[Paper Review] Anomaly Detection in Emails using Machine Learning and Header Information

Craig Beaman, Haruna Isah|arXiv (Cornell University)|Mar 19, 2022

Spam and Phishing Detection4 citations

TL;DR

This paper proposes a machine learning approach for detecting phishing and spam emails using only email header information, bypassing reliance on content analysis. It achieves 99% accuracy for spam and 97% for phishing using supervised models like Random Forest and SVM, with One-Class SVM also showing strong performance, demonstrating that headers alone are sufficient for high-accuracy anomaly detection in real-world filtering systems.

ABSTRACT

Anomalies in emails such as phishing and spam present major security risks such as the loss of privacy, money, and brand reputation to both individuals and organizations. Previous studies on email anomaly detection relied on a single type of anomaly and the analysis of the email body and subject content. A drawback of this approach is that it takes into account the written language of the email content. To overcome this deficit, this study conducted feature extraction and selection on email header datasets and leveraged both multi and one-class anomaly detection approaches. Experimental analysis results obtained demonstrate that email header information only is enough to reliably detect spam and phishing emails. Supervised learning algorithms such as Random Forest, SVM, MLP, KNN, and their stacked ensembles were found to be very successful, achieving high accuracy scores of 97% for phishing and 99% for spam emails. One-class classification with One-Class SVM achieved accuracy scores of 87% and 89% with spam and phishing emails, respectively. Real-world email filtering applications will benefit from the use of only the header information in terms of resources utilization and efficiency.

Motivation & Objective

• To address the limitations of prior email anomaly detection methods that rely solely on email body and subject content, which are vulnerable to language-based evasion.
• To investigate whether email header information alone can effectively detect spam and phishing anomalies.
• To compare the performance of multi-class and one-class machine learning models using only header features for anomaly detection.
• To develop a lightweight, efficient email filtering solution that reduces computational overhead by avoiding content analysis.

Proposed method

• Extracted and selected relevant features from email header datasets, focusing on metadata such as sender, recipient, timestamps, and routing information.
• Applied both multi-class and one-class anomaly detection techniques, including Random Forest, SVM, MLP, KNN, and One-Class SVM.
• Used stacked ensemble models to improve generalization and robustness across diverse email header patterns.
• Performed feature selection to reduce dimensionality and improve model efficiency while preserving detection accuracy.
• Evaluated models using standard metrics such as accuracy, with a focus on real-world applicability and low resource consumption.
• Validated results on real-world email header data to ensure practical relevance and scalability.

Experimental results

Research questions

• RQ1 Can email header information alone achieve high-accuracy detection of spam and phishing emails without analyzing the content?
• RQ2 How do multi-class and one-class machine learning models compare in performance when detecting anomalies using only email headers?
• RQ3 Which supervised learning algorithms yield the highest detection accuracy when trained exclusively on header metadata?
• RQ4 To what extent can one-class classification models detect novel or unseen phishing/spam patterns using only header data?
• RQ5 How does the proposed header-only approach compare in efficiency and resource usage to content-based detection systems?

Key findings

• Supervised learning models achieved 99% accuracy in detecting spam emails and 97% accuracy in detecting phishing emails using only email header information.
• One-Class SVM achieved 89% accuracy for phishing and 87% for spam, demonstrating strong performance even in unsupervised anomaly detection scenarios.
• The use of only header data was sufficient to reliably detect both spam and phishing anomalies, eliminating the need for content analysis.
• Stacked ensemble models of Random Forest, SVM, and MLP outperformed individual models, indicating improved robustness and generalization.
• The approach significantly reduces computational overhead and resource utilization, making it suitable for real-time email filtering applications.
• Feature selection improved model efficiency without sacrificing detection accuracy, confirming the relevance of selected header features.