An Explainable and Efficient Ensemble Framework for Phishing Email Detection

Abstract

Phishing email detection has increasingly benefited from deep neural models and transformer-based language representations. However, many operational security settings still require detectors that are transparent, low-latency, auditable, and deployable without GPU resources. This paper presents an explainable phishing email detection framework that combines adversarial-aware natural language preprocessing, TF-IDF and lexical-security features, a soft-voting ensemble of Random Forest and XGBoost classifiers, and two complementary explainability mechanisms: LIME for instance-level explanations and ELI5style global feature attribution. On a consolidated corpus of 39,648 emails, the system achieves 89.46% accuracy and 0.97 AUC while producing analyst-facing explanations in real time on commodity hardware. The results highlight a practical trade-off between predictive performance, interpretability, and deployment efficiency for security operations environments.