A three-stage phishing email detection framework driven by persuasion–rhetorical dependency graph

Authors:
Publisher website
Google Scholar
Abstract
Phishing email detection faces many challenges, as existing detection methods have difficulty in distinguishing phishing-oriented intent from legitimate semantics, lack unified modeling of persuasion strategies and rhetorical structures, and suffer from the impact of class imbalance. To address these issues, this paper proposes a three-stage phishing email detection framework. In the first stage, unsupervised SimCSE is employed to obtain discriminative sentence representations. In the second stage, a multi-task graph construction model, KD-PEPRD-Graph, jointly identifies intra-sentence persuasion principles and inter-sentence rhetorical dependencies, and automatically generates a persuasion–rhetorical dependency graph for each email. Furthermore, a knowledge distillation mechanism is introduced to enhance the generalization ability of the graph construction model using unlabeled emails. In the third stage, the SimCSE-Graphormer-LMF detection model is proposed. Node features are initialized with the SimCSE encoder. Graphormer then performs global reasoning over the constructed graph. To mitigate class imbalance, the large-margin-aware focal loss is also incorporated. The core contribution of this work lies in jointly modeling intra-sentence persuasion principles and inter-sentence rhetorical dependencies within a unified graph structure, thereby uncovering how persuasion principles, organized through rhetorical dependencies, together construct the deceptive narrative of phishing emails. Experiments show that the proposed model achieves F1 scores of 99.15% and 84.31% on the IWSPA-AP and Hard-Example datasets, respectively, outperforming all baseline methods. On the Enron-Nazario dataset, it attains performance comparable with the state-of-the-art large-language-model baseline Gemini 3.1-PPS&RDR. Statistical significance tests based on the McNemar’s test confirmed the reliability of these improvements. Taken together, the results across the three datasets validate the effectiveness of the proposed framework, which achieves high detection performance while maintaining a manageable model size and acceptable inference latency.

This publication has 41 references indexed in Scilit: