Rapid Phishing Email Detection Using Soft-Voting Ensemble of Heuristics and TF-IDF Features

Emails with phishing result in the loss of more than $57 billion every year all over the world. The current detection methods, including heuristic rule sets, statistical classifiers, and deep neural networks, detect only a fraction of phishing signals, restricting the coverage of detection. The hybrid framework presented in this paper is a 37-dimensional heuristic feature vector (including URL anomalies, metadata inconsistencies, urgency scores, financial cues, stylometric features and statistical text metrics across nine categories) combined with a 1000-dimensional TF-IDF representation condensed into a unified feature space of size 1,037. The Proposed Ensemble Model (PEM) is a combination of five classifiers (Random Forest, SVM, Logistic Regression, XGBoost, LightGBM). The PEM is tested on two benchmark datasets (Radev Fraud Email and Kaggle consolidated corpus; 24,000 samples) with an accuracy of 99.25, 99.04 recall and 0.9846 MCC. The statistical significance across all baselines is confirmed by McNemar test (p < 0.05). The inference latency per email of 2.84 ms supports the use of inference in real-time enterprise deployment without the need to have a GPU infrastructure.