{"id":"https://openalex.org/W7108622815","doi":"https://doi.org/10.1109/access.2025.3641123","title":"A Cognitive BDI\u2013BiLSTM Hybrid Framework for Interpretable Email Threat Detection","display_name":"A Cognitive BDI\u2013BiLSTM Hybrid Framework for Interpretable Email Threat Detection","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W7108622815","doi":"https://doi.org/10.1109/access.2025.3641123"},"language":null,"primary_location":{"id":"doi:10.1109/access.2025.3641123","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3641123","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2025.3641123","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Salam Al-E\u2019Mari","orcid":"https://orcid.org/0000-0002-2134-4158"},"institutions":[{"id":"https://openalex.org/I36622005","display_name":"Petra University","ror":"https://ror.org/039d9es10","country_code":"JO","type":"education","lineage":["https://openalex.org/I36622005"]}],"countries":["JO"],"is_corresponding":false,"raw_author_name":"Salam Al-E\u2019Mari","raw_affiliation_strings":["Department of Information Security, Faculty of Information Technology, University of Petra, Amman, Jordan"],"raw_orcid":"https://orcid.org/0000-0002-2134-4158","affiliations":[{"raw_affiliation_string":"Department of Information Security, Faculty of Information Technology, University of Petra, Amman, Jordan","institution_ids":["https://openalex.org/I36622005"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yousef Sanjalawe","orcid":"https://orcid.org/0000-0002-4442-1865"},"institutions":[{"id":"https://openalex.org/I114972647","display_name":"University of Jordan","ror":"https://ror.org/05k89ew48","country_code":"JO","type":"education","lineage":["https://openalex.org/I114972647"]}],"countries":["JO"],"is_corresponding":false,"raw_author_name":"Yousef Sanjalawe","raw_affiliation_strings":["Department of Information Technology, King Abdullah II School for Information Technology, University of Jordan (JU), Amman, Jordan"],"raw_orcid":"https://orcid.org/0000-0002-4442-1865","affiliations":[{"raw_affiliation_string":"Department of Information Technology, King Abdullah II School for Information Technology, University of Jordan (JU), Amman, Jordan","institution_ids":["https://openalex.org/I114972647"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Salam Fraihat","orcid":"https://orcid.org/0000-0002-1025-7868"},"institutions":[{"id":"https://openalex.org/I182000528","display_name":"Ajman University","ror":"https://ror.org/01j1rma10","country_code":"AE","type":"education","lineage":["https://openalex.org/I182000528"]},{"id":"https://openalex.org/I2799651553","display_name":"City University Ajman","ror":"https://ror.org/00zb4qh40","country_code":"AE","type":"education","lineage":["https://openalex.org/I2799651553"]}],"countries":["AE"],"is_corresponding":false,"raw_author_name":"Salam Fraihat","raw_affiliation_strings":["Department of Information Technology, College of Engineering and Information Technology, Artificial Intelligence Research Center (AIRC), Ajman University, Ajman, United Arab Emirates"],"raw_orcid":"https://orcid.org/0000-0002-1025-7868","affiliations":[{"raw_affiliation_string":"Department of Information Technology, College of Engineering and Information Technology, Artificial Intelligence Research Center (AIRC), Ajman University, Ajman, United Arab Emirates","institution_ids":["https://openalex.org/I182000528","https://openalex.org/I2799651553"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Ghader Kurdi","orcid":null},"institutions":[{"id":"https://openalex.org/I199693650","display_name":"Umm al-Qura University","ror":"https://ror.org/01xjqrm90","country_code":"SA","type":"education","lineage":["https://openalex.org/I199693650"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Ghader Kurdi","raw_affiliation_strings":["Department of Data Science, College of Computing, Umm Al-Qura University (UQU), Makkah, Saudi Arabia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Data Science, College of Computing, Umm Al-Qura University (UQU), Makkah, Saudi Arabia","institution_ids":["https://openalex.org/I199693650"]}]},{"author_position":"last","author":{"id":null,"display_name":"Budoor Allehyani","orcid":"https://orcid.org/0009-0006-0424-6894"},"institutions":[{"id":"https://openalex.org/I199693650","display_name":"Umm al-Qura University","ror":"https://ror.org/01xjqrm90","country_code":"SA","type":"education","lineage":["https://openalex.org/I199693650"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Budoor Allehyani","raw_affiliation_strings":["Department of Software Engineering, College of Computing, Umm Al-Qura University (UQU), Makkah, Saudi Arabia"],"raw_orcid":"https://orcid.org/0009-0006-0424-6894","affiliations":[{"raw_affiliation_string":"Department of Software Engineering, College of Computing, Umm Al-Qura University (UQU), Makkah, Saudi Arabia","institution_ids":["https://openalex.org/I199693650"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":2.3589,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.92820405,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":98},"biblio":{"volume":"13","issue":null,"first_page":"208192","last_page":"208211"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.44909998774528503,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.44909998774528503,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12607","display_name":"Personal Information Management and User Behavior","score":0.12070000171661377,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11147","display_name":"Misinformation and Its Impacts","score":0.08489999920129776,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/communication-source","display_name":"Communication source","score":0.5273000001907349},{"id":"https://openalex.org/keywords/cognition","display_name":"Cognition","score":0.5116999745368958},{"id":"https://openalex.org/keywords/safeguarding","display_name":"Safeguarding","score":0.486299991607666},{"id":"https://openalex.org/keywords/transparency","display_name":"Transparency (behavior)","score":0.4361000061035156},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.3971000015735626},{"id":"https://openalex.org/keywords/trustworthiness","display_name":"Trustworthiness","score":0.39309999346733093},{"id":"https://openalex.org/keywords/deception","display_name":"Deception","score":0.3790999948978424},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.3718000054359436},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.37139999866485596}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8299000263214111},{"id":"https://openalex.org/C198104137","wikidata":"https://www.wikidata.org/wiki/Q974688","display_name":"Communication source","level":2,"score":0.5273000001907349},{"id":"https://openalex.org/C169900460","wikidata":"https://www.wikidata.org/wiki/Q2200417","display_name":"Cognition","level":2,"score":0.5116999745368958},{"id":"https://openalex.org/C2776743756","wikidata":"https://www.wikidata.org/wiki/Q5097921","display_name":"Safeguarding","level":2,"score":0.486299991607666},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4650999903678894},{"id":"https://openalex.org/C2780233690","wikidata":"https://www.wikidata.org/wiki/Q535347","display_name":"Transparency (behavior)","level":2,"score":0.4361000061035156},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3971000015735626},{"id":"https://openalex.org/C153701036","wikidata":"https://www.wikidata.org/wiki/Q659974","display_name":"Trustworthiness","level":2,"score":0.39309999346733093},{"id":"https://openalex.org/C2779267917","wikidata":"https://www.wikidata.org/wiki/Q170028","display_name":"Deception","level":2,"score":0.3790999948978424},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.3718000054359436},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.37139999866485596},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.36899998784065247},{"id":"https://openalex.org/C20854674","wikidata":"https://www.wikidata.org/wiki/Q4386060","display_name":"Cognitive architecture","level":3,"score":0.3490999937057495},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.34769999980926514},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.3237000107765198},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.320499986410141},{"id":"https://openalex.org/C85407183","wikidata":"https://www.wikidata.org/wiki/Q1045785","display_name":"Semantic network","level":2,"score":0.3192000091075897},{"id":"https://openalex.org/C2986342778","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Cognitive systems","level":3,"score":0.31619998812675476},{"id":"https://openalex.org/C2780276568","wikidata":"https://www.wikidata.org/wiki/Q191928","display_name":"Polysemy","level":2,"score":0.3075000047683716},{"id":"https://openalex.org/C175154964","wikidata":"https://www.wikidata.org/wiki/Q380077","display_name":"Task analysis","level":3,"score":0.2912999987602234},{"id":"https://openalex.org/C61641136","wikidata":"https://www.wikidata.org/wiki/Q1107019","display_name":"Cognitive load","level":3,"score":0.2897000014781952},{"id":"https://openalex.org/C161407221","wikidata":"https://www.wikidata.org/wiki/Q4382939","display_name":"Cognitive model","level":3,"score":0.28610000014305115},{"id":"https://openalex.org/C2780224610","wikidata":"https://www.wikidata.org/wiki/Q1530061","display_name":"Credibility","level":2,"score":0.28119999170303345},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.2703999876976013},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.2678999900817871},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.26179999113082886},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.2615000009536743},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.25940001010894775}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/access.2025.3641123","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3641123","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1109/access.2025.3641123","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3641123","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.48023244738578796,"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":43,"referenced_works":["https://openalex.org/W1578573078","https://openalex.org/W1955603680","https://openalex.org/W2028223155","https://openalex.org/W2037930066","https://openalex.org/W2040717637","https://openalex.org/W2148143831","https://openalex.org/W2747680751","https://openalex.org/W2890718808","https://openalex.org/W2962772482","https://openalex.org/W2991305957","https://openalex.org/W2994233584","https://openalex.org/W3039513780","https://openalex.org/W3164563478","https://openalex.org/W3171314438","https://openalex.org/W3198728774","https://openalex.org/W3212041623","https://openalex.org/W4207043923","https://openalex.org/W4210312870","https://openalex.org/W4226418765","https://openalex.org/W4240840618","https://openalex.org/W4313328599","https://openalex.org/W4315643577","https://openalex.org/W4323847532","https://openalex.org/W4382516701","https://openalex.org/W4386608804","https://openalex.org/W4387108032","https://openalex.org/W4388041793","https://openalex.org/W4388110907","https://openalex.org/W4388379719","https://openalex.org/W4390512389","https://openalex.org/W4391964416","https://openalex.org/W4401297269","https://openalex.org/W4401343271","https://openalex.org/W4402822963","https://openalex.org/W4402925642","https://openalex.org/W4403887030","https://openalex.org/W4405728396","https://openalex.org/W4407443647","https://openalex.org/W4411120371","https://openalex.org/W4411206831","https://openalex.org/W4411294637","https://openalex.org/W4414592619","https://openalex.org/W4414602852"],"related_works":[],"abstract_inverted_index":{"Email":[0],"threats":[1],"continue":[2],"to":[3,37,53,90,162],"pose":[4],"a":[5,22,46,63,86,130,152],"significant":[6],"challenge":[7],"in":[8],"cybersecurity,":[9],"exploiting":[10],"human":[11],"vulnerabilities":[12],"through":[13],"highly":[14],"deceptive":[15],"and":[16,56,76,96,104,151,176],"context-aware":[17],"content.":[18],"This":[19],"study":[20],"introduced":[21],"novel":[23],"hybrid":[24],"detection":[25,165],"framework":[26],"that":[27],"integrated":[28],"semantic":[29],"deep":[30],"learning":[31],"with":[32,117],"cognitively":[33],"inspired":[34],"symbolic":[35,115],"reasoning":[36],"address":[38],"these":[39],"evolving":[40],"risks.":[41],"The":[42],"proposed":[43,140],"system":[44],"utilized":[45],"Bidirectional":[47],"Long":[48],"Short-Term":[49],"Memory":[50],"(BiLSTM)":[51],"network":[52],"capture":[54],"sequential":[55],"linguistic":[57],"patterns":[58],"from":[59],"email":[60,133],"content,":[61],"while":[62,167],"Belief\u2013Desire\u2013Intention":[64],"(BDI)":[65],"cognitive":[66,98],"agent":[67],"modeled":[68],"behavioral":[69],"indicators,":[70],"including":[71],"urgency":[72],"cues,":[73],"sender":[74],"anomalies,":[75],"irregular":[77],"sending":[78],"patterns.":[79],"These":[80,156],"complementary":[81],"components":[82],"were":[83],"fused":[84],"within":[85],"unified":[87],"architecture":[88],"designed":[89],"achieve":[91],"both":[92],"high":[93],"predictive":[94],"accuracy":[95],"meaningful":[97],"interpretability.":[99],"To":[100],"further":[101],"enhance":[102],"transparency":[103],"facilitate":[105],"human-in-the-loop":[106],"decision-making,":[107],"the":[108,136,139,159],"BDI-SHAP-X":[109],"module":[110],"was":[111],"developed,":[112],"combining":[113],"rule-based":[114],"explanations":[116],"SHapley":[118],"Additive":[119],"exPlanations":[120],"(SHAP)":[121],"for":[122,173],"localized":[123],"feature":[124],"attribution.":[125],"An":[126],"experimental":[127],"evaluation":[128],"of":[129,138,154],"comprehensive,":[131],"enriched":[132],"corpus":[134],"demonstrates":[135],"effectiveness":[137],"model,":[141],"achieving":[142],"98.31%":[143],"accuracy,":[144],"97.80%":[145],"precision,":[146],"98.85%":[147],"recall,":[148],"98.32%":[149],"F1-score,":[150],"ROC-AUC":[153],"99.78%.":[155],"results":[157],"emphasize":[158],"framework\u2019s":[160],"capacity":[161],"deliver":[163],"state-of-the-art":[164],"performance":[166],"ensuring":[168],"interpretable,":[169],"trustworthy":[170],"insights":[171],"essential":[172],"safeguarding":[174],"enterprise":[175],"critical":[177],"communication":[178],"infrastructures.":[179]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-12-05T00:00:00"}