Phishing Email Detection Using Ensemble Learning
Resumo
Phishing attacks are a cybersecurity threat, especially via emails designed to deceive users and steal sensitive data. This work proposes a modular architecture for phishing e-mail detection in which content, URL features, and e-mail metadata are handled by independent specialized models, integrated at the decision level through stacking with out-of-fold meta-features. The main contribution is the modular design and the analysis of channel complementarity, rather than stacking itself. Over five independent runs, the ensemble reaches a macro F1-score of 0.9750, above the best individual model (0.9690), while ablation and error-overlap analyses provide evidence that the URL and metadata channels correct errors made by the textual channel.Referências
Alvarado, E. et al. (2025). Meajor: A multi-feature email dataset for advanced junk, phishing, and organizational risk detection. arXiv preprint arXiv:2507.17978.
Anti-Phishing Working Group (2024). Phishing activity trends report. [link]. Accessed on: May 21, 2026.
Bountakas, P. and Xenakis, C. (2023). HELPHED: Hybrid ensemble learning phishing email detection. Journal of Network and Computer Applications, 210:103545.
Breiman, L. (2001). Random forests. Machine Learning, 45(1):5–32.
Cruz, L. P. (2025). Detecção de phishing por aprendizado de máquina com ênfase em métodos ensemble. Trabalho acadêmico.
Devlin, J., Chang, M.-W., Lee, K., and Toutanova, K. (2019). Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of NAACL-HLT.
Dietterich, T. G. (2000). Ensemble methods in machine learning. International Workshop on Multiple Classifier Systems.
Gualberto, E. S., De Sousa, R. T., Thiago, P. D. B., Da Costa, J. P. C., and Duque, C. G. (2020). From feature engineering and topics models to enhanced prediction rates in phishing detection. IEEE Access, 8:76368–76385.
Hosmer, D. W., Lemeshow, S., and Sturdivant, R. X. (2013). Applied Logistic Regression. Wiley.
Jakobsson, M. and Myers, S. (2006). Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft. Wiley.
Salton, G. and Buckley, C. (1988). Term-weighting approaches in automatic text retrieval. Information Processing & Management, 24(5):513–523.
Anti-Phishing Working Group (2024). Phishing activity trends report. [link]. Accessed on: May 21, 2026.
Bountakas, P. and Xenakis, C. (2023). HELPHED: Hybrid ensemble learning phishing email detection. Journal of Network and Computer Applications, 210:103545.
Breiman, L. (2001). Random forests. Machine Learning, 45(1):5–32.
Cruz, L. P. (2025). Detecção de phishing por aprendizado de máquina com ênfase em métodos ensemble. Trabalho acadêmico.
Devlin, J., Chang, M.-W., Lee, K., and Toutanova, K. (2019). Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of NAACL-HLT.
Dietterich, T. G. (2000). Ensemble methods in machine learning. International Workshop on Multiple Classifier Systems.
Gualberto, E. S., De Sousa, R. T., Thiago, P. D. B., Da Costa, J. P. C., and Duque, C. G. (2020). From feature engineering and topics models to enhanced prediction rates in phishing detection. IEEE Access, 8:76368–76385.
Hosmer, D. W., Lemeshow, S., and Sturdivant, R. X. (2013). Applied Logistic Regression. Wiley.
Jakobsson, M. and Myers, S. (2006). Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft. Wiley.
Salton, G. and Buckley, C. (1988). Term-weighting approaches in automatic text retrieval. Information Processing & Management, 24(5):513–523.
Publicado
21/10/2026
Como Citar
KUGLIN, Guilherme E.; LADEIRA, Ricardo de la Rocha.
Phishing Email Detection Using Ensemble Learning. In: ESCOLA REGIONAL DE REDES DE COMPUTADORES (ERRC), 23. , 2026, Santa Maria/RS.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2026
.
p. 162-167.
DOI: https://doi.org/10.5753/errc.2026.36067.
