CHANNEL ASYMMETRY IN MULTI-COMPONENT PHISHING DETECTION: A CROSS-VALIDATED COMPARISON OF URL, HTML AND EMAIL-TEXT CLASSIFIERS

Multi-component phishing detectors are normally reported as a single headline accuracy, which conceals how differently the individual channels behave. This paper re-examines a three-component lightweight framework — a DistilBERT classifier over URLs, a Random Forest over thirteen structural HTML features, and a second DistilBERT over email body text — and asks not how well the framework performs but how unequally its channels perform. The three channels receive 99.87 %, 93.81 % and 96.79 % accuracy under the same five-fold cross-validation procedure. The spread in point estimates, however, is the less important part of the story: the standard deviation of accuracy across folds ranges by a factor of 15.7 from the URL to the email channel, and the standard deviation of recall by a factor of 37.5. Both content channels also exhibit high precision above recall, meaning the errors are in missed phishing rather than false alarms, and that the imbalance is largest (1.27 pp) in the email channel that faces the human victim. We argue that the per-channel error rate alone is not enough for designing a fusion layer and the dispersion across folds and the direction of precision–recall gap should be reported together.

Hali tarjima qilinmagan