# AI-Driven Phishing Detection: Enhancing Cybersecurity with Reinforcement Learning
## 5 Model Ongoing Training
### Detection Latency and Performance Trade-Off  
In addition to detection accuracy, we evaluated the detection latency (inference time) of the RL-based phishing detection model compared to other ML methods. After the training phase, the RL-based DQN model demonstrated a low average inference time of approximately 2.3 ms per email sample. This was comparable to traditional ML models such as SVM (2.1 ms) and significantly faster than deep learning models like CNN (7.5 ms) and BERT (21 ms). Although RL models require extensive interactions during training, their real-time inference speed is highly efficient once deployed. Thus, the trade-off between training complexity and inference efficiency makes the proposed RL-based method suitable for real-world phishing detection scenarios requiring both accuracy and timeliness. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Model**} & **Training** & **Peak Memory** & **Model Size** & **Convergence** \\  & **Time** & **Usage** & **(Parameters)** & **Speed** \\ \hline RL-Based DQN & 35 min & 420 MB & \(\sim\)1.2 million & 7500 episodes \\ CNN & 2.3 h & 1.6 GB & \(\sim\)8 million & 25 epochs \\ BERT-Based & 5.5 h & 3.8 GB & \(\sim\)110 million & 5 epochs \\ \hline \hline \end{tabular}  
* The RL-based DQN model required approximately 35 min of total training time across 10,000 episodes, with a peak memory consumption of 420 MB.
* The CNN-based phishing detection model required approximately 2.3 h of training and 1.6 GB of memory.
* The BERT-based phishing detection model required 5.5 h of training and 3.8 GB of memory during fine-tuning.
* The RL agent achieved convergence after approximately 7500 episodes, while CNN and BERT models required multiple epochs (25+ epochs for CNN; 5+ epochs for BERT) over the entire dataset.
* These findings demonstrate that the RL-based model achieved strong phishing detection accuracy with substantially reduced computational resource requirements compared to deep learning counterparts.  
\end{table} 
Table 6: Computational benchmarking results \begin{table}
\begin{tabular}{c c c} \hline \hline
**Model** & **Accuracy (\%)** & **False Positive Rate (\%)** \\ \hline RL-Based DQN & 95 & 2 \\ SVM & 85 & 12 \\ Random Forest & 87 & 10 \\ K-Nearest Neighbors (KNN) & 80 & 14 \\ Naïve Bayes & 78 & 16 \\ Logistic Regression & 83 & 11 \\ CNN & 96 & 5 \\ BERT-Based Detection & 97 & 3 \\ Double [27] & 95 & 3 \\ \hline \hline \end{tabular}  
\end{table} 
Table 5: Comparative performance metrics (testing phase). Deep learning models such as CNN (96% accuracy, 97% precision, 96% recall, and 5% false positives) and BERT-based phishing detection (97% accuracy, 98% precision, 97% recall, and 3% false positives) outperformed traditional ML approaches but required greater computational resources. The proposed RL-based model achieved a 95% accuracy, 96% precision, 94% recall, and a notably low 2% false positive rate, offering a strong balance between adaptability, precision, and real-time efficiency. In Figure 4 below, the ROC curves illustrate the trade-offs between true positive rates (TPR) and false positive rates (FPR) for each phishing detection model. The XGBoost model achieved the highest AUC score (0.97), followed closely by the RL-based model (0.96), BERT-based model (0.94), CNN (0.91), and DDQN (0.90). Traditional machine learning models such as SVM (0.88), Random Forest (0.75), Logistic Regression (0.60), and Naive Bayes (0.68) exhibited comparatively weaker performance, with lower separability between phishing and benign samples. These results underscore the superior phishing detection capabilities of reinforcement and deep learning models, which demonstrate stronger classification accuracy while minimizing false positives.