IntelliPhish: An Explainable DistilBERT-Based Phishing Email Detection System with URL Deep Analysis and Live Threat Analytics

This paper presented IntelliPhish, a phishing-email detection system that goes beyond a bare classification label by combining a fine-tuned DistilBERT transformer with SHAP word-level explanation, an independent URL Deep Analysis module and a curated threat-keyword lexicon, all served through a single, self-contained Flask application. Fine-tuning DistilBERT on a carefully cleaned and de-duplicated merged corpus produced the highest accuracy (97.4%) and F1-score (97.3) among five benchmarked models, while remaining roughly three times faster and nearly half the size of full BERT-base, directly validating the choice of a distilled transformer for a system intended to run without specialised hardware. Beyond raw classification accuracy, the SHAP-based word-level explanation, the URL Deep Analysis module's typosquat and domain-age checks, and the keyword-extraction layer together give the user independently corroborating evidence for every verdict rather than a single opaque number. The analysis of 97 real scans recorded during live use showed a 35.1%/64.9% phishing/legitimate split, an average confidence of 97.79%, and a keyword profile dominated by call-to-action and urgency language consistent with established phishing patterns, evidence that the system's outputs behave in line with real-world expectations rather than only with benchmark data. Structured testing, in particular the graceful-degradation test cases, further confirmed that the system remains usable and honest with the user even when an individual analysis module fails. Limitations: Two limitations are worth stating plainly. First, the deployed inference pipeline truncates email text to 128 tokens while the model was trained at a 256-token maximum length, so reported benchmark accuracy and live-inference accuracy on unusually long emails are not strictly like-for-like. Second, the URL Deep Analysis module relies on structural heuristics — IP-based addressing, typosquatting distance, domain age and HTTP usage — rather than a live threat-intelligence feed, so a newly weaponised but structurally unremarkable domain could still score as low risk. Both limitations are addressed directly in the future work below.

[1] S. Jamal, H. Wimmer, I. H. Sarker, “An Improved Transformer-Based Model for Detecting Phishing, Spam and Ham Emails: A Large Language Model Approach,” Security and Privacy, Wiley, vol. 7, no. 5, 2024. [2] M. A. Uddin, M. Mahiuddin, I. H. Sarker, “An Explainable Transformer-Based Model for Phishing Email Detection: A Large Language Model Approach,” arXiv:2402.13871, 2024. [3] A. Alhuzali, A. Alloqmani, M. Aljabri, F. Alharbi, “In-Depth Analysis of Phishing Email Detection: Evaluating the Performance of Machine Learning and Deep Learning Models Across Multiple Datasets,” Applied Sciences, MDPI, vol. 15, no. 6, Art. 3396, 2025. [4] K. M. M. Uddin, N. Biswas, S. T. Rikta, M. Nur-A-Alam, R. Mostafiz, “Explainable Machine Learning for Phishing Site Detection: A High-Efficiency Approach Using Boosting Models and SHAP,” The Journal of Engineering, Wiley, 2025. [5] M. Mia, D. Derakhshan, M. M. A. Pritom, “Can Features for Phishing URL Detection Be Trusted Across Diverse Datasets? A Case Study with Explainable AI,” Proc. 11th Int. Conf. on Networking, Systems, and Security (NSysS ’24), ACM, pp. 137–145, 2024. [6] V. Sanh, L. Debut, J. Chaumond, T. Wolf, “DistilBERT, a Distilled Version of BERT: Smaller, Faster, Cheaper and Lighter,” arXiv:1910.01108, 2019. [7] S. M. Lundberg, S.-I. Lee, “A Unified Approach to Interpreting Model Predictions,” Advances in Neural Information Processing Systems (NeurIPS), 2017. [8] J. Devlin, M.-W. Chang, K. Lee, K. Toutanova, “BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding,” NAACL-HLT, 2019. [9] Pallets Projects, “Flask Documentation,” https://flask.palletsprojects.com/. [10] Hugging Face, “Transformers Documentation,” https://huggingface.co/docs/transformers/.