Evaluating GAN‐Based Architectures for Phishing Email Generation

Abstract

This thesis researches how Generative Adversarial Networks (GANs) can be used to generate phishing emails and evaluates how realistic and detectable those emails are in a cybersecurity context. Two models were developed and compared: an LSTM-based GAN and a Transformer-based GAN. The results showed a clear difference in performance, with the Transformer model producing more coherent, structured, and convincing phishing emails that often included urgency and account-related warnings while still passing content-based spam filters. In contrast, the LSTM model struggled with repetition and mode collapse, resulting in unrealistic emails that were far less effective at bypassing detection. Both qualitative and quantitative evaluations confirmed that Transformer-generated emails were more readable, consistent, and more likely to reach a recipient’s inbox. Overall, the findings suggest that Transformer-based architectures are significantly more effective than traditional LSTM models for phishing email generation.