Federated Phish Bowl: LSTM-Based Decentralized Phishing Email Detection

TL;DR

The paper introduces Federated Phish Bowl, a privacy-preserving decentralized LSTM-based phishing email detection system that achieves performance comparable to centralized methods through federated learning.

Contribution

It presents a novel federated learning framework for phishing detection that shares global word embeddings without compromising data privacy.

Findings

Achieves 83% prediction accuracy with federated learning.

Performs comparably to centralized phishing detection systems.

Effective across various client numbers and data distributions.

Abstract

With increasingly more sophisticated phishing campaigns in recent years, phishing emails lure people using more legitimate-looking personal contexts. To tackle this problem, instead of traditional heuristics-based algorithms, more adaptive detection systems such as natural language processing (NLP)-powered approaches are essential to understanding phishing text representations. Nevertheless, concerns surrounding the collection of phishing data that might cover confidential information hinder the effectiveness of model learning. We propose a decentralized phishing email detection framework called Federated Phish Bowl (FedPB) which facilitates collaborative phishing detection with privacy. In particular, we devise a knowledge-sharing mechanism with federated learning (FL). Using long short-term memory (LSTM) for phishing detection, the framework adapts by sharing a global word embedding matrix across the clients, with each client running its local model with Non-IID data. We collected the most recent phishing samples to study the effectiveness of the proposed method using different client numbers and data distributions. The results show that FedPB can attain a competitive performance with a centralized phishing detector, with generality to various cases of FL retaining a prediction accuracy of 83%.