AI-Enhanced Email Security: A Novel Pipeline for Phishing Campaign Detection and Profiling

In recent years, phishing attacks have grown exponentially in scale, frequency, and sophistication, placing a significant burden on organizations and security personnel. Attackers leverage advanced obfuscation techniques to evade detection systems and ensure their emails reach users’ inboxes. Additionally, attackers distribute thousands of emails as part of large-scale coordinated campaigns to increase the probability of a successful attack. The growing use of social engineering and AI-generated phishing content has further heightened the complexity of these threats, making detection more challenging. As attackers continuously refine their tactics, mitigating these threats requires substantial time, expertise, and resources from IT/SOC teams, who must analyze, categorize, and respond to a high volume of evolving phishing attacks. In this study, we explore the integration of artificial intelligence (AI) into phishing mitigation, not as a replacement for human expertise but as a complement to it. We propose a novel hybrid pipeline designed to enhance the efficiency of IT personnel in responding to phishing threats. Our approach consists of three key components: (1) Feature Extraction, where fine-tuned language models analyze phishing emails to extract contextual features; (2) Campaign Detection, leveraging community detection algorithms to identify and cluster similar phishing emails; and (3) Campaign Profiling, generating comprehensive attack summaries to streamline response efforts. By clustering related emails and providing a comprehensive attack summary, our framework enables security teams to identify and neutralize threats faster, block incoming emails, and respond to users.