High-Performance Phishing Email Detection Using Hybrid Machine Learning and Deep Learning Approaches

High-Performance Phishing Email Detection Using Hybrid Machine Learning and Deep Learning Approaches | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article High-Performance Phishing Email Detection Using Hybrid Machine Learning and Deep Learning Approaches Mohamed Khayati, Driss Ait Omar, Mohamed Baslam This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-9131182/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Phishing emails continue to represent a major cybersecurity threat, leveraging increasingly sophisticated social engineering techniques to evade conventional detection systems. Addressing this challenge requires intelligent and adaptive approaches capable of capturing both statistical patterns and contextual dependencies within email data. In this study, we propose a unified and robust phishing email detection framework that systematically integrates classical machine learning and advanced deep learning models within a consistent experimental pipeline. The novelty of this work lies in bridging feature-based learning and sequence-aware modeling through a standardized preprocessing and evaluation strategy, enabling a fair, reproducible, and comprehensive comparison across heterogeneous approaches. A wide range of machine learning algorithms, including Naive Bayes, Logistic Regression, SGDClassifier, XGBoost, Decision Tree, Random Forest, and MLPClassifier, are evaluated alongside deep learning architectures such as Long Short-Term Memory (LSTM), Bidirectional LSTM (BiLSTM), and Gated Recurrent Unit (GRU). Experiments conducted on a large-scale email dataset demonstrate that traditional models achieve competitive performance, with accuracies ranging from 96.01% to 98.77%. However, deep learning models consistently outperform these approaches, reaching up to 99.9% accuracy by effectively capturing sequential and contextual information. The proposed framework highlights the effectiveness of combining structured feature engineering with deep sequential learning, offering a scalable and high-performance solution for real-world phishing detection. This work contributes to the advancement of intelligent cybersecurity systems capable of adapting to evolving and previously unseen phishing attacks. Physical sciences/Engineering Physical sciences/Mathematics and computing Cybersecurity SGDClassifier XGBoost Decision Tree Random Forest MLPClassifier LSTM BiLSTM GRU Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-9131182","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":617359754,"identity":"53476cfc-eb47-469e-9cfc-aec55cd0fd17","order_by":0,"name":"Mohamed Khayati","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABCklEQVRIiWNgGAWjYFACHhDBzCAhAeZJyJGqJUHCmGQtDIkNhDTotvce/HSjwppBcnbzM4mfPyzSN5w/nfyBoYYhmh+HZrMz55Klc86kM0jLHDOT7EmQyN1wI3ebBMMxhtwZB3BouZFjIJ3bdphBTiLBTIIHrIV3GwMDG0NuA24txr9z/4G0pH+T/JMgkW5w/uzmDwz/GHLn49ZiJp3bcJhBWgLIANqSYHAgd4MEYxtD7gZcWs6cMbPOOZbOIzkjp9haJk3CcCbIL4l9ErkbcWk53mN8O6fGWk7iRvrGm29s6uT5QA778M0mdx4OLTAAih0WCTg3gUECt1okwPyBKGWjYBSMglEw4gAA1TFcMZJ2Vw8AAAAASUVORK5CYII=","orcid":"","institution":"Université Sultan Moulay Slimane","correspondingAuthor":true,"prefix":"","firstName":"Mohamed","middleName":"","lastName":"Khayati","suffix":""},{"id":617359755,"identity":"ab30c6f3-094c-48a1-9cf1-2e6be8ad90f6","order_by":1,"name":"Driss Ait Omar","email":"","orcid":"","institution":"Université Sultan Moulay Slimane","correspondingAuthor":false,"prefix":"","firstName":"Driss","middleName":"Ait","lastName":"Omar","suffix":""},{"id":617359756,"identity":"b3b8b058-08ee-4684-90f8-6becc5bb0f9b","order_by":2,"name":"Mohamed Baslam","email":"","orcid":"","institution":"Université Sultan Moulay Slimane","correspondingAuthor":false,"prefix":"","firstName":"Mohamed","middleName":"","lastName":"Baslam","suffix":""}],"badges":[],"createdAt":"2026-03-15 21:38:16","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-9131182/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-9131182/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":107287694,"identity":"293f2f4d-0719-41ae-a8aa-016ec28dffe0","added_by":"auto","created_at":"2026-04-20 04:25:29","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":898726,"visible":true,"origin":"","legend":"","description":"","filename":"PhishingEmailDetectionv21.pdf","url":"https://assets-eu.researchsquare.com/files/rs-9131182/v1_covered_155926f8-d3e8-47e4-a65e-211a018d90f9.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"High-Performance Phishing Email Detection Using Hybrid Machine Learning and Deep Learning Approaches","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":" Cybersecurity, SGDClassifier, XGBoost, Decision Tree, Random Forest, MLPClassifier, LSTM, BiLSTM, GRU","lastPublishedDoi":"10.21203/rs.3.rs-9131182/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-9131182/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Phishing emails continue to represent a major cybersecurity threat, leveraging increasingly sophisticated social engineering techniques to evade conventional detection systems. Addressing this challenge requires intelligent and adaptive approaches capable of capturing both statistical patterns and contextual dependencies within email data. In this study, we propose a unified and robust phishing email detection framework that systematically integrates classical machine learning and advanced deep learning models within a consistent experimental pipeline. The novelty of this work lies in bridging feature-based learning and sequence-aware modeling through a standardized preprocessing and evaluation strategy, enabling a fair, reproducible, and comprehensive comparison across heterogeneous approaches. A wide range of machine learning algorithms, including Naive Bayes, Logistic Regression, SGDClassifier, XGBoost, Decision Tree, Random Forest, and MLPClassifier, are evaluated alongside deep learning architectures such as Long Short-Term Memory (LSTM), Bidirectional LSTM (BiLSTM), and Gated Recurrent Unit (GRU). Experiments conducted on a large-scale email dataset demonstrate that traditional models achieve competitive performance, with accuracies ranging from 96.01% to 98.77%. However, deep learning models consistently outperform these approaches, reaching up to 99.9% accuracy by effectively capturing sequential and contextual information. The proposed framework highlights the effectiveness of combining structured feature engineering with deep sequential learning, offering a scalable and high-performance solution for real-world phishing detection. This work contributes to the advancement of intelligent cybersecurity systems capable of adapting to evolving and previously unseen phishing attacks.","manuscriptTitle":"High-Performance Phishing Email Detection Using Hybrid Machine Learning and Deep Learning Approaches","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-04-07 11:11:03","doi":"10.21203/rs.3.rs-9131182/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"9c6a056e-0191-44a4-9ee5-13194af0c370","owner":[],"postedDate":"April 7th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[{"id":65701354,"name":"Physical sciences/Engineering"},{"id":65701355,"name":"Physical sciences/Mathematics and computing"}],"tags":[],"updatedAt":"2026-04-20T04:24:38+00:00","versionOfRecord":[],"versionCreatedAt":"2026-04-07 11:11:03","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-9131182","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-9131182","identity":"rs-9131182","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}