PhishingAgent: an agentic workflow method for advanced phishing email detection - JIN Jiandong; HUANG Zheng; HU Zhanyu; ZOU Yuanxin; QIN Huidong; LAI Qingnan; YANG Jia; ZHOU Changling (Tongxin xuebao)
To address the increasing complexity of advanced persistent threat (APT) and phishing email attacks, an intelligent agentic workflow method for phishing email detection called PhishingAgent was proposed. PhishingAgent integrated multi-source knowledge bases and security tools to fully leverage the reasoning capabilities of large language model (LLM), enhancing the precision and depth of identifying complex phishing email attacks. The agentic workflow was built on a dual-system reasoning framework, a rapid detection system facilitates efficient preliminary threat identification, followed by a deep reasoning system that conducted detailed semantic analysis and contextual inference, significantly improving the interpretability of results. Experimental results demonstrate that the PhishingAgent increases detection efficiency without sacrificing accuracy and outperforms existing mainstream email security mechanisms in detecting APT-related phishing emails.