Machine learning models for detecting targeted attacks through email attachments

Abstract

Machine learning models for detecting targeted attacks through email attachments

Belyakov K.A., Gindin E.M., Shevchenko A.V.

Incoming article date: 27.11.2025

The article discusses the task of detecting malicious attachments in emails used in targeted cyber attacks. An approach based on the combined use of text and file attributes of messages using machine learning methods is proposed. The models of logistic regression and the random forest method are compared according to the main classification quality metrics. Experiments on a synthetic dataset have shown that logistic regression provides a higher completeness of detection of malicious attachments, whereas a random forest is characterized by a higher classification accuracy. The results obtained confirm the effectiveness of the hybrid approach and the possibility of its integration into email protection systems.

Keywords: machine learning, targeted attack, email, phishing, malicious attachment, attack detection, information security