M.S. Candidate: Nesil Bor
Program: Cybersecurity
Date: 02.09.2026 / 10:00
Place: A-212

Abstract: This thesis evaluates 25 language models to compare generative and classification architectures for phishing email detection in resource-constrained local environments. A major challenge in modern cybersecurity is the lack of localized, psychologically accurate threat data for languages other than English. To address this gap, we used the collaboratively developed OLTA-TR dataset. Built on Cialdini's principles of persuasion, this synthetic Turkish corpus trains models to recognize manipulative intent rather than just filtering static keywords. Because endpoint security often requires running models locally, we managed hardware limitations using QLoRA fine-tuning and 4-bit quantization techniques. Experimental results combining the MeAJOR archive and OLTA-TR show that generative models consistently suffer from a helpful AI bias. While this bias caused formatting errors, the underlying autoregressive decoding process introduced critical latency issues when integrating these models into automated workflows. In contrast, smaller classification models adhered to formatting constraints consistently and completed their analysis in under a second. Most notably, the mmBERT model achieved a 99.49% Macro F1-Score, showing that effective phishing email detection relies mostly on recognizing psychological intent rather than language-specific grammar. To explain how these models make decisions, we introduced a dual-layer interpretability framework. Ultimately, while generative models are flexible, fine-tuned classification models offer a more reliable and secure method for real-time defense.