PhishShield: A Lightweight Multi-Layer Email Phishing Detection Framework for Small and Medium Enter by IRJET Journal

PhishShield: A Lightweight Multi-Layer Email Phishing Detection Framework for Small and Medium Enterprises

Ketan Sawant, Sujal Raut, Manohar Kumawat, Sahil Valanju

B.E. Students, Dept. of Computer Science and Engineering (IoT and CS BC), A. C. Patil College of Engineering, Kharghar, Navi Mumbai University of Mumbai, India Guide: Dr. Manjusha Deshmukh, Head of Department, Dept. of CSE (IoT and CS BC)

Abstract Email phishing remains one of the most persistent and damaging cybersecurity threats globally. Attackers increasingly exploit breach data and AI-generated content to craft convincing messages that bypass conventional filters. Existing machine-learning solutions, although effective, demand substantial computational resources and infrastructure investment, rendering them impractical for small and medium enterprises (SMEs). This paper presents PhishShield, a lightweight, costeffective, multi-layer email protection framework that combines cloud-based AI content analysis (Google Gemini), email authentication protocols (SPF, DKIM, DMARC), keyword-based heuristic detection, and URL reputation scoring via the VirusTotal API. The system operates as an SMTP proxy, intercepting emails in transit before delivery and assigning each a composite threat score on a 0–40 scale. Emails are then automatically delivered, quarantined, or dropped according to configurable thresholds. Evaluation on a dataset of 20 real-world emails seven legitimate and thirteen phishing demonstrated 100% detection accuracy with zero false positives and an average processing latency of 10.8 seconds per message. PhishShield provides a scalable, explainable, and easy-to-deploy security layer that enables SMEs to strengthen email defences without requiring specialised expertise or costly on-premise infrastructure.

Key Words: Phishing Detection, Email Security, SMTP Proxy, Machine Learning, SPF/DKIM/DMARC, VirusTotal, Google Gemini, Explainable AI, Cybersecurity, SME

1. INTRODUCTION

Email phishing constitutes one of the foremost cyber security threats of the modern era. Phishing emails are fraudulent communications engineered to deceive recipients into disclosing sensitive credentials, financial details, or personal information,ortotriggertheinstallationofmalicioussoftware.Whatdistinguishescontemporaryphishingfromearlierspam campaignsisthelevelofprecisionandpersonalisationinvolved.Whereastraditionalspamwasbroadcastindiscriminatelyto large mailing lists, today's attacks are carefully researched, contextually relevant, and frequently indistinguishable from legitimatecorrespondence.

Accordingtocybersecurityreports,phishingincidentsaccountedforover300,000reportedcybereventsintheUnitedStates in 2024 alone, resulting in financial losses measured in billions of dollars. The problem is compounded by three converging trends. First, the rapid proliferation of large language models enables attackers to generate grammatically correct, professionallytonedemailsatscale,eliminatingthetypographicerrorsthatonceservedasreliableredflags.Second,theshift from bulk campaigns to spear phishing highly targeted attacks personalised with information sourced from social media, corporate directories, or previous breaches substantially increases the probability that a recipient will trust and act upon a fraudulentmessage.Third,attackerscontinuouslyadapttoevadenewlydeployeddefences,renderingstatic,rule-basedfilters obsoletewithinweeksofdeployment.

SMEs are disproportionately exposed to these threats. Large organisations typically employ dedicated security operations centres,expensiveenterpriseemailgateways,andteamsofanalysts.SMEs,bycontrast,rarelypossessthebudgetorexpertise todeployandmaintainsuchinfrastructure.Theconsequenceisa growingasymmetry:sophisticatedphishingtoolsavailable toanyattackeratnegligiblecost,versusunder-resourceddefendersrelyingonbasicspamfilters.

This paper addresses that asymmetry by proposing PhishShield a multi-layer, SMTP-proxy-based framework that delivers enterprise-grade phishing detection at a fraction of the cost. By combining cloud AI, authentication protocols, heuristic

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 05 | May 2026 www.irjet.net p-ISSN: 2395-0072

analysis, and real-time threat intelligence in a lightweight Python stack, PhishShield is designed to be deployable by any organisationregardlessofitstechnicalcapacity.

1.1 Phishing Taxonomy

Phishing manifests across multiple channels and targeting strategies. Email phishing represents the most prevalent form, in whichfraudulentmessagesimpersonatetrustedinstitutionstoharvestcredentialsorinstallmalware.Spearphishingrefines thisapproachwithindividualisedcontentderivedfromopen-sourceintelligence.Whalingtargetssenior executives,typically toauthorisefraudulentfinancialtransfersavariantknownasBusinessEmailCompromise(BEC).Smishingandvishingextend the same social-engineering principles to SMS and telephone channels respectively. PhishShield targets the email vector, whichremainstheprimaryattacksurfacefororganisationalcompromise.

1.2 Phishing Attack Lifecycle

A typical phishing campaign proceeds through a structured lifecycle: (1) target selection an individual or organisation is identified; (2)reconnaissance publiclyavailableinformationis gatheredto personalisethe message;(3) message crafting a convincingemail iscomposed,oftenassisted byAItools;(4)delivery themessageisdispatched,frequentlyfromspoofedor compromiseddomains;(5)exploitation thevictimclicksamaliciouslinkorprovidescredentials;(6)dataexfiltration stolen informationisleveragedforfraud,furtherintrusion,orresaleondark-webmarkets.Effectivedefencesmustintervenebefore stepfive,ideallyatthepointofdelivery.

2. LITERATURE SURVEY

Phishingdetectionresearchhasevolvedfromsimpleblacklist-basedapproachestosophisticatedensemblelearningsystems. Abu-Nimeh et al. [1] conducted a foundational comparative study of machine-learning techniques including naive Bayes, random forests, and support vector machines and demonstrated that learned models outperform static rules for email classification.Ma etal.[2] extendedthis work toURL-level analysis,showing thatfeaturesderived fromdomain registration andlexicalURLstructurecanreliablydistinguishmaliciousfrombenignlinks.

Verma and Hossain [3] applied semantic feature selection to phishing email text, demonstrating that contextual meaning capturesdeceptiveintentmoreeffectivelythansurface-levelkeywordfrequency.Sahingozetal.[4]evaluatedsevenmachine learning algorithms on a large URL dataset, with random forests achieving the highest classification accuracy.Fette et al. [5] proposedthePILFERsystem,whichextractedtenfeaturesfromemailheadersandbodiestotrainanSVMclassifier,achieving 99.5%detectionwithalowfalse-positiverate.

Deeplearningapproacheshavefurtherimproveddetectioncapability.Convolutionalandrecurrentneuralnetworks,including LSTMarchitectures,cancapturesequentialandcontextualpatternsinemailtextthatelude shallowermodels.However,these gains come with substantially higher computational requirements and the need for large, continuously updated labelled datasets barriersthatSMEscannotreadilyovercome.

Authentication-protocol-based approaches using SPF, DKIM, and DMARC [7, 8] provide orthogonal protection by verifying sender domain authority at the DNS level. These protocols are effective against domain spoofing but cannot detect phishing originatingfromcompromisedlegitimateaccountsornewlyregisteredlookalikedomainsthatpassauthenticationchecks.

Hybrid, multi-layer frameworks that combine content analysis, URL inspection, and authentication have demonstrated superior accuracy compared to single-method approaches [3, 4]. Nevertheless, most published systems require significant infrastructure and continuous retraining cycles, limiting their applicability to resource-constrained environments. The emergence of cloud-based AI APIs, such as those provided by Google and OpenAI, presents a promising direction: powerful natural-language understanding accessible via simple HTTP calls, without local model hosting. Academic evaluation of such APIsinthephishing-detectioncontextremainslimited,representingagapthatthisworkseekstoaddress.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 05 | May 2026 www.irjet.net p-ISSN: 2395-0072

2.1 Identified Research Gaps

Based on the survey above, the following gaps are evident: (i) static and rule-based approaches fail to generalise to novel phishing patterns; (ii) deep-learning models impose computational and maintenance burdens unsuitable for SMEs; (iii) existing datasets under-represent breach-based, AI-generated phishing; (iv) multi-layer integration remains complex to deploy in practice; and (v) cloud AI APIs are under-studied in this domain. PhishShield is designed to address all five gaps throughalightweight,modulararchitecture.

3. SYSTEM DESIGN AND ARCHITECTURE

PhishShieldisarchitectedasanSMTPproxy anintermediarypositionedbetweenexternalsendersandtheorganisation'smail server. All incoming SMTP traffic is routed through the proxy on port 1025, where each message is subject to multi-stage analysis before a delivery decision is issued. This placement requires no modification to existing mail clients or user workflows,reducingdeploymentfriction.

3.1 Multi-Layer Detection Pipeline

Uponreceipt,theproxyparseseachmessagetoextractthesenderaddress,recipientdetails,subjectline,plain-textandHTML body, embedded URLs, and attachment metadata. This structured representation is simultaneously forwarded to four independentdetectionengines,eachofwhichreturnsa sub-scoreona0–10scale.Thefourenginesaredescribedbelowand summarisedinTable1.

Table 1: PhishShield Detection Modules

Detection Module Weight Function

AIContentAnalysis(Gemini) High

EmailAuthentication (SPF/DKIM/DMARC)

Semanticunderstandingofemailintent,socialengineeringcues,and impersonationdetectionusingcloud-basedLLM

Medium DNS-levelverificationofsenderdomainauthoritytodetectspoofed identities

Keyword/PatternMatching Medium Heuristicscanningforurgencyphrases,suspiciousrequests,and obfuscationpatterns

URLReputation(VirusTotal) High Staticanddynamiclinkanalysisagainstaglobalthreatintelligence database

The AI Content Analysis Engine submits the email body and subject to the Google Gemini API with a carefully engineered system prompt that instructs the model to evaluate semantic intent, identify social-engineering tactics (urgency creation, authority impersonation, fear induction), and return a structured JSON response containing a numeric score and a naturallanguageexplanation.ThiscomponentoperationalisestheprincipleofExplainableAI(XAI):everyautomateddecision isaccompaniedbyahuman-readablerationalethatadministratorscanauditandchallenge.

TheEmailAuthenticationEngineperformsDNSlookupstoevaluateSPFrecords,verifiesDKIMcryptographicsignatures,and enforces DMARC policy. Failure of any check elevates the sub-score proportionally. This module reliably intercepts domainspoofing and sender-forgery attacks but is acknowledged to be ineffective against phishing originating from compromised legitimateaccounts.

The Keyword and Pattern Matching Engine applies a curated library of regular expressions to the email content, targeting urgency markers ('act immediately', 'verify within 24 hours'), impersonation phrases, and obfuscation techniques such as charactersubstitution.Whilestraightforward,thiscomponentprovidesfast,deterministicdetectionofknownattackpatterns andservesasanimportantcounterweightwhentheAIengineisdeceivedbyprofessionallywordedtext.

TheURLReputationEngineextractsallhyperlinksfromthemessage,appliesheuristicchecks(suspiciousTLDs, typosquatting patterns, excessive subdomains), and submits each URL to the VirusTotal API for evaluation against over 70 commercial

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 05 | May 2026 www.irjet.net p-ISSN: 2395-0072

antivirus and threat-intelligence engines. The aggregated results are converted into a sub-score reflecting the proportion of positivemaliciousdetections.

3.2 Composite Scoring and Decision Engine

Sub-scoresfromallfourenginesarecombinedusingaweightedsummationtoproduceafinalcompositethreatscoreona040 scale.Weightsareassignedtoreflectthereliabilityandcoverageofeachmodule,withtheAIandURLenginescarryinghigher weights due to their broader detection surface. The decision engine maps composite scores to three dispositions using configurablethresholds:(i)scoresbelow40 email deliverednormally; (ii)scoresbetween40and70 email quarantinedfor administratorreview;(iii)scoresabove70 emaildroppedandlogged.Thesethresholdsareadjustableviatheadministrative dashboardtoaccommodatevaryingorganisationalrisktolerances.

3.3 Technology Stack and Deployment

ThebackendisimplementedinPython3.10onaLinuxserver,utilisingtheFlaskwebframeworkforAPIrequesthandlingand inter-component communication. Email metadata, detection scores, and administrative actions are persisted in a SQLite database,chosen forits zero-configuration deployment profile and low resourcefootprint. Theoverall architecturesupports deployment on local servers, virtual machines, and cloud platforms with equal ease, providing organisations with full flexibility over their hosting arrangements. The administrative dashboard is a responsive web application offering real-time threatmonitoring,configurablethresholds,whitelistandblacklistmanagement,anddownloadableauditlogs.

4. RESULTS AND ANALYSIS

PhishShieldwasevaluatedonadatasetof20emailscomprisingsevenlegitimatemessagesandthirteenphishingsamples.The phishing samples were drawn from multiple attack categories, including standard credential harvesting, Business Email Compromise attempts, prize-baiting spam, and breach-based campaigns reconstructed from real 2025 security incidents involvingQantas,Microsoft,andGoogle.TheresultsaresummarisedinTable2.

Table 2: Evaluation Results Summary

All thirteen phishing emails were correctly identified and either quarantined or dropped. All seven legitimate emails were delivered without disruption, yielding a false-positive rate of zero. The highest composite score (24.0 / 40, after normalisation) was assigned to a Qantas breach-based phishing email, which leveraged authentic brand language and contextualalignmentwithawidelyreportedsecurityincident,illustratingthesophisticationofcontemporaryattacks.

4.1 Ensemble Resilience Against AI-Generated Phishing

A particularly instructive test case involved a Chase Bank impersonation email constructed with professional, grammatically flawlesslanguageandaplausibletransactionnarrative.Whenevaluatedinisolation,theDistilBERT-basedNLPsu-component a finetuned transformer model used to benchmark against PhishShield's AI engine assigned this email a low-threat score, incorrectly classifying it as legitimate. However, the URL analysis module identified the sender domain as a suspicious .tk toplevel domain,andthekeyword engineflaggedurgencyphrasing.Theircombinedcontributionraisedthecompositescore to 95, triggering an automatic drop decision. This outcome demonstrates the core architectural benefit of ensemble design: individualmodulesmaybedeceived,butmulti-engineagreementisconsiderablyhardertoevade.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 05 | May 2026 www.irjet.net p-ISSN: 2395-0072

4.2 Sandbox Testing Environment

PhishShieldincludesaThreatAnalysisSandbox amanualsubmissioninterfacethatenablessecurityanalyststotestarbitrary emailcontentagainstthedetectionpipelinewithoutriskofdelivery.Thesandboxreturnsafullanalysisreportincludingthe composite score, per-module sub-scores, the AI engine's natural-language explanation, and identified keywords and URLs. Thisfacilitysupportsanalysttraining,incidentresponseinvestigations,andregressiontestingafterconfigurationchanges.

5. SECURITY ANALYSIS

5.1

Attack Resistance Profile

Standard phishing emails characterised by suspicious sender domains, urgency language, and malicious links are reliably intercepted by multiple engines simultaneously, producing high composite scores. Breach-based phishing, which exploits realworld events to achieve contextual credibility, was correctly detected in all test instances, with the semantic AI engine providing the most discriminating signal. SPF/DKIM/DMARC validation provides robust resistance against domain-spoofing attacks,elevatingthreatscoresforanyemailwhoseauthenticatedidentitydivergesfromtheclaimedsender.

Thesystem'smostsignificantvulnerabilityliesinzero-dayphishingcampaignsthatemployentirelynovel languagepatterns and newly registered, unindexed malicious domains. For such attacks, the keyword engine and VirusTotal lookup provide limited coverage, and the AI engine must bear the primary detection burden. A second known limitation involves phishing content hosted on trusted platforms Google Drive, Dropbox, GitHub whose domains are whitelisted by most threatintelligence services. Contextual URL analysis beyond domain reputation is required to close this gap and is identified as a priorityforfuturedevelopment.

5.2 Privacy and Compliance Considerations

Operating as a full-content SMTP proxy, PhishShield necessarily processes the complete content of every email passing through the organisation. Two aspects require particular attention. First, submission of email content to external cloud APIs (Google Gemini and VirusTotal) constitutes a transfer of potentially sensitive data outside the organisation's network boundary. Organisations subject to regulations such as GDPR, HIPAA, or India's Digital Personal Data Protection Act must assesswhetherthistransferispermissibleand,ifrequired,executeappropriatedata-processingagreementswiththerelevant serviceproviders.Second,SQLitestorageofemailmetadatacreatesapersistentrecordthatdemandsaclearretentionpolicy andaccesscontrols,includingmulti-factorauthenticationfordashboardaccess.Futureversionsshouldincorporatedatabaseat-restencryptiontomitigatetheimpactofservercompromise.

6. ADVANTAGES AND LIMITATIONS

6.1

Key Advantages

PhishShield offers several notable strengths. Its ensemble architecture four independent engines contributing to a single compositedecision providesresilienceagainsttheevasiontechniquesthatdefeat single-methodapproaches.CloudbasedAI integrationviatheGeminiAPIdeliversadvancedsemanticunderstandingwithoutlocalmodeltrainingorGPUinfrastructure. The three-tier decision system (deliver, quarantine, drop) preserves legitimate mail while providing a safety buffer for ambiguous cases, substantially reducing the operational cost of false positives. Every decision is logged and explained, satisfyingtheExplainableAIrequirementsincreasinglymandatedbyenterprisegovernanceframeworks.Thesystemachieved 100%detection accuracyacross a carefullycurated test setthat included breach-basedattacksrepresentativeofthe current threatlandscape.

6.2

Current Limitations

Several limitations bound the present implementation. The evaluation dataset of 20 emails, while carefully selected and diverse, is insufficient to characterise performance at production scale. Processing latency of 10.8 seconds per email may introduce unacceptable delivery delays in high-volume environments and warrants optimisation through asynchronous

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 05 | May 2026 www.irjet.net p-ISSN: 2395-0072

pipelineprocessingandAPIcallbatching.Attachmentscanning acriticalattackvector isnotyetimplemented.Thekeyword database requires regular curation to remain effective against evolving vocabulary. Finally, dependence on external APIs introduces both privacy considerations and availability risk: service outages or quota exhaustion would degrade detection capability.

7. CONCLUSIONS

This paper presented PhishShield, a lightweight multilayer email phishing detection framework designed to address the security needs of SMEswithoutimposing theresourcedemands of enterprise-grade solutions.Byintegratingcloud-basedAI semanticanalysis,emailauthenticationprotocolvalidation,heuristickeywordmatching,andreal-timeURLreputationscoring withinanSMTPproxyarchitecture,PhishShieldachievescomprehensivecoverageacrossthemajorphishingattackcategories inusetoday.

Experimental evaluation demonstrated 100% phishing detection and zero false positives on a dataset spanning standard, AIgenerated,spear,andbreach-basedphishingemails.TheensembledesignprovedparticularlyvaluableagainstAIgenerated content: when individual modules were deceived, corroborating signals from complementary engines ensured correct final classification. The administrative dashboard and sandbox environment further reduce the operational burden on security teamsbyprovidingexplainable,auditabledecisionsandasafetestingenvironmentforanalystinvestigation.

Future work will focus on four directions: (i) evaluation on large-scale, publicly available phishing datasets to validate generalisation;(ii)asynchronouspipelineredesigntoreduceper-emaillatency;(iii)integrationofattachmentscanningusing sandboxed execution environments; and (iv) development of a privacy-preserving local AI inference option to eliminate dependencyonexternalcloudservicesfororganisationsoperatingunderstrictdata-residencyrequirements.

ACKNOWLEDGEMENT

The authors gratefully acknowledge the guidance of Dr. Manjusha Deshmukh, Head of Department, Computer Science and Engineering(IoTandCSBC),A.C.PatilCollegeofEngineering,whoseexpertise,feedback,andconsistentencouragementwere instrumentalthroughoutthisproject.TheauthorsalsothankthefacultyandstaffoftheDepartmentofComputerScienceand Engineering(IoTandCSBC)fortheirsupport,andthedevelopersandmaintainersoftheopen-sourcelibrariesandcloudAPIs thatmadethisworkpossible.

REFERENCES

[1] S. Abu-Nimeh, D. Nappa, X. Wang, and S. Nair, 'A Comparison of Machine Learning Techniques for Phishing Detection,' in Proc.Anti-PhishingWorkingGroupeCrimeResearchersSummit,Pittsburgh,PA,2007,pp.60–69.

[2] J. Ma, L. K. Saul, S. Savage, and G. M. Voelker, 'Beyond Blacklists: Learning to Detect Malicious Web Sites from Suspicious URLs,'inProc.ACMSIGKDDInt.Conf.KnowledgeDiscoveryandDataMining,Paris,France,2009,pp.1245–1254.

[3]R.VermaandN.Hossain,'SemanticFeatureSelectionforTextwithApplicationtoPhishingEmailDetection,'inProc.IEEE Int.Conf.DataMining(ICDM),NewOrleans,LA,2017.

[4] O. K. Sahingoz, E. Buber, O. Demir, and B. Diri, 'Machine Learning Based Phishing Detection from URLs,' Expert Systems withApplications,vol.117,pp.345–357,Mar.2019.

[5] I. Fette, N. Sadeh, and A. Tomasic, 'Learning to Detect Phishing Emails,' in Proc. 16th Int. World Wide Web Conference, Banff,Canada,2007,pp.649–656.

[6] P. Kumaraguru, Y. Rhee, A. Acquisti, et al., 'Getting Users to Pay Attention to Anti-Phishing Education,' in Proc. ACM CHI, Boston,MA,2009.

[7]P.ResnickandP.Hoffman,'SenderPolicyFramework(SPF)forAuthorizingUseofDomainsinEmail,'IETFRFC4408,Apr. 2006.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 05 | May 2026 www.irjet.net p-ISSN: 2395-0072

[8] M. Kucherawy and E. Zwicky, 'Domain-based Message Authentication, Reporting, and Conformance (DMARC),' IETF RFC 7489,Mar.2015.

[9] VirusTotal (Google LLC), 'VirusTotal API v3 Documentation for URL and File Analysis,' [Online]. Available: https://developers.virustotal.com/,2024.

Biographies

Ketan Sawant is a final-year student in the B.E. Computer Science and Engineering (IoT and CS BC) programme at A. C. Patil College of Engineering, Navi Mumbai. His research interests include cybersecurity, network security, and full-stack web development.HeservedastheleadarchitectofthePhishShieldbackendandSMTPproxyimplementation.

SujalRautisafinal-yearB.E.studentinthesameprogramme.Hisareasofinterestspanmachinelearning,data analysis,and softwareengineering.HeledtheintegrationoftheAIcontent-analysisandURLreputationmoduleswithinPhishShield.

ManoharKumawatisafinal-yearB.E.studentwithafocusoncloudcomputing,APIintegration,andsystemsprogramming.He wasresponsiblefortheemailauthenticationengineanddatabasemanagementcomponentsofthePhishShieldsystem.

SahilValanjuisafinal-yearB.E.studentwhoseinterestsencompasswebdevelopment,datavisualisation,anduserexperience design.HedesignedandimplementedthePhishShieldadministrativedashboardandsandboxtestingenvironment.