{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,4]],"date-time":"2025-12-04T16:20:12Z","timestamp":1764865212063,"version":"3.46.0"},"reference-count":31,"publisher":"MDPI AG","issue":"12","license":[{"start":{"date-parts":[[2025,12,1]],"date-time":"2025-12-01T00:00:00Z","timestamp":1764547200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>AI-generated phishing emails present a growing cybersecurity threat, exploiting human psychology with high-quality, context-aware language. This paper introduces a novel two-stage detection framework that combines deep learning with psychological analysis to address this challenge. A new dataset containing 2995 GPT-o1-generated phishing emails, each labelled with Cialdini\u2019s six persuasion principles, is created across five organisational sectors\u2014forming one of the largest and most behaviourally annotated corpora in the field. The first stage employs a fine-tuned DistilBERT model to predict the presence of persuasion principles in each email. These confidence scores then feed into a lightweight dense neural network at the second stage for final binary classification. This interpretable design balances performance with insight into attacker strategies. The full system achieves 94% accuracy and 98% AUC, outperforming comparable methods while offering a clearer explanation of model decisions. Analysis shows that principles like authority, scarcity, and social proof are highly indicative of phishing, while reciprocation and likeability occur more often in legitimate emails. This research contributes an interpretable, psychology-informed framework for phishing detection, alongside a unique dataset for future study. Results demonstrate the value of behavioural cues in identifying sophisticated phishing attacks and suggest broader applications in detecting malicious AI-generated content.<\/jats:p>","DOI":"10.3390\/computers14120523","type":"journal-article","created":{"date-parts":[[2025,12,4]],"date-time":"2025-12-04T16:07:38Z","timestamp":1764864458000},"page":"523","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["A Two-Stage Deep Learning Framework for AI-Driven Phishing Email Detection Based on Persuasion Principles"],"prefix":"10.3390","volume":"14","author":[{"given":"Peter","family":"Tooher","sequence":"first","affiliation":[{"name":"WMG, Cyber Security Centre, University of Warwick, Coventry CV4 7AL, UK"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1558-5115","authenticated-orcid":false,"given":"Harjinder Singh","family":"Lallie","sequence":"additional","affiliation":[{"name":"WMG, Cyber Security Centre, University of Warwick, Coventry CV4 7AL, UK"}]}],"member":"1968","published-online":{"date-parts":[[2025,12,1]]},"reference":[{"key":"ref_1","unstructured":"Micro, T. (2024, October 20). Top 15 Phishing Stats to Know in 2024. Trend Micro News Web Article, 2024. Available online: https:\/\/news.trendmicro.com\/2024\/07\/22\/phishing-stats-2024\/."},{"key":"ref_2","unstructured":"Cveticanin, N. (2024, October 20). Phishing Statistics & How to Avoid Taking the Bait. Dataprot Web Article, 2023. Available online: https:\/\/dataprot.net\/statistics\/phishing-statistics\/."},{"key":"ref_3","unstructured":"IBM (2024, October 20). Cost of a Data Breach 2024. IBM Report, 2024. Available online: https:\/\/www.ibm.com\/reports\/data-breach."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"76","DOI":"10.1038\/scientificamerican0201-76","article-title":"The science of persuasion","volume":"284","author":"Cialdini","year":"2001","journal-title":"Sci. Am."},{"key":"ref_5","unstructured":"Hooson, M. (2024, October 20). UK Remote and Hybrid Working Statistics. Forbes Advisor UK Web Article, 2024. Available online: https:\/\/www.forbes.com\/uk\/advisor\/business\/remote-work-statistics\/."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Fette, I., Sadeh, N., and Tomasic, A. (2007, January 8\u201312). Learning to detect phishing emails. Proceedings of the Proceedings of the 16th International Conference on World Wide Web (WWW \u201907), Banff, AB, Canada.","DOI":"10.1145\/1242572.1242660"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Bagui, S., Nandi, D., Bagui, S., and White, R.J. (2019, January 3\u20134). Classifying phishing email using machine learning and deep learning. Proceedings of the 2019 International Conference on Cyber Security and Protection of Digital Services (CyberSecPODS), Oxford, UK.","DOI":"10.1109\/CyberSecPODS.2019.8885143"},{"key":"ref_8","unstructured":"Ma, Q., Qin, Z., Zhang, F., and Liu, Q. (2010, January 28\u201330). Text spam neural-network classification algorithm. Proceedings of the 2010 International Conference on Communications, Circuits and Systems (ICCCAS), Chengdu, China."},{"key":"ref_9","unstructured":"Metsis, V., Androutsopoulos, I., and Paliouras, G. (2006, January 27\u201328). Spam filtering with naive Bayes-Which naive Bayes?. Proceedings of the Proceedings of the 3rd Conference on Email and Anti-Spam (CEAS 2006), Mountain View, CA, USA."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Shams, R., and Mercer, R.E. (2013, January 7\u201310). Classifying spam emails using text and readability features. Proceedings of the 2013 IEEE 13th International Conference on Data Mining, Dallas, TX, USA.","DOI":"10.1109\/ICDM.2013.131"},{"key":"ref_11","first-page":"55","article-title":"An intelligent classification model for phishing-email detection","volume":"8","author":"Yasin","year":"2016","journal-title":"Int. J. Netw. Secur. Its Appl."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"108826","DOI":"10.1016\/j.comnet.2022.108826","article-title":"Efficient spam- and phishing-email filtering based on deep learning","volume":"206","author":"Magdy","year":"2022","journal-title":"Comput. Netw."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"149","DOI":"10.1016\/j.neucom.2019.02.056","article-title":"Application of deep learning to cybersecurity: A survey","volume":"347","author":"Mahdavifar","year":"2019","journal-title":"Neurocomputing"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1007\/s10462-024-11055-z","article-title":"Staying ahead of phishers: A review of recent advances and emerging methodologies in phishing detection","volume":"58","author":"Kavya","year":"2025","journal-title":"Artif. Intell. Rev."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1016\/j.ijhcs.2018.12.004","article-title":"Persuasion: How phishing emails can influence users and bypass security measures","volume":"125","author":"Ferreira","year":"2019","journal-title":"Int. J.-Hum.-Comput. Stud."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Li, X., Zhang, D., and Wu, B. (2020, January 12\u201314). Detection method of phishing email based on persuasion principle. Proceedings of the 2020 IEEE 4th Information Technology, Networking, Electronic and Automation Control Conference, Chongqing, China.","DOI":"10.1109\/ITNEC48623.2020.9084766"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Bustio-Mart\u00ednez, L., Herrera-Semenets, V., Garc\u00eda-Mendoza, J.L., Gonz\u00e1lez-Ordiano, J.\u00c1., Z\u00fa\u00f1iga-Morales, L., S\u00e1nchez Rivero, R., Quir\u00f3z-Ibarra, J.E., Santander-Molina, P.A., van den Berg, J., and Buscaldi, D. (2023). Towards automatic principles of persuasion detection using a machine-learning approach. Lecture Notes in Computer Science, Springer.","DOI":"10.1007\/978-3-031-49552-6_14"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Karki, B., Abri, F., Siami Namin, A., and Jones, K.S. (2022, January 17\u201320). Using transformers for identification of persuasion principles in phishing emails. Proceedings of the 2022 IEEE International Conference on Big Data, Osaka, Japan.","DOI":"10.1109\/BigData55660.2022.10020452"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Eze, C.S., and Shamir, L. (2024). Analysis and prevention of AI-based phishing email attacks. Electronics, 13.","DOI":"10.3390\/electronics13101839"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"127044","DOI":"10.1016\/j.eswa.2025.127044","article-title":"Evaluating spam filters and stylometric detection of AI-generated phishing emails","volume":"276","author":"Opara","year":"2025","journal-title":"Expert Syst. Appl."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Gryka, P., Grado\u0144, K., Koz\u0142owski, M., Kuty\u0142a, M., and Janicki, A. (August, January 30). Detection of AI-generated emails-A case study. Proceedings of the 19th International Conference on Availability, Reliability and Security (ARES 2024), Vienna, Austria.","DOI":"10.1145\/3664476.3670465"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Elongha, G., and Liu, X. Detecting AI-generated phishing emails targeting healthcare practitioners using ensemble techniques. SSRN, 2024. in press.","DOI":"10.2139\/ssrn.4934129"},{"key":"ref_23","first-page":"1","article-title":"Advanced strategies for detecting and preventing AI-generated phishing attacks","volume":"10","author":"Petrov","year":"2024","journal-title":"Innov. Comput. Sci. J."},{"key":"ref_24","first-page":"5998","article-title":"Attention is all you need","volume":"Volume 30","author":"Vaswani","year":"2017","journal-title":"Proceedings of the 31st Conference on Neural Information Processing Systems (NIPS 2017)"},{"key":"ref_25","unstructured":"Brown, T.B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., and Askell, A. (2020, January 6\u201312). Language models are few-shot learners. Proceedings of the 34th International Conference on Neural Information Processing Systems, Vancouver, BC, Canada."},{"key":"ref_26","first-page":"1","article-title":"Pre-train, prompt, and predict: A systematic survey of prompting methods in natural-language processing","volume":"55","author":"Liu","year":"2022","journal-title":"ACM Comput. Surv."},{"key":"ref_27","unstructured":"Sanh, V., Debut, L., Chaumond, J., and Wolf, T. (2019). DistilBERT, a distilled version of BERT: Smaller, faster, cheaper and lighter. arXiv."},{"key":"ref_28","unstructured":"Devlin, J., Chang, M.W., Lee, K., and Toutanova, K. (2019, January 2\u20137). BERT: Pre-training of deep bidirectional transformers for language understanding. Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Minneapolis, MN, USA."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Kobayashi, T. (2023, January 17\u201324). Two-way multi-label loss. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada.","DOI":"10.1109\/CVPR52729.2023.00722"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Yang, Z., Yang, D., Dyer, C., He, X., Smola, A., and Hovy, E. (2016, January 12\u201317). Hierarchical attention networks for document classification. Proceedings of the 2016 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, San Diego, CA, USA.","DOI":"10.18653\/v1\/N16-1174"},{"key":"ref_31","unstructured":"Miltchev, R., Rangelov, D., and Genchev, E. (2024). Phishing-Validation Emails Dataset, Zenodo. Dataset."}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-431X\/14\/12\/523\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,4]],"date-time":"2025-12-04T16:16:30Z","timestamp":1764864990000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-431X\/14\/12\/523"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,12,1]]},"references-count":31,"journal-issue":{"issue":"12","published-online":{"date-parts":[[2025,12]]}},"alternative-id":["computers14120523"],"URL":"https:\/\/doi.org\/10.3390\/computers14120523","relation":{},"ISSN":["2073-431X"],"issn-type":[{"value":"2073-431X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,12,1]]}}}