Open Access

ARTICLE

A Hybrid CNN-XGBoost Framework for Phishing Email Detection Using Statistical and Semantic Features

Lin-Hui Liu¹, Dong-Jie Liu^1,*, Yin-Yan Zhang¹, Xiao-Bo Jin², Xiu-Cheng Wu³, Guang-Gang Geng¹

1 College of Cyber Security, Jinan University, Guangzhou, China
2 Department of Intelligent Science, Xi’an Jiaotong-Liverpool University, Suzhou, China
3 Coremail Technology Co. Ltd., Guangzhou, China

* Corresponding Author: Dong-Jie Liu. Email:

Computers, Materials & Continua 2026, 87(2), 58 https://doi.org/10.32604/cmc.2026.074253

Received 06 October 2025; Accepted 26 December 2025; Issue published 12 March 2026

Abstract

Phishing email detection represents a critical research challenge in cybersecurity. To address this, this paper proposes a novel Double-S (statistical-semantic) feature model based on three core entities involved in email communication: the sender, recipient, and email content. We employ strategic game theory to analyze the offensive strategies of phishing attackers and defensive strategies of protectors, extracting statistical features from these entities. We also leverage the Qwen large language model to excavate implicit semantic features (e.g., emotional manipulation and social engineering tactics) from email content. By integrating statistical and semantic features, our model achieves a robust representation of phishing emails. We introduce a hybrid detection model that integrates a convolutional neural network (CNN) module with the XGBoost (Extreme Gradient Boosting) classifier, effectively capturing local correlations in high-dimensional features. Experimental results on real-world phishing email datasets demonstrate the superiority of our approach, achieving an F1-score of 0.9587, precision of 0.9591, and recall of 0.9583, representing improvements of 1.3%–10.6% compared to state-of-the-art methods.

---

Keywords

---