{"id":"https://openalex.org/W7161050952","doi":"https://doi.org/10.48550/arxiv.2605.11619","title":"PhishSigma++: Malicious Email Detection with Typed Entity Relations","display_name":"PhishSigma++: Malicious Email Detection with Typed Entity Relations","publication_year":2026,"publication_date":"2026-05-12","ids":{"openalex":"https://openalex.org/W7161050952","doi":"https://doi.org/10.48550/arxiv.2605.11619"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.11619","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.11619","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.11619","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136021026","display_name":"Shang Shang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shang, Shang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136029593","display_name":"Ruiqi Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Ruiqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136016293","display_name":"Ruijie Qi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Qi, Ruijie","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136070630","display_name":"Hao Li","orcid":"https://orcid.org/0000-0002-7577-1366"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Hao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049446052","display_name":"Yingxiao Xiang","orcid":"https://orcid.org/0000-0002-8679-7000"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xiang, Yingxiao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044754708","display_name":"Yepeng Yao","orcid":"https://orcid.org/0000-0002-2669-4915"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yao, Yepeng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5136033355","display_name":"Zhengwei Jiang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jiang, Zhengwei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9599000215530396,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9599000215530396,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11147","display_name":"Misinformation and Its Impacts","score":0.00989999994635582,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12380","display_name":"Authorship Attribution and Profiling","score":0.0035000001080334187,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/evasion","display_name":"Evasion (ethics)","score":0.525600016117096},{"id":"https://openalex.org/keywords/discriminative-model","display_name":"Discriminative model","score":0.521399974822998},{"id":"https://openalex.org/keywords/relation","display_name":"Relation (database)","score":0.5102999806404114},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.492900013923645},{"id":"https://openalex.org/keywords/phishing","display_name":"Phishing","score":0.47209998965263367},{"id":"https://openalex.org/keywords/invariant","display_name":"Invariant (physics)","score":0.42289999127388},{"id":"https://openalex.org/keywords/probabilistic-logic","display_name":"Probabilistic logic","score":0.41440001130104065},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.4049000144004822},{"id":"https://openalex.org/keywords/filter","display_name":"Filter (signal processing)","score":0.3935999870300293},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.3725000023841858}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7627999782562256},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.525600016117096},{"id":"https://openalex.org/C97931131","wikidata":"https://www.wikidata.org/wiki/Q5282087","display_name":"Discriminative model","level":2,"score":0.521399974822998},{"id":"https://openalex.org/C25343380","wikidata":"https://www.wikidata.org/wiki/Q277521","display_name":"Relation (database)","level":2,"score":0.5102999806404114},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.492900013923645},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.47209998965263367},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4611000120639801},{"id":"https://openalex.org/C190470478","wikidata":"https://www.wikidata.org/wiki/Q2370229","display_name":"Invariant (physics)","level":2,"score":0.42289999127388},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.41440001130104065},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.4049000144004822},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.4041000008583069},{"id":"https://openalex.org/C106131492","wikidata":"https://www.wikidata.org/wiki/Q3072260","display_name":"Filter (signal processing)","level":2,"score":0.3935999870300293},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.3725000023841858},{"id":"https://openalex.org/C188198153","wikidata":"https://www.wikidata.org/wiki/Q1613840","display_name":"Limiting","level":2,"score":0.36250001192092896},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.35760000348091125},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.34950000047683716},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.33660000562667847},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.33000001311302185},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.31779998540878296},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.3156000077724457},{"id":"https://openalex.org/C90805587","wikidata":"https://www.wikidata.org/wiki/Q10944557","display_name":"Word (group theory)","level":2,"score":0.3052000105381012},{"id":"https://openalex.org/C66746571","wikidata":"https://www.wikidata.org/wiki/Q1134833","display_name":"ENCODE","level":3,"score":0.29760000109672546},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.28450000286102295},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2838999927043915},{"id":"https://openalex.org/C153604712","wikidata":"https://www.wikidata.org/wiki/Q7310755","display_name":"Relationship extraction","level":3,"score":0.28279998898506165},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.28029999136924744},{"id":"https://openalex.org/C2778049214","wikidata":"https://www.wikidata.org/wiki/Q7512234","display_name":"Sigma","level":2,"score":0.27410000562667847},{"id":"https://openalex.org/C2778827112","wikidata":"https://www.wikidata.org/wiki/Q22245680","display_name":"Feature engineering","level":3,"score":0.26910001039505005},{"id":"https://openalex.org/C5655090","wikidata":"https://www.wikidata.org/wiki/Q192588","display_name":"Relational database","level":2,"score":0.26809999346733093},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.26660001277923584},{"id":"https://openalex.org/C2776461190","wikidata":"https://www.wikidata.org/wiki/Q22673982","display_name":"Word2vec","level":3,"score":0.26570001244544983},{"id":"https://openalex.org/C107673813","wikidata":"https://www.wikidata.org/wiki/Q812534","display_name":"Bayesian probability","level":2,"score":0.26440000534057617},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2599000036716461},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.2581000030040741},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2540999948978424}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.11619","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.11619","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.11619","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.11619","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/10","score":0.5943929553031921,"display_name":"Reduced inequalities"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Here":[0],"is":[1,84],"a":[2,131,143,179,187,220,236],"further":[3],"shortened":[4],"version":[5],"(pure":[6],"text,":[7,74],"no":[8,14],"extra":[9],"formatting,":[10],"academic":[11],"style":[12],"preserved,":[13],"content":[15,23],"change):":[16],"Abstract.":[17],"With":[18],"the":[19,58],"rise":[20],"of":[21,223],"AI-generated":[22],"(AIGC),":[24],"phishing":[25,67,189],"actors":[26],"now":[27],"possess":[28],"richer":[29],"linguistic":[30],"capabilities":[31],"and":[32,135,149,163,186,207,231],"evasion":[33],"techniques.":[34],"Most":[35],"existing":[36],"detectors":[37],"over-rely":[38],"on":[39,46,160],"mutable":[40],"textual":[41],"features,":[42],"achieving":[43],"high":[44],"accuracy":[45],"clean":[47,161],"data":[48,162],"but":[49,89],"degrading":[50],"severely":[51],"under":[52,167],"text-focused":[53],"adversarial":[54],"manipulation.":[55],"This":[56],"mirrors":[57],"lab-to-real":[59],"performance":[60],"gap.":[61],"We":[62,104,211],"investigate":[63],"invariant":[64],"signals":[65],"in":[66,235],"emails:":[68],"even":[69],"when":[70],"attackers":[71],"modify":[72],"surface":[73],"functional":[75],"intent":[76],"constrains":[77],"relations":[78,128],"among":[79],"typed":[80,122,132,216],"entities.":[81],"Threat-actor":[82],"tradecraft":[83],"described":[85],"via":[86],"high-level":[87],"TTPs,":[88],"rule-based":[90],"systems":[91],"like":[92],"Sigma":[93,197],"express":[94],"invariants":[95],"only":[96],"through":[97],"manually":[98],"curated,":[99],"field-specific":[100],"patterns,":[101],"limiting":[102],"flexibility.":[103],"introduce":[105],"PhishSigma++,":[106],"an":[107],"entity-relation-based":[108],"malicious":[109],"email":[110,133],"detector":[111],"for":[112],"RFC822":[113],"messages":[114],"that":[115,214],"generalizes":[116],"Sigma's":[117],"design.":[118],"It":[119,174],"extracts":[120],"40":[121],"entity":[123],"classes,":[124],"computes":[125],"5":[126],"cross-type":[127],"to":[129,141,184,192],"build":[130],"graph,":[134],"uses":[136],"particle":[137],"swarm":[138],"optimization":[139],"(PSO)":[140],"select":[142],"sparse":[144],"discriminative":[145],"mask,":[146],"supporting":[147],"classification":[148],"type-level":[150],"evidence":[151],"summary.":[152],"On":[153],"29,142":[154],"messages,":[155],"PhishSigma++":[156,199],"achieves":[157],"0.9675":[158],"F1":[159],"outperforms":[164],"text-centric":[165],"baselines":[166],"non-adaptive":[168],"Good":[169],"Word":[170],"padding":[171],"at":[172],"\\r{ho}=0.8.":[173],"maintains":[175],"0.9579":[176],"F1,":[177],"while":[178],"token-based":[180],"Bayesian":[181],"filter":[182],"collapses":[183],"0.0243":[185],"DistilBERT":[188],"checkpoint":[190],"falls":[191],"0.7284.":[193],"Compared":[194],"with":[195],"traditional":[196],"rules,":[198],"offers":[200],"higher":[201],"detection,":[202],"broader":[203],"relational":[204],"invariance":[205],"coverage,":[206],"data-driven":[208],"feature":[209],"selection.":[210],"also":[212],"show":[213],"thresholded":[215],"relation":[217,233],"scores":[218],"encode":[219],"useful":[221],"fragment":[222],"Sigma-style":[224],"field":[225],"conditions,":[226],"unifying":[227],"hand-crafted":[228],"rule":[229],"logic":[230],"learned":[232],"masks":[234],"single-email":[237],"framework.":[238]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-14T00:00:00"}