Machine Learning-Based Intrusion Detection for Malicious Email Attachments

DOI

10.2991/978-94-6239-799-6_10How to use a DOI?

Keywords

Malicious Email Attachments; Malware Detection; Machine Learning; Intrusion Detection; Email Security

Abstract

Email attachments are a common way for cybercriminals to distribute malware. These attachments can include ransomware, spyware, viruses or other malicious software. Traditional antivirus systems are primarily signature-based, and do not recognize new or unknown malware. It has become increasingly difficult to protect against the variety of attacks that are currently being used, especially if they are new variants of malware. This research aims to see if it’s possible to automatically detect malicious email attachments using machine learning (ML) algorithms before they are executed. The machine learning (ML) models were trained and tested with a dataset of 100,000 file samples, with half of it is malicious and the other half of it is benign. A well-balanced class distribution minimized bias in model training and gave a fair ground for performance calculation. To ensure data quality, certain non-informative attributes like hash identifiers and timestamp-related attributes were filtered before developing the model. Three supervised learning algorithms – Random Forest (RF), Logistic Regression (LR) and Linear Support Vector (SVC) Classification – were trained and evaluated. Experimental analysis showed that the RF model has the best performance with an average classification precision of 91.28%, while the LR model and the Linear SVC model achieved an average classification accuracy of 74.82% and 76.28%, respectively. The results show that ML can be a valuable tool to recognize potentially dangerous attachments prior to execution. Future studies could involve using real-world email datasets and explainable artificial intelligence (XAI) methods to improve the practical application and interpretability of models.

Copyright

© 2026 The Author(s)

Open Access

Open Access This chapter is licensed under the terms of the Creative Commons Attribution-NonCommercial 4.0 International License (http://creativecommons.org/licenses/by-nc/4.0/), which permits any noncommercial use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

Download article (PDF)

TY  - CONF
AU  - Kanak Lata
AU  - Ritesh Jha
AU  - Vijay Kumar Jha
PY  - 2026
DA  - 2026/09/30
TI  - Machine Learning-Based Intrusion Detection for Malicious Email Attachments
BT  - Proceedings of the International Conference on Emerging Trends and Technologies in Applications of Computer Science (ICETTACS 2026)
PB  - Atlantis Press
SP  - 135
EP  - 145
SN  - 1951-6851
UR  - https://doi.org/10.2991/978-94-6239-799-6_10
DO  - 10.2991/978-94-6239-799-6_10
ID  - Lata2026
ER  -