifiers

Abstract: Phishing email remains one of the most persistent and cost-effective attack vectors used to compromise credentials, deliver malware, and defraud individuals and organizations. This study presents an end-to-end machine learning pipeline for automated phishing email detection using a large, publicly sourced corpus of 82,486 labeled emails (39,595 legitimate and 42,891 phishing). Raw email text was cleaned through lowercasing, URL removal, non-alphabetic character stripping, and stopword elimination, and transformed into a 5,000-dimensional Term Frequency-Inverse Document Frequency (TF-IDF) feature space. Three supervised classifiers Multinomial Naïve Bayes, Linear Support Vector Machine (SVM), and Random Forest were trained on an 80:20 stratified train-test split and evaluated using accuracy, precision, recall, and F1-score. The Linear SVM achieved the strongest overall performance (accuracy = 98.33%, precision = 98.46%, recall = 98.33%, F1-score = 98.40%), outperforming Naïve Bayes (accuracy = 95.93%) and Random Forest (accuracy = 94.32%). The trained SVM model and TF-IDF vectorizer were serialized for deployment, and a demonstration function correctly classified an unseen, realistic phishing message. The findings confirm that a lightweight, interpretable TF-IDF plus linear-classifier pipeline can achieve detection performance competitive with far more computationally expensive deep learning and transformer-based approaches reported in recent literature, making it a practical candidate for resource-constrained or real-time email security deployments.

Keywords: Phishing Detection, Machine Learning, Natural Language Processing, TF-IDF, Support Vector Machine, Naïve Bayes, Random Forest, Cybersecurity, Text Classification, Email Security.