Cognitive Threat Intelligence for Phishing Attacks: A Reasoning-Driven Explainable AI Framework for Transparent Decision-Making

Abstract

As phishing techniques become increasingly sophisticated through contextual manipulation and social engineering, traditional detection methods based on blacklists and lexical analysis face limitations in identifying previously unseen threats. This study presents an explainable phishing email detection framework that combines Bidirectional Encoder Representations from Transformers (BERT) for contextual semantic feature extraction with a Support Vector Machine (SVM) for classification. In addition to semantic representations, structural characteristics of email messages are incorporated to improve phishing detection. To enhance transparency, SHapley Additive exPlanations (SHAP) is integrated to provide feature-level explanations for the model's predictions. The proposed BERT-SVM framework achieved an accuracy of 94% on the evaluated test set (utilizing an 80:20 split on the CEAS 2008 benchmark), with a phishing-class recall of 94% and a ROC-AUC of 0.95. These results indicate that the framework can effectively distinguish phishing emails from legitimate messages while providing interpretable information that can support cybersecurity analysis.