Automatic Detection of Phishing Attacks in Email using Large Language Models (LLM)

Abstract

This research aimed to train a model based on a Large Language Model (LLM) for the detection of phishing attacks through the analysis of email content. The Transformer DistilBERT model was employed following the CRISP-DM methodology, which ensured a structured life cycle for training. The procedure included preprocessing the ealvaradob/phishing-dataset, tokenization, and division into training, validation, and test subsets. The model was trained in two phases: fine-tuning on specialized data and rigorous validation using standardized metrics (accuracy, precision, recall, F1-score). Results in the training phase exceeded 95% across all metrics. In the final validation with an independent dataset (zefang-liu/phishing-email-dataset), an average above 98% was achieved, demonstrating high effectiveness and a minimal margin of error. It is concluded that the model meets the functional requirements for deployment in production, providing solid evidence for the use of Natural Language Processing (NLP) in cybersecurity applications.