These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Modern email spam and phishing attacks have evolved far beyond keyword
blacklists or simple heuristics. Adversaries now craft multi-modal campaigns
that combine natural-language text with obfuscated URLs, forged headers, and
malicious attachments, adapting their strategies within days to bypass filters.
Traditional spam detection systems, which rely on static rules or
single-modality models, struggle to integrate heterogeneous signals or to
continuously adapt, leading to rapid performance degradation.
We propose EvoMail, a self-evolving cognitive agent framework for robust
detection of spam and phishing. EvoMail first constructs a unified
heterogeneous email graph that fuses textual content, metadata (headers,
senders, domains), and embedded resources (URLs, attachments). A Cognitive
Graph Neural Network enhanced by a Large Language Model (LLM) performs
context-aware reasoning across these sources to identify coordinated spam
campaigns. Most critically, EvoMail engages in an adversarial self-evolution
loop: a ''red-team'' agent generates novel evasion tactics -- such as character
obfuscation or AI-generated phishing text -- while the ''blue-team'' detector
learns from failures, compresses experiences into a memory module, and reuses
them for future reasoning.
Extensive experiments on real-world datasets (Enron-Spam, Ling-Spam,
SpamAssassin, and TREC) and synthetic adversarial variants demonstrate that
EvoMail consistently outperforms state-of-the-art baselines in detection
accuracy, adaptability to evolving spam tactics, and interpretability of
reasoning traces. These results highlight EvoMail's potential as a resilient
and explainable defense framework against next-generation spam and phishing
threats.