[Paper Review] Improving Phishing Detection Via Psychological Trait Scoring

Sadat Shahriar, Arjun Mukherjee+1 more|arXiv (Cornell University)|Aug 14, 2022

Spam and Phishing Detection4 citations

TL;DR

This paper proposes enhancing phishing detection by integrating psychological trait scoring—specifically urgency, fear, and desire—into deep learning models. By fine-tuning BERT and SBERT to extract Phishing Psychological Trait (PPT) scores and combining them with neural networks, the method improves F1 score by 4.54% over SOTA, with fear emerging as the strongest detection cue.

ABSTRACT

Phishing emails exhibit some unique psychological traits which are not present in legitimate emails. From empirical analysis and previous research, we find three psychological traits most dominant in Phishing emails - A Sense of Urgency, Inducing Fear by Threatening, and Enticement with Desire. We manually label 10% of all phishing emails in our training dataset for these three traits. We leverage that knowledge by training BERT, Sentence-BERT (SBERT), and Character-level-CNN models and capturing the nuances via the last layers that form the Phishing Psychological Trait (PPT) scores. For the phishing email detection task, we use the pretrained BERT and SBERT model, and concatenate the PPT scores to feed into a fully-connected neural network model. Our results show that the addition of PPT scores improves the model performance significantly, thus indicating the effectiveness of PPT scores in capturing the psychological nuances. Furthermore, to mitigate the effect of the imbalanced training dataset, we use the GPT-2 model to generate phishing emails (Radford et al., 2019). Our best model outperforms the current State-of-the-Art (SOTA) model's F1 score by 4.54%. Additionally, our analysis of individual PPTs suggests that Fear provides the strongest cue in detecting phishing emails.

Motivation & Objective

• Address the challenge of detecting phishing emails that exploit psychological manipulation, which traditional NLP methods often miss.
• Identify and quantify dominant psychological traits—urgency, fear, and desire—in phishing emails to improve detection accuracy.
• Overcome data class imbalance in phishing datasets by generating synthetic phishing emails using GPT-2.
• Develop a hybrid deep learning model that fuses contextual embeddings with psychological trait scores for superior performance.
• Demonstrate that psychological cues, especially fear, are strong indicators for distinguishing phishing from legitimate emails.

Proposed method

• Manually label 10% of phishing emails for three psychological traits: urgency, fear, and desire.
• Fine-tune BERT and Sentence-BERT models to extract contextual representations and generate Phishing Psychological Trait (PPT) scores from the final layers.
• Train a character-level CNN model to learn low-level linguistic patterns associated with psychological traits.
• Concatenate the PPT scores with contextual embeddings from BERT/SBERT and feed them into a fully connected neural network for final classification.
• Use GPT-2 to generate synthetic phishing emails to augment the training data and mitigate class imbalance.
• Train and evaluate the final model using standard metrics, including F1 score, on a benchmark phishing detection dataset.

Experimental results

Research questions

• RQ1 To what extent do psychological traits like urgency, fear, and desire improve phishing detection beyond standard NLP features?
• RQ2 How do PPT scores derived from BERT and SBERT models contribute to distinguishing phishing from legitimate emails?
• RQ3 Can synthetic phishing email generation via GPT-2 effectively improve model generalization on imbalanced datasets?
• RQ4 Which psychological trait—urgency, fear, or desire—provides the strongest signal for phishing detection?
• RQ5 Does the integration of psychological trait scoring significantly outperform existing state-of-the-art phishing detection models?

Key findings

• The integration of Phishing Psychological Trait (PPT) scores into BERT and SBERT models improves the F1 score by 4.54% over the current state-of-the-art model.
• Fear-related psychological traits provide the strongest discriminative signal for phishing detection, outperforming urgency and desire.
• The use of GPT-2 to generate synthetic phishing emails effectively mitigates the impact of data class imbalance during model training.
• The PPT score extraction mechanism successfully captures nuanced psychological cues that are not fully represented in standard NLP embeddings.
• The final model, combining contextual embeddings with PPT scores, demonstrates robust generalization and improved detection performance on unseen phishing samples.
• The ablation study confirms that each psychological trait contributes uniquely, with fear being the most predictive individual trait.