## 4 Results and Discussion
### Results  
This study presents significant findings in detecting phishing emails using ML and DL models. Table 3 summarizes the accuracy achieved by all models across the ten datasets. Detailed results, including precision, recall, and F1-Score for each model on each dataset, are available in Appendix A. Below, we provide detailed answers and discussions for all our research questions. Our experimental results indicate that BERT emerged as the top-performing model, as highlighted in Tables 3 and 4. It achieved the highest accuracy, precision, recall, and F1-Score (see Table 4). This superior performance can be attributed to BERT's bidirectional transformer architecture, which enables a deep understanding of text structure and semantics. Its ability to capture subtle details in text makes it particularly effective in detecting the nuanced tactics used in phishing emails. Furthermore, BERT consistently demonstrated a balance between high precision and high recall, with minimal variance between the two metrics. This balance ensures the model accurately identifies phishing emails and reduces false positives. This addresses our RQ1, identifying the most effective ML and DL models for phishing email detection. Similarly, RoBERTa, another transformer-based model, delivered outstanding results, particularly on the merged dataset, as shown in Table 3. The merged dataset comprises a substantial volume of data with diverse text structures, derived from multiple sources. The strong performance of BERT and RoBERTa on this dataset underscores the effectiveness of transformer-based approaches for text classification tasks involving complex and heterogeneous data. Their ability to adapt to varied language patterns makes them well-suited for detecting phishing emails across different sources. The accuracies of the balanced dataset are close to those of the unbalanced dataset, likely because the class percentages before balancing (45.81% and 54.19%) were relatively close, resulting in minimal impact from thebalancing technique. This answers our RQ4, why DL models demonstrate superior results in phishing detection. In contrast, Table 3 indicates that the GCN model did not perform well. GCNs are optimized for graph-structured data, while email text is inherently linear. Without transforming the text into a graph representation, GCNs struggle to extract meaningful patterns, which limits their effectiveness in this context. As part of addressing RQ1 concerning the best-performing ML algorithm, we found out that SGD Classifier emerged as the best-performing traditional machine learning model across the analysis of the ten datasets, having the highest average accuracy of 98.17%. Its consistently high performance, adaptability across various datasets, and balanced precision and recall make it a reliable choice for phishing detection tasks. While other classifiers, such as the Extra Trees, performed well on datasets like Enron, CEAS_08, and the Merged dataset, and Random Forest excelled on the TREC_05 dataset, the overall consistency of the SGD Classifier makes it the preferred option. Regarding RQ2, which investigates the performance of ML and DL models when applied to multiple individual datasets and a merged dataset, we studied the effectiveness