Enhancing detection of zero-day phishing email attacks in the Indonesian language using deep learning algorithms

Abstract

Email phishing is a manipulative technique aimed at compromising information security and user privacy. To overcome the limitations of traditional detection methods, such as blacklists, this research proposes a phishing detection model that leverages natural language processing (NLP) and deep learning technologies to analyze Indonesian email headers. The primary objective is to more efficiently detect zero-day phishing attacks by focusing on the unique linguistic and cultural context of the Indonesian language. This enables the development of models capable of recognizing phishing attack patterns that differ from those in other language contexts. Four models are tested, combining Indonesian bidirectional encoder representation of transformers (IndoBERT) and FastText feature extraction techniques with convolutional neural network (CNN) and long short-term memory (LSTM) deep learning algorithms. The results indicate that the combination of FastText and CNN achieved the highest performance in accuracy, precision, and F1-score metrics, each at 98.4375%. Meanwhile, the FastText model with LSTM showed the best performance in recall, with a score of 98.9583%. The research suggests exploring deeper into email content or integrating analysis between headers and email content in future studies to further improve accuracy and effectiveness in phishing email detection.