CoChat
Sign Up
PreprintCited by 7Spam and Phishing DetectionAdversarial Robustness in Machine LearningHate Speech and Cyberbullying Detection

Prompted Contextual Vectors for Spear-Phishing Detection

Open access
Nahmias, Daniel, Engelberg, Gal, Klein, Dan, Shabtai, Asaf·2024·arXiv
DOI 10.48550/arxiv.2402.08309arXiv 2402.08309
Open this paper in CoChat — free accountOpen PDF

Abstract

Spear-phishing attacks present a significant security challenge, with large language models (LLMs) escalating the threat by generating convincing emails and facilitating target reconnaissance. To address this, we propose a detection approach based on a novel document vectorization method that utilizes an ensemble of LLMs to create representation vectors. By prompting LLMs to reason and respond to human-crafted questions, we quantify the presence of common persuasion principles in the email's content, producing prompted contextual document vectors for a downstream supervised machine learning model. We evaluate our method using a unique dataset generated by a proprietary system that automates target reconnaissance and spear-phishing email creation. Our method achieves a 91\% F1 score in identifying LLM-generated spear-phishing emails, with the training set comprising only traditional phishing and benign emails. Key contributions include a novel document vectorization method utilizing LLM reasoning, a publicly available dataset of high-quality spear-phishing emails, and the demonstrated effectiveness of our method in detecting such emails. This methodology can be utilized for various document classification tasks, particularly in adversarial problem domains.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2402.08309

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Nahmias et al. (2024) introduces a spear-phishing detection approach utilizing LLMs to generate prompted contextual document vectors; the approach utilizes reasoning capabilities of LLMs and outperforms traditional phishing detection methods.

    “Nahmias et al. (2024) introduces a spear-phishing detection approach utilizing LLMs to generate 'prompted contextual document vectors. ' By posing targeted questions to LLMs about email content, the method quantifies the presence of common persuasion principles, creating vectors that capture the malicious intent within spear-phishing emails. The approach utilizes the reason”

    From When LLMs meet cybersecurity: a systematic literature review (2025) · cites this paper as Nahmias et al. (2024)

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

No references could be resolved yet.

Research works printed but not linked: 50

  1. A. Burns, M. E. Johnson, and D. D. Caputo, "Spear phishing in a barrel: Insights from a targeted phishing campaign," Journal of Organizational Computing and Electronic Commerce, vol. 29, no. 1, pp. 24-39, 2019.
  2. J. Hazell, "Large language models can be used to effectively scale spear phishing campaigns," arXiv preprint arXiv:2305.06972, 2023. · arXiv
  3. F. Heiding, B. Schneier, A. Vishwanath, and J. Bernstein, "Devising and detecting phishing: Large language models vs. smaller human models," arXiv preprint arXiv:2308.12287, 2023. · arXiv
  4. M. Elatoubi, "Phishing in web 3.0: Opportunities for the attack- ers, challenges for the defenders," ARIS2-Advanced Research on Information Systems Security, vol. 3, no. 2, pp. 11-25, 2023.
  5. R. Duro, M. Andresel, C. Singewald, V. Siska, A. Weißenfeld, and D. Ignjatović, "Boosting the automated information processing for reconnaissance," in 2023 IEEE International Workshop on Technologies for Defense and Security (TechDefense). IEEE, 2023, pp. 214-219.
  6. H. Gascon, S. Ullrich, B. Stritter, and K. Rieck, "Reading between the lines: content-agnostic detection of spear-phishing emails," in Research in Attacks, Intrusions, and Defenses: 21st International Symposium, RAID 2018, Heraklion, Crete, Greece, September 10- 12, 2018, Proceedings 21. Springer, 2018, pp. 69-91.
  7. M. Khonji, Y. Iraqi, and A. Jones, "Mitigation of spear phishing attacks: A content-based authorship identification framework," in 2011 International Conference for Internet Technology and Secured Transactions. IEEE, 2011, pp. 416-421.
  8. S. Duman, K. Kalkan-Cakmakci, M. Egele, W. Robertson, and E. Kirda, "Emailprofiler: Spearphishing filtering with header and stylometric features of emails," in 2016 IEEE 40th Annual Com- puter Software and Applications Conference (COMPSAC), vol. 1. IEEE, 2016, pp. 408-416.
  9. A. Das, S. Baki, A. El Aassal, R. Verma, and A. Dunbar, "Sok: a comprehensive reexamination of phishing research from the security perspective," IEEE Communications Surveys & Tutorials, vol. 22, no. 1, pp. 671-708, 2019.
  10. C. N. Gutierrez, T. Kim, R. Della Corte, J. Avery, D. Goldwasser, M. Cinque, and S. Bagchi, "Learning from the ones that got away: Detecting new forms of phishing attacks," IEEE Transactions on Dependable and Secure Computing, vol. 15, no. 6, pp. 988-1001, 2018.
  11. S. Salloum, T. Gaber, S. Vadera, and K. Shaalan, "Phishing email detection using natural language processing techniques: a literature survey," Procedia Computer Science, vol. 189, pp. 19-28, 2021.
  12. R. B. Cialdini, "The science of persuasion," Scientific American, vol. 284, no. 2, pp. 76-81, 2001.
  13. A. Ferreira and S. Teles, "Persuasion: How phishing emails can in- fluence users and bypass security measures," International Journal of Human-Computer Studies, vol. 125, pp. 19-31, 2019.
  14. S. Salloum, T. Gaber, S. Vadera, and K. Shaalan, "A systematic literature review on phishing email detection using natural language processing techniques," IEEE Access, vol. 10, pp. 65 703-65 727, 2022.
  15. B. Klimt and Y. Yang, "The enron corpus: A new dataset for email classification research," in European conference on machine learning. Springer, 2004, pp. 217-226.
  16. A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, "Attention is all you need," Advances in neural information processing systems, vol. 30, 2017.
  17. G. I. Webb, R. Hyde, H. Cao, H. L. Nguyen, and F. Petitjean, "Characterizing concept drift," Data Mining and Knowledge Dis- covery, vol. 30, no. 4, pp. 964-994, 2016.
  18. P. Bountakas and C. Xenakis, "Helphed: Hybrid ensemble learn- ing phishing email detection," Journal of network and computer applications, vol. 210, p. 103545, 2023.
  19. A. A. Akinyelu, A. O. Adewumi et al., "Classification of phishing email using random forest machine learning technique," Journal of Applied Mathematics, vol. 2014, 2014.
  20. S. Smadi, N. Aslam, L. Zhang, R. Alasem, and M. A. Hossain, "Detection of phishing emails using data mining algorithms," in 2015 9th International Conference on Software, Knowledge, Infor- mation Management and Applications (SKIMA). IEEE, 2015, pp. 1-8.
  21. L. Ma, B. Ofoghi, P. Watters, and S. Brown, "Detecting phishing emails using hybrid features," in 2009 Symposia and Workshops on Ubiquitous, Autonomic and Trusted Computing. IEEE, 2009, pp. 493-497.
  22. Anandita, D. P. Yadav, P. Paliwal, D. Kumar, and R. Tripathi, "A novel ensemble based identification of phishing e-mails," in Pro- ceedings of the 9th International Conference on Machine Learning and Computing, 2017, pp. 447-451.
  23. I. R. A. Hamid and J. Abawajy, "Hybrid feature selection for phishing email detection," in Algorithms and Architectures for Parallel Processing: 11th International Conference, ICA300 2011, Melbourne, Australia, October 24-26, 2011, Proceedings, Part II 11. Springer, 2011, pp. 266-275.
  24. F. Toolan and J. Carthy, "Phishing detection using classifier en- sembles," in 2009 eCrime researchers summit. IEEE, 2009, pp. 1-9.
  25. A. Alhogail and A. Alsabih, "Applying machine learning and natural language processing to detect phishing email," Computers & Security, vol. 110, p. 102414, 2021.
  26. J. Lee, F. Tang, P. Ye, F. Abbasi, P. Hay, and D. M. Divakaran, "D-fence: A flexible, efficient, and comprehensive phishing email detection system," in 2021 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2021, pp. 578-597.
  27. K. Evans, A. Abuadbba, T. Wu, K. Moore, M. Ahmed, G. Pogrebna, S. Nepal, and M. Johnstone, "Raider: Reinforcement- aided spear phishing detector," in International Conference on Network and System Security. Springer, 2022, pp. 23-50.
  28. Y. Han and Y. Shen, "Accurate spear phishing campaign attribution and early detection," in Proceedings of the 31st Annual ACM Symposium on Applied Computing, 2016, pp. 2079-2086.
  29. X. Ding, B. Liu, Z. Jiang, Q. Wang, and L. Xin, "Spear phishing emails detection based on machine learning," in 2021 IEEE 24th In- ternational Conference on Computer Supported Cooperative Work in Design (CSCWD). IEEE, 2021, pp. 354-359.
  30. D. J. McInerney, G. Young, J.-W. van de Meent, and B. C. Wallace, "Chill: Zero-shot custom interpretable feature extraction from clin- ical notes with large language models," in The 2023 Conference on Empirical Methods in Natural Language Processing, 2023.
  31. J. Wei, X. Wang, D. Schuurmans, M. Bosma, F. Xia, E. Chi, Q. V. Le, D. Zhou et al., "Chain-of-thought prompting elicits reasoning in large language models," Advances in Neural Information Pro- cessing Systems, vol. 35, pp. 24 824-24 837, 2022.
  32. G. Wu, W. Wu, X. Liu, K. Xu, T. Wan, and W. Wang, "Cheap- fake detection with llm using prompt engineering," in 2023 IEEE International Conference on Multimedia and Expo Workshops (ICMEW). IEEE, 2023, pp. 105-109.
  33. K. Allix, T. F. Bissyandé, J. Klein, and Y. Le Traon, "Are your training datasets yet relevant? an investigation into the importance of timeline in machine learning-based malware detection," in Inter- national Symposium on Engineering Secure Software and Systems. Springer, 2015, pp. 51-67.
  34. F. Barbero, F. Pendlebury, F. Pierazzi, and L. Cavallaro, "Tran- scending transcend: Revisiting malware classification in the pres- ence of concept drift," in 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, pp. 805-823.
  35. J. G. Moreno-Torres, T. Raeder, R. Alaiz-Rodríguez, N. V. Chawla, and F. Herrera, "A unifying view on dataset shift in classification," Pattern recognition, vol. 45, no. 1, pp. 521-530, 2012.
  36. H. Shimodaira, "Improving predictive inference under covariate shift by weighting the log-likelihood function," Journal of statisti- cal planning and inference, vol. 90, no. 2, pp. 227-244, 2000.
  37. R. Alaiz-Rodríguez and N. Japkowicz, "Assessing the impact of changing environments on classifier performance," in Advances in Artificial Intelligence: 21st Conference of the Canadian Society for Computational Studies of Intelligence, Canadian AI 2008 Windsor, Canada, May 28-30, 2008 Proceedings 21. Springer, 2008, pp. 13-24.
  38. G. Widmer and M. Kubat, "Learning in the presence of concept drift and hidden contexts," Machine learning, vol. 23, pp. 69-101, 1996.
  39. O. Sagi and L. Rokach, "Ensemble learning: A survey," Wiley interdisciplinary reviews: data mining and knowledge discovery, vol. 8, no. 4, p. e1249, 2018.
  40. L. Bustio-Martínez, V. Herrera-Semenets, J. L. García-Mendoza, M. Á. Álvarez-Carmona, J. Á. González-Ordiano, L. Zúñiga- Morales, J. E. Quiróz-Ibarra, P. A. Santander-Molina, and J. van den Berg, "Uncovering phishing attacks using principles of persuasion analysis," Journal of Network and Computer Appli- cations, vol. 230, p. 103964, 2024.
  41. N. Akbar, "Analysing persuasion principles in phishing emails," Master's thesis, University of Twente, 2014.
  42. M. Butavicius, K. Parsons, M. Pattinson, and A. McCormac, "Breaching the human firewall: Social engineering in phishing and spear-phishing emails," arXiv preprint arXiv:1606.00887, 2016. · arXiv
  43. O. Zielinska, A. Welk, C. B. Mayhorn, and E. Murphy-Hill, "The persuasive phish: Examining the social psychological principles hidden in phishing emails," in Proceedings of the Symposium and Bootcamp on the Science of Security, 2016, pp. 126-126.
  44. L. Van der Maaten and G. Hinton, "Visualizing data using t-sne." Journal of machine learning research, vol. 9, no. 11, 2008.
  45. V. Sanh, L. Debut, J. Chaumond, and T. Wolf, "Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter," arXiv preprint arXiv:1910.01108, 2019. · arXiv
  46. D. Timko and M. L. Rahman, "Smishing dataset i: Phishing sms dataset from smishtank. com," in Proceedings of the Fourteenth ACM Conference on Data and Application Security and Privacy, 2024, pp. 289-294.
  47. T. Almeida, J. M. Hidalgo, and T. Silva, "Towards sms spam filtering: Results under a new dataset," International Journal of Information Security Science, vol. 2, no. 1, pp. 1-18, 2013.
  48. E. S. Gualberto, R. T. De Sousa, T. P. D. B. Vieira, J. P. C. L. Da Costa, and C. G. Duque, "The answer is in the text: Multi- stage methods for phishing detection based on feature engineering," IEEE Access, vol. 8, pp. 223 529-223 547, 2020.
  49. S. Bird, E. Klein, and E. Loper, Natural language processing with Python: analyzing text with the natural language toolkit. " O'Reilly Media, Inc.", 2009.
  50. F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg et al., "Scikit-learn: Machine learning in python," the Journal of machine Learning research, vol. 12, pp. 2825-2830, 2011.

Cited by

Sorted by citations

Authors
Nahmias, D., Engelberg, G., Klein, D., & Shabtai, A.
Affiliations
  • Accenture (Switzerland) (CH)
  • Ben-Gurion University of the Negev (IL)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2024
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2402.08309
arXiv
2402.08309
OpenAlex
W4391835300
Cited by
7
References
0
Citations by year
2025: 2 · 2024: 5
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by-nc-sa)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Hate Speech and Cyberbullying Detection
Keywords
large language models, document vectorization, persuasion principles, email classification, phishing dataset

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review