Enhanced CyberDART: A Federated and Privacy-Preserving System for Detecting Spam, Phishing and Malware Email

Email is one of the most widely used communication tools, yet it remains a primary vector for cyberattacks such as spam, phishing, and malicious links. Traditional spam filters often fail when organizations operate in isolation, while cross-organization data sharing raises privacy concerns. To address this, the CyberDART framework introduces a federated, privacy-preserving email threat detection system that integrates rule-based filters like Spam Assassin, phishing link and sender verification, and machine learning/NLP methods such as k-Nearest Neighbors (k-NN), hashing, Jaccard similarity, and the Lucene NLP pipeline, orchestrated through the PATCH algorithm for anonymized clustering and similarity analysis. Experiments on the Enron and TREC datasets reported nearly 58% improvement in spam detection accuracy over standalone systems while keeping false positives low. However, CyberDART has several drawbacks and limitations: it is restricted mainly to spam and phishing detection, lacking support for malware attachments and advanced spear-phishing; it faces a privacy–accuracy trade-off due to heavy anonymization; its performance depends strongly on the dataset used; and scalability may suffer under large-scale, real-time traffic. To address these gaps, the system can be enhanced with deep NLP models (e.g., BERT/transformers) for semantic phishing detection, static and dynamic malware analysis for attachment inspection, federated learning to share model updates instead of signatures, and cryptographic techniques such as homomorphic encryption or secure multi-party computation to strengthen privacy. These improvements will transform CyberDART from a spam-centric filter into a comprehensive, privacy-preserving email security framework capable of mitigating spam, phishing, and malware attacks with higher accuracy and broader coverage.