Deep learning and explainable AI for email phishing classification: A comparative study of TabNet, NODE and FT-transformer models

Basit Öğe Kaydı
dc.contributor.authorAsal, Burcak
dc.contributor.authorOyucu, Saadin
dc.contributor.authorDogan, Ferdi
dc.contributor.authorPolat, Onur
dc.contributor.authorAksoz, Ahmet
dc.date.accessioned2026-02-27T07:33:25Z
dc.date.available2026-02-27T07:33:25Z
dc.date.issued2025
dc.description.abstractIn the changing landscape of cybersecurity threats, phishing emails indicate a persistent and damaging attack vector. This study investigates the effectiveness of deep learning models on a phishing email classification task using tabular data and focusing on TabNet, NODE (Neural Oblivious Decision Ensembles), and FT-Transformer architectures. The utilized dataset includes eight input features capturing linguistic and structural characteristics of emails, with a binary label indicating phishing or normal classification. Additionally, the NearMiss under-sampling approach is applied to address the significant class imbalance. Experimental results demonstrate that while all three models achieve strong performance, the FT-Transformer model outperforms TabNet and NODE by achieving the highest classification accuracy and balanced precision-recall scores. Additionally, explainable artificial intelligence (XAI) methods, SHAP and LIME, are employed to interpret the FT-Transformer model's decision-making process, which highlights the critical role of spelling errors, unique word counts, and urgency-related keywords in phishing detection. The findings emphasize the potential of transformer-based approaches for tabular cybersecurity applications and indicate the importance of interpretable AI in enhancing trust and transparency in phishing detection systems.
dc.identifier.doi10.2339/politeknik.1745083
dc.identifier.issn1302-0900
dc.identifier.issn2147-9429
dc.identifier.urihttp://dx.doi.org/10.2339/politeknik.1745083
dc.identifier.urihttps://hdl.handle.net/20.500.14669/4559
dc.identifier.wosWOS:001609051000001
dc.indekslendigikaynakWeb of Science
dc.indekslendigikaynakTR-Dizin
dc.language.isotr
dc.publisherGazi Univ
dc.relation.ispartofJournal of Polytechnic-Politeknik Dergisi
dc.relation.publicationcategoryMakale - Uluslararas� Hakemli Dergi - Kurum ��retim Eleman�
dc.rightsinfo:eu-repo/semantics/openAccess
dc.snmzKA_20260302
dc.subjectExplainable Artificial Intelligence (XAI)
dc.subjectTabNet
dc.subjectNODE
dc.subjectFT-Transformer
dc.subjectEmail Phishing Classification
dc.subjectSHAP
dc.subjectLIME
dc.titleDeep learning and explainable AI for email phishing classification: A comparative study of TabNet, NODE and FT-transformer models
dc.typeArticle; Early Access

Dosyalar

Koleksiyon

WoS İndeksli Yayınlar Koleksiyonu
TR-Dizin İndeksli Yayınlar Koleksiyonu