Systems and methods for detecting phishing emails using machine learning

Abstract

The disclosure provides for systems and methods directed to classifying emails as phishing or non-phishing through the use of machine learning. Preprocessing operations may be performed on the email that include removal of punctuation and changing all letters to lower case. Additionally, recipient and sender email addresses and a subject line may be concatenated to the text of the email body, which is then tokenized and provided to a machine learning model. In some implementations, the machine learning model may be constructed with a multi-layer transformer encoder architecture that includes a plurality of transformer blocks. The result of the machine learning model may include a contextualized embedding sequence. A set of linear layers may reduce the dimensionality of a first vector of the contextualized embedding sequence and an activation function may be applied thereto to determine a classification predication.