Detection and Classification of Email Phishing using CNN-BiLSTM Model

Abstract

Phishing emails remain one of the most prevalent cybersecurity threats, exploiting users through deceptive messages that mimic legitimate communication. Traditional detection techniques such as blacklist filtering, rule-based systems, and signature-based methods are increasingly ineffective against evolving phishing strategies. This study proposes an intelligent deep learning-based approach for the detection and classification of email phishing using a hybrid Convolutional Neural Network–Bidirectional Long Short-Term Memory (CNN–BiLSTM) model. The model leverages CNN for automated feature extraction and BiLSTM for capturing contextual and sequential dependencies in email text. A labeled dataset consisting of 50,000 phishing and legitimate emails was preprocessed using text cleaning, normalization, tokenization, and encoding techniques to enhance model performance. The proposed model was trained and evaluated using standard performance metrics. Experimental results demonstrate that the CNN–BiLSTM model achieves superior performance compared to traditional and machine learning-based approaches, effectively identifying complex phishing patterns. The proposed model attained an accuracy of 98.42%, a precision of 97.85%, a recall of 96.93%, an F1-score of 97.38%, and an AUC-ROC of 0.992, while maintaining a practical inference time of 42 ms. While the model demonstrates robust classification capabilities, limitations remain regarding dataset diversity and deployment context. The findings highlight the potential of deep learning techniques to improve email security and mitigate phishing attacks. This study contributes to the development of intelligent cybersecurity systems capable of adapting to the dynamic nature of phishing threats.