## 3 Research Methodology
### Models Selection
#### 3.3.1 Selected Machine Learning Models  
Naive Bayes is a type of probabilistic classifier developed from [PERSON] theorem and assumes feature independence, often referred to as the \"naive\" assumption [44]. It also assumes that all features in the dataset contribute equally to the outcome. These assumptions simplify its computation by requiring only a single probability per variable. While these assumptions are often unrealistic, the algorithm remains effective, especially with small datasets and for problems such as phishing email detection [12; 13; 14; 15]. The model classifies emails as either phishing or legitimate given the extracted features by computing the posterior probability of each class. Logistic Regression is a commonly employed statistical technique for binary classification tasks [45] such as phishing email detection [15; 46]. It estimates the probability of an email being phishing or legitimate by fitting data to a logistic function. This function models the relationship between a dependent binary variable and one or more independent variables. For phishing detection, the model analyzes various email features to determine the likelihood that an email is malicious. An example of an email feature is email textual content (i.e., presence of suspicious words, grammatical errors, urgent language, request for sensitive information, etc.). Each feature has a weight assigned by the logistic regression model, which collectively contributes to the final probability score. If this probability score exceeds a certain threshold, the email is classified as phishing; otherwise, it is considered safe. Stochastic Gradient Descent Classifier (SGD) operates by randomly selecting a subset of samples from the dataset for each iteration, rather than using the entire dataset [47]. This method results in different outputs for each iteration because the output reflects a partial derivative based on the subset of parameters used from the input. Specifically, email text is converted into numerical features. The classifier is trained using labeled email data: phishing and safe email. During each iteration, SGD updates model parameters based on a randomly selected subset of samples. It adjusts the weights to minimize classification error and uses a loss function to guide the updating of the weights. After the training, the model predicts if an incoming email is phishing or safe based on the learned feature weights. EXtreme Gradient Boosting Classifier (XGBoost) represents an advanced version of gradient boosting algorithms [48]. It is designed for scalable and efficient tree boosting. It uses an ensemble learning method by combining multiple decision trees to enhance predictive accuracy. Each tree in the sequence is built to specifically address and correct the errors of its predecessors through gradient boosting. XGBoost is effective for structured data classification tasks, including phishing email detection [33; 46; 49]. In our work, we utilized the base model, where email content is converted into numerical features, and the model was trained. After training, XGBoost assigns a probability score for classifying an email as phishing or safe. Decision Tree is a ML classifier used for classification and regression tasks [48]. It includes a recursive partitioning that assesses attributes or features based on specific purity metrics. The model creates multiple decision nodes, each representing a feature that effectively recognizes the classes based on the training data. At each node, the tree branches into outcomes or subsequent decisions. This branching continues until the model can classify an email as phishing or legitimate by following the path of decisions made from the root to a leaf of the tree [50]. This model is used in many phishing detection works such as [15]. Random Forest is a supervised ML algorithm used for classification and regression tasks [51]. It constructs multiple decision trees from the training dataset.