Phishing email is a serious cyber threat that tries to deceive users by
sending false emails with the intention of stealing confidential information or
causing financial harm. Attackers, often posing as trustworthy entities,
exploit technological advancements and sophistication to make detection and
prevention of phishing more challenging. Despite extensive academic research,
phishing detection remains an ongoing and formidable challenge in the
cybersecurity landscape. Large Language Models (LLMs) and Masked Language
Models (MLMs) possess immense potential to offer innovative solutions to
address long-standing challenges. In this research paper, we present an
optimized, fine-tuned transformer-based DistilBERT model designed for the
detection of phishing emails. In the detection process, we work with a phishing
email dataset and utilize the preprocessing techniques to clean and solve the
imbalance class issues. Through our experiments, we found that our model
effectively achieves high accuracy, demonstrating its capability to perform
well. Finally, we demonstrate our fine-tuned model using Explainable-AI (XAI)
techniques such as Local Interpretable Model-Agnostic Explanations (LIME) and
Transformer Interpret to explain how our model makes predictions in the context
of text classification for phishing emails.

本研究论文介绍了一种优化的、经过微调的基于 Transformer 的 DistilBERT 模型，用于检测钓鱼邮件。通过实验，我们发现我们的模型能够有效地实现高准确性，并使用可解释的 AI 技术来解释我们的模型在钓鱼邮件的文本分类中进行预测的方式。

可解释的基于 Transformer 的网络钓鱼邮件检测模型：一种大型语言模型方法

An Explainable Transformer-based Model for Phishing Email Detection: A  Large Language Model Approach

Many public sources of cyber threat and vulnerability information exist to
help defend cyber systems. This paper links MITRE's ATT&CK MATRIX of Tactics
and Techniques, NIST's Common Weakness Enumerations (CWE), Common
Vulnerabilities and Exposures (CVE), and Common Attack Pattern Enumeration and
Classification list (CAPEC), to gain further insight from alerts, threats and
vulnerabilities. We preserve all entries and relations of the sources, while
enabling bi-directional, relational path tracing within an aggregate data graph
called BRON. In one example, we use BRON to enhance the information derived
from a list of the top 10 most frequently exploited CVEs. We identify attack
patterns, tactics, and techniques that exploit these CVEs and also uncover a
disparity in how much linked information exists for each of these CVEs. This
prompts us to further inventory BRON's collection of sources to provide a view
of the extent and range of the coverage and blind spots of public data sources.

本文将 MITRE 的 ATT＆CK MATRIX、NIST 的通用弱点枚举（CWE）、CVE 和 CAPEC 等公共数据源连接起来，构建了一个名为 BRON 的聚合数据图，从而增强了 Alerts，威胁和漏洞的信息，并鉴别了公共数据源的盲点和范围。