Intent-Aware Continual Phishing Detection Using Public Email Datasets

Abstract

Phishing emails remain an important cybersecurity threat because attackers can manipulate legitimate communication patterns, exploit human trust, and modify message content to evade static detection mechanisms. The increasing availability of generative artificial intelligence also makes it easier to produce fluent and contextually plausible malicious messages, increasing the importance of detection approaches that are robust to changes in wording and attack strategy.

This paper investigates an intent-aware continual-learning framework for phishing-email detection. The proposed approach combines conventional textual representations based on term frequency-inverse document frequency (TF-IDF) with four explicit intent cues: requested action, target asset, deception strategy, and urgency. The resulting hybrid representation is evaluated using logistic regression and compared with text-only logistic regression, BERT, and a super-learner ensemble. A rehearsal-based continuallearning procedure is used to simulate the evolution of phishing attacks through multiple adaptive rounds, including paraphrased phishing messages.

The original manuscript describes a corpus of 22,000 emails constructed from the Enron, SpamAssassin, and Nazario corpora. However, a detailed audit of the manuscript reveals contradictory descriptions of the corpus composition and experimental split. In particular, different sections report different class distributions and different train/test protocols. Consequently, this revised paper distinguishes reported experimental values from values that can be independently derived from the supplied evidence. The reported confusion matrices are recalculated using standard classification equations, and the resulting metrics are used where the underlying matrix is available.

The results support the general research hypothesis that combining textual features with explicit intent information can provide a useful and interpretable representation for adaptive phishing detection. However, the available manuscript evidence is insufficient to establish the originally claimed dataset composition or every reported performance value as independently reproducible. The study therefore emphasizes methodological transparency, explicit dataset provenance, reproducible evaluation, and the need for raw prediction files when reporting continuallearning results.