Hybrid Phishing Detection Model: Integrating BERT with TF-IDF for Enhanced Email Security

Abstract

Phishing emails remain a major cybersecurity problem because they cleverly exploit our natural trust by impersonating real messages. While standard NLP methods like TF-IDF and FastText are efficient, they often miss the subtle, contextual tricks found in today's sophisticated phishing attempts. On the other hand, advanced deep learning models like BERT are fantastic at understanding context, but they require a lot of computational power. In this paper, we suggest a hybrid solution. We merge the lightweight, statistical strengths of TF-IDF with the deep contextual power of BERT's embeddings to create a more robust phishing detection system. To test this, we ran experiments on datasets of 1,000, 5,000, and 10,000 emails, putting five different models head-to-head. Our results were clear: the hybrid models consistently beat the single-method ones. Interestingly, the TF-IDF + BERT combo was the most accurate on the smaller dataset (1,000 samples). However, for larger datasets (5,000 and 10,000 samples), TF-IDF + FastText offered the best balance of accuracy and speed. While the BERT hybrid was slightly more accurate, its slower processing time is a real hurdle for scaling up. We believe our proposed framework offers a practical and effective tool for real-world cybersecurity teams.

Manuscript received: 3 Jul 2025 | Revised: 25 Aug 2025 | Accepted: 7 Sep 2025 | Published: 30 Nov 2025