GENERATIVE LANGUAGE MODELS VERSUS ENCODER-BASED LANGUAGE MODELS FOR MULTILINGUAL PHISHING EMAIL DETECTION

Date

2026-9-2

Author

Bor, Nesil

Metadata

Show full item record

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.

Item Usage Stats

50
views

0
downloads

Cite This

This thesis evaluates 25 language models to compare generative and classification architectures for phishing email detection in resource-constrained local environments. A major challenge in modern cybersecurity is the lack of localized, psychologically accurate threat data for languages other than English. To address this gap, we used the collaboratively developed OLTA-TR dataset. Built on Cialdini’s principles of persuasion, this synthetic Turkish corpus trains models to recognize manipulative intent rather than just filtering static keywords. Because endpoint security often requires running models locally, we managed hardware limitations using QLoRA fine-tuning and 4-bit quantization techniques. Experimental results combining the MeAJOR archive and OLTA-TR show that generative models consistently suffer from a helpful AI bias. While this bias caused formatting errors, the underlying autoregressive decoding process introduced critical latency issues when integrating these models into automated workflows. In contrast, smaller classification models adhered to formatting constraints consistently and completed their analysis in under a second. Most notably, the mmBERT model achieved a 99.49% Macro F1-Score, showing that effective phishing email detection relies mostly on recognizing psychological intent rather than language-specific grammar. To explain how these models make decisions, we introduced a dual-layer interpretability framework. Ultimately, while generative models are flexible, fine-tuned classification models offer a more reliable and secure method for real-time defense.

Subject Keywords

phishing email detection, generative language models, encoder models, low resource languages, cybersecurity

URI

https://hdl.handle.net/11511/120718

Collections

Graduate School of Informatics, Thesis