Nebulon Enterprise Simulated Threats for Phishing Research (NEST-Phish): A Synthetic Enterprise Phishing Email Dataset for Behavioral and Machine-Learning Research

• URL: http://arxiv.org/abs/2609.04474v1
• Date: Thu, 03 Sep 2026 20:58:21 GMT
• Title: Nebulon Enterprise Simulated Threats for Phishing Research (NEST-Phish): A Synthetic Enterprise Phishing Email Dataset for Behavioral and Machine-Learning Research
• Abstract summary: We introduce a synthetic enterprise phishing email dataset built around a fictitious organization, Nebulon.<n>The dataset spans a broad set of workplace communication themes and includes matched synthetic legitimate and phishing emails with interpretable phishing-cue annotations.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Phishing remains one of the most persistent cyber threats, yet publicly shareable datasets for studying phishing in realistic enterprise email settings remain limited. To address this gap, we introduce a synthetic enterprise phishing email dataset built around a fictitious organization, Nebulon. The dataset spans a broad set of workplace communication themes and includes matched synthetic legitimate and phishing emails with interpretable phishing-cue annotations. Here, ``legitimate'' denotes the non-phishing class, not legitimately occurring organizational emails. Human-subject categorizations and classifier evaluations show that the dataset supports meaningful variation in phishing judgments while also providing learnable signal for supervised detection. This publicly released resource is intended to support future work on phishing detection, human susceptibility, explainability, and benchmark development in enterprise-like contexts.

Related papers

• PhiShark2026: A Multi-Layer Active-Web Raw-Evidence Dataset for Phishing Website Research [39.146761527401424]
  Phishing websites are short-lived and rapidly changing, yet many phishing datasets reduce observations to URLs or precomputed features.<n>This study addresses this limitation with a multi-layer active-web dataset comprising 67,502 scans, including 33,387 phishing observations from operational feeds and 34,115 screened benign reference observations.<n>The corpus preserves raw evidence across HTML content and screenshots, URL and redirect behavior, HTTP and security headers, compliance files, TLS certificates, DNS and domain registration, open ports, geolocation and accessibility measurements, and network infrastructure.
  arXiv  Detail & Related papers  (2026-08-24T12:50:12Z)
• Characterizing Phishing Pages by JavaScript Capabilities [77.64740286751834]
  This paper aims to aid researchers and analysts by automatically differentiating groups of phishing pages based on the underlying kit.<n>For kit detection, our system has an accuracy of 97% on a ground-truth dataset of 548 kit families deployed across 4,562 phishing URLs.<n>We find that UI interactivity and basic fingerprinting are universal techniques, present in 90% and 80% of the clusters.
  arXiv  Detail & Related papers  (2025-09-16T15:39:23Z)
• LLM-Powered Intent-Based Categorization of Phishing Emails [0.0]
  This paper investigates the practical potential of Large Language Models (LLMs) to detect phishing emails by focusing on their intent.<n>We introduce an intent-type taxonomy, which is operationalized by the LLMs to classify emails into distinct categories and, therefore, generate actionable threat information.<n>Our results demonstrate that existing LLMs are capable of detecting and categorizing phishing emails, underscoring their potential in this domain.
  arXiv  Detail & Related papers  (2025-06-17T09:21:55Z)
• EPhishCADE: A Privacy-Aware Multi-Dimensional Framework for Email Phishing Campaign Detection [11.200645222578363]
  Phishing attacks, typically carried out by email, remain a significant cybersecurity threat.<n>We propose bf EPhishCADE, the first privacy-aware framework for bf Email bf Phishing bf CAmpaign bf DEtection.
  arXiv  Detail & Related papers  (2025-02-28T00:58:42Z)
• Characterizing the Networks Sending Enterprise Phishing Emails [3.6005071324152227]
  Phishing attacks on enterprise employees present one of the most costly and potent threats to organizations.<n>We draw on a dataset spanning one year across thousands of enterprises, billions of emails, and over 800,000 delivered phishing attacks.<n>We find that over one-third of the phishing email in our dataset originates from highly reputable networks, including Amazon and Microsoft.
  arXiv  Detail & Related papers  (2024-12-16T23:15:40Z)
• Phishing Codebook: A Structured Framework for the Characterization of Phishing Emails [17.173114048398954]
  Phishing is one of the most prevalent and expensive types of cybercrime faced by organizations and individuals worldwide. Most prior research has focused on various technical features and traditional representations of text to characterize phishing emails. In this paper, we dissect the structure of phishing emails to gain a better understanding of the factors that influence human decision-making.
  arXiv  Detail & Related papers  (2024-08-16T18:30:53Z)
• Novel Interpretable and Robust Web-based AI Platform for Phishing Email Detection [0.0]
  Phishing emails pose a significant threat, causing financial losses and security breaches. This study proposes a high-performance machine learning model for email classification. The model achieves a f1 score of 0.99 and is designed for deployment within relevant applications.
  arXiv  Detail & Related papers  (2024-05-19T17:18:27Z)
• An Innovative Information Theory-based Approach to Tackle and Enhance The Transparency in Phishing Detection [23.962076093344166]
  We propose an innovative deep learning-based approach for phishing attack localization. Our method can not only predict the vulnerability of the email data but also automatically learn and figure out the most important and phishing-relevant information.
  arXiv  Detail & Related papers  (2024-02-27T00:03:07Z)
• Prompted Contextual Vectors for Spear-Phishing Detection [41.26408609344205]
  Spear-phishing attacks present a significant security challenge.<n>We propose a detection approach based on a novel document vectorization method.<n>Our method achieves a 91% F1 score in identifying LLM-generated spear-phishing emails.
  arXiv  Detail & Related papers  (2024-02-13T09:12:55Z)
• Blockchain-aided Secure Semantic Communication for AI-Generated Content in Metaverse [59.04428659123127]
  We propose a blockchain-aided semantic communication framework for AIGC services in virtual transportation networks. We illustrate a training-based semantic attack scheme to generate adversarial semantic data by various loss functions. We also design a semantic defense scheme that uses the blockchain and zero-knowledge proofs to tell the difference between the semantic similarities of adversarial and authentic semantic data.
  arXiv  Detail & Related papers  (2023-01-25T02:32:02Z)
• FacTeR-Check: Semi-automated fact-checking through Semantic Similarity and Natural Language Inference [61.068947982746224]
  FacTeR-Check enables retrieving fact-checked information, unchecked claims verification and tracking dangerous information over social media. The architecture is validated using a new dataset called NLI19-SP that is publicly released with COVID-19 related hoaxes and tweets from Spanish social media. Our results show state-of-the-art performance on the individual benchmarks, as well as producing useful analysis of the evolution over time of 61 different hoaxes.
  arXiv  Detail & Related papers  (2021-10-27T15:44:54Z)
• Deep convolutional forest: a dynamic deep ensemble approach for spam detection in text [219.15486286590016]
  This paper introduces a dynamic deep ensemble model for spam detection that adjusts its complexity and extracts features automatically. As a result, the model achieved high precision, recall, f1-score and accuracy of 98.38%.
  arXiv  Detail & Related papers  (2021-10-10T17:19:37Z)
• Robust and Verifiable Information Embedding Attacks to Deep Neural Networks via Error-Correcting Codes [81.85509264573948]
  In the era of deep learning, a user often leverages a third-party machine learning tool to train a deep neural network (DNN) classifier. In an information embedding attack, an attacker is the provider of a malicious third-party machine learning tool. In this work, we aim to design information embedding attacks that are verifiable and robust against popular post-processing methods.
  arXiv  Detail & Related papers  (2020-10-26T17:42:42Z)
• Phishing and Spear Phishing: examples in Cyber Espionage and techniques to protect against them [91.3755431537592]
  Phishing attacks have become the most used technique in the online scams, initiating more than 91% of cyberattacks, from 2012 onwards. This study reviews how Phishing and Spear Phishing attacks are carried out by the phishers, through 5 steps which magnify the outcome.
  arXiv  Detail & Related papers  (2020-05-31T18:10:09Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.