Comparative Analysis of Machine Learning Algorithms for the Detection and Classification of Suspicious Emails - Shamsuddeen J. AHMAD; Saifullahi S. SADI; Muhammad M. AHMAD; Abdullahi D. UMAR; Shamsuddeen USMAN (FUDMA Journal of Engineering and Technology, 2025)
The exponential growth of corporate email communications poses significant challenges for digital forensic investigations because manual analysis is slow, resource-intensive, and error-prone. This study compares three machine learning algorithms: Random Forest, Support Vector Machine (SVM), and Artificial Neural Network (ANN) for the detection and classification of suspicious emails. A publicly available dataset from the GitHub repository that comprises 60,000 instances was extracted. The methodology involved preprocessing the dataset by encoding categorical features and converting email body content into numerical representations using TF-IDF vectorisation, and SMOTE was used to balance the dataset. The dataset was then split into 80% (48,000 instances) for training and 20% (12,000 instances) for testing, and each classifier was trained and evaluated using performance metrics including accuracy, precision, recall, F1-score, and AUC. The result indicates that ANN achieved the highest performance (accuracy: 99.86%, AUC: 1.00), with balanced precision and recall across “Evidence” and “Non-Evidence” classes. Random Forest also performed strongly (accuracy: 99.92%, AUC: 1.00) with high interpretability, while SVM (accuracy: 98.92%, AUC: 1.00) showed strong precision but lower recall for “Non-Evidence” emails. ANN’s superior performance is attributed to its ability to model complex patterns and handle class imbalance effectively. The findings indicate that ANN demonstrates the highest performance in classifying suspicious emails, showing superior accuracy, efficiency, and scalability.