# RAIDER: Reinforcement-aided Spear Phishing Detector

arXiv: https://arxiv.org/abs/2105.07582 · HTML: https://mlsanity.com/paper/2105.07582/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 44 references that are in the map.
- First posted on arXiv 17 May 2021.

## Builds on (most cited first, 11 of 11)

- [Target-driven Visual Navigation in Indoor Scenes using Deep Reinforcement Learning](https://mlsanity.com/paper/1609.05143/) (2016)
- [Revisiting the Arcade Learning Environment: Evaluation Protocols and Open Problems for General Agents](https://mlsanity.com/paper/1709.06009/) (2017)
- [An Empirical Analysis of Feature Engineering for Predictive Modeling](https://mlsanity.com/paper/1701.07852/) (2017)
- [Detecting and Characterizing Lateral Phishing at Scale](https://mlsanity.com/paper/1910.00790/) (2019)
- [Reinforcement learning for non-prehensile manipulation: Transfer from simulation to physical system](https://mlsanity.com/paper/1803.10371/) (2018)
- [SOK: A Comprehensive Reexamination of Phishing Research from the Security Perspective](https://mlsanity.com/paper/1911.00953/) (2019)
- [Cognitive Triaging of Phishing Attacks](https://mlsanity.com/paper/1905.02162/) (2019)
- [DeepCapture: Image Spam Detection Using Deep Learning and Data Augmentation](https://mlsanity.com/paper/2006.08885/) (2020)
- [Analyzing Social and Stylometric Features to Identify Spear phishing Emails](https://mlsanity.com/paper/1406.3692/) (2014)
- [Weak Links in Authentication Chains: A Large-scale Analysis of Email Sender Spoofing Attacks](https://mlsanity.com/paper/2011.08420/) (2020)
- [Phishing and Spear Phishing: examples in Cyber Espionage and techniques to protect against them](https://mlsanity.com/paper/2006.00577/) (2020)

## Built on by (most cited first, 6 of 6)

- [Reinforcement Learning for Feedback-Enabled Cyber Resilience](https://mlsanity.com/paper/2107.00783/) (2021)
- [Prompted Contextual Vectors for Spear-Phishing Detection](https://mlsanity.com/paper/2402.08309/) (2024)
- [Profiler: Profile-Based Model to Detect Phishing Emails](https://mlsanity.com/paper/2208.08745/) (2022)
- [PhishClone: Measuring the Efficacy of Cloning Evasion Attacks](https://mlsanity.com/paper/2209.01582/) (2022)
- [PiMRef: Deducing Ever-evolving Spear-phishing Emails with Knowledge Base Invariants](https://mlsanity.com/paper/2507.15393/) (2025)
- [TEGDetector: A Phishing Detector that Knows Evolving Transaction Behaviors](https://mlsanity.com/paper/2111.15446/) (2021)

## Abstract (arXiv)

Spear Phishing is a harmful cyber-attack facing business and individuals worldwide. Considerable research has been conducted recently into the use of Machine Learning (ML) techniques to detect spear-phishing emails. ML-based solutions may suffer from zero-day attacks; unseen attacks unaccounted for in the training data. As new attacks emerge, classifiers trained on older data are unable to detect these new varieties of attacks resulting in increasingly inaccurate predictions. Spear Phishing detection also faces scalability challenges due to the growth of the required features which is proportional to the number of the senders within a receiver mailbox. This differs from traditional phishing attacks which typically perform only a binary classification between phishing and benign emails. Therefore, we devise a possible solution to these problems, named RAIDER: Reinforcement AIded Spear Phishing DEtectoR. A reinforcement-learning based feature evaluation system that can automatically find the optimum features for detecting different types of attacks. By leveraging a reward and penalty system, RAIDER allows for autonomous features selection. RAIDER also keeps the number of features to a minimum by selecting only the significant features to represent phishing emails and detect spear-phishing attacks. After extensive evaluation of RAIDER over 11,000 emails and across 3 attack scenarios, our results suggest that using reinforcement learning to automatically identify the significant features could reduce the dimensions of the required features by 55% in comparison to existing ML-based systems. It also improves the accuracy of detecting spoofing attacks by 4% from 90% to 94%. In addition, RAIDER demonstrates reasonable detection accuracy even against a sophisticated attack named Known Sender in which spear-phishing emails greatly resemble those of the impersonated sender.