EvoMail: Self-Evolving Cognitive Agents for Adaptive Spam and Phishing Email Defense

2025-09-25

AI Summary

Rapid evolution of multimodal phishing emails challenges traditional static detection methods, which suffer from poor adaptability and limited interpretability. Method: We propose a cognition-driven dynamic defense framework that (1) constructs a unified heterogeneous email graph integrating text, metadata, and embedded resources; (2) designs a collaborative reasoning mechanism between a Cognition Graph Neural Network (CGNN) and large language models (LLMs) for deep multimodal signal fusion; and (3) introduces an adversarial self-evolution mechanism—where red teams generate evasion samples and blue teams iteratively update and compress a memory knowledge base using failure experiences—to enable continual learning and strategy refinement. Results: Evaluated on both real-world and synthetic datasets, our approach significantly outperforms state-of-the-art baselines in accuracy, generalization, and interpretability, empirically validating the efficacy of dynamic evolutionary defense paradigms.

Technology Category

• Machine Learning: Multimodal Learning
• Natural Language Processing: Language Grounding & Multi-modal NLP
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Web Mining and Content Analysis: Models for Web evolution
• Search and Retrieval-Augmented AI: Retrieval-Augmented Generation (RAG) and multi-modal RAG

Abstract

Modern email spam and phishing attacks have evolved far beyond keyword blacklists or simple heuristics. Adversaries now craft multi-modal campaigns that combine natural-language text with obfuscated URLs, forged headers, and malicious attachments, adapting their strategies within days to bypass filters. Traditional spam detection systems, which rely on static rules or single-modality models, struggle to integrate heterogeneous signals or to continuously adapt, leading to rapid performance degradation. We propose EvoMail, a self-evolving cognitive agent framework for robust detection of spam and phishing. EvoMail first constructs a unified heterogeneous email graph that fuses textual content, metadata (headers, senders, domains), and embedded resources (URLs, attachments). A Cognitive Graph Neural Network enhanced by a Large Language Model (LLM) performs context-aware reasoning across these sources to identify coordinated spam campaigns. Most critically, EvoMail engages in an adversarial self-evolution loop: a ''red-team'' agent generates novel evasion tactics -- such as character obfuscation or AI-generated phishing text -- while the ''blue-team'' detector learns from failures, compresses experiences into a memory module, and reuses them for future reasoning. Extensive experiments on real-world datasets (Enron-Spam, Ling-Spam, SpamAssassin, and TREC) and synthetic adversarial variants demonstrate that EvoMail consistently outperforms state-of-the-art baselines in detection accuracy, adaptability to evolving spam tactics, and interpretability of reasoning traces. These results highlight EvoMail's potential as a resilient and explainable defense framework against next-generation spam and phishing threats.

Problem

• Detecting multi-modal spam campaigns combining text, URLs, and attachments
• Overcoming limitations of static rules that cannot adapt to evolving threats
• Integrating heterogeneous email signals for coordinated attack identification

Innovation

• Unified heterogeneous graph fuses email content and metadata
• Cognitive Graph Neural Network with LLM enables context-aware reasoning
• Adversarial self-evolution loop continuously improves detection capabilities