TechNet Augusta 2026

Cyber Research Showcase Presentation: I-Powered Phishing Detection: A Multi-Feature Machine Learning Approach to Email Threat Classification (Room Georgia Cyber Center 2402)

19 Aug 26
11:00 AM - 11:20 AM

Tracks: Research Presentations

Phishing remains the most reported form of internet crime, with the FBI's 2024 Internet Crime Report documenting over 193,000 phishing complaints amid record-breaking $16.6 billion in total cybercrime losses, yet traditional detection methods rely on static blacklists and rule-based filters that cannot adapt to novel attack patterns. This research presents an AI-powered phishing detection system that uses machine learning to classify emails as phishing or legitimate through a multi-feature architecture combining content analysis, URL inspection, and email header metadata evaluation. The system was trained on a dataset of 18,650 labeled emails sourced from Hugging Face, consisting of 11,322 legitimate and 7,328 phishing samples. Text features were extracted using Term Frequency Inverse Document Frequency (TF-IDF) vectorization with 3,000 features, and three classifiers were evaluated: Logistic Regression, Naive Bayes, and Random Forest, with Logistic Regression achieving the highest accuracy at 96.5%. Beyond text classification, the system incorporates URL analysis to detect suspicious link patterns including IP-based URLs, URL shorteners, and typosquatting domains, as well as email header analysis to evaluate SPF, DKIM, and DMARC authentication records. A composite scoring model weights these three vectors to produce an overall threat assessment, and a Flask-based web interface allows users to submit emails for real-time classification with confidence scoring. AI-assisted development tools were used to accelerate code implementation; all architectural decisions, model selection, and evaluation were conducted independently. Results demonstrate that the multi-feature architecture provides a more comprehensive and accurate threat assessment than single-vector approaches, with direct implications for enterprise email security and a foundation for future research incorporating transformer-based models and adversarial robustness testing.