A Two-stage Architecture for Phishing Email Detection via Domain Analysis with Inverse Transformer Fine-Tuning

Abstract

In the digital era, email has become the primary attack vector exploited by cybercriminals through increasingly sophisticated phishing campaigns. In Vietnam, unique linguistic characteristics, combined with the widespread use of domain obfuscation techniques, have significantly reduced the effectiveness of traditional detection systems that rely on blacklists or hand-crafted lexical features. To address these challenges, this paper proposes a comprehensive two-stage architecture for phishing email detection that efficiently eliminates obvious threats in the first stage and accurately classifies ambiguous “gray-zone” cases in the second stage. The proposed architecture rapidly detects overt attack indicators by integrating an in-depth rule-based filtering mechanism with a classification module based on modern Transformer architectures. Experiments were conducted on a large scale dataset collected from reputable Vietnamese sources, consisting of 48,866 phishing email samples. The experimental results show that the first stage achieves an accuracy of 87%, while the second stage reaches an accuracy of 97.0% accuracy for legitimate emails and 88.0% for phishing emails by using the URLBERT-Tiny model enhanced with an inverse layer-wise fine-tuning strategy. The proposed Two-stage strategy demonstrates the best overall performance, achieving an accuracy of 99.8%. These results validate the effectiveness of combining rule based domain analysis with intelligent parameter optimization techniques on specialized compact language models for real-time cybersecurity tasks.