A Multi-Dataset Machine Learning For Phishing Email Detection Using Feature Selection And Feature Importance

The detection of phishing emails faces a rapid increase in challenges due to the continuous development of phishing mechanisms. Thus, makes it more difficult to distinguish between phishing and legitimate emails in real-world environments. This research proposes a comprehensive framework for intelligence detection relying on Machine Learning (ML) algorithms. The proposed framework incorporates Genetic Algorithm (GA) and Feature Importance (FI) to enhance the performance and explain the model's decisions. It combines three different datasets, Enron, Nazario, and SpamAssassin, in addition to a combined dataset to achieve higher variety and stronger generalization. The experiments showed that eXtreme Gradient Boosting (XGBoost) and Random Forest (RF) achieved the highest performance when using a variety of data, while Support Vector Machines (SVM) performed better on more consistent individual data. This work evaluated before and after the two techniques of feature engineering to measure the changes in their performance across different datasets. The experimental results illustrate that the feature importance optimizes the performance of all the metrics of the K-Nearest Neighbors (KNN) algorithm. This study presents a practical framework able to be applied to real-world email systems, with expandability and the ability to engage additional features, such as language, time, and URLs. The results of the proposed work confirmed that the effectiveness of integrating the data diversity and features analysis significantly improves the accuracy of phishing email detection.