PiMRef

PiMRef : Detecting and Explaining Ever-Evolving Phishing Emails with Knowledge-Based Invariants

Introduction

In this work, we propose the 1st reference-based phishing email detection solution, PiMRef, which

Debunks the disprovable claims on sender identity,
Highlights the call-to-action triggers on next-step engagement

PiMRef significantly outperforms

Feature-engineering-based (D-Fence, HelpHed)
LLM-based (ChatSpamdetector)
Rule-based (Rspamd, SpamAssassin)

baselines in terms of precision, and recall, while maintaining a runtime within 0.05 seconds.

Demo (PimRef as an Outlook Plugin)

Assets

SpearMail Benchmark

** This benchmark is only for showing the feasibility of LLM misuse in Spear-phishing Email generation.
To prevent ethical concerns, this benchmark will NOT be disseminated **

The diversity of topics covered by SpearMail in the following Figure
(Colors are produced by Latent Dirichlet allocation (LDA))

PiMRef : Detecting and Explaining Ever-Evolving Phishing Emails with Knowledge-Based Invariants

Introduction

Demo (PimRef as an Outlook Plugin)

Assets

SpearMail Benchmark

Datasets

Models

Code