AI-Enabled Cyber Threat Intelligence Platform for Email Security: Detection, Geolocation, and Forensic Correlation
DOI:
https://doi.org/10.46610/RTAIA.2026.v05i03.008Keywords:
Artificial intelligence, Cyber incident response, Digital forensics, Email security, Email spoofing, IP geolocation, Machine learningAbstract
Email remains one of the most widely used and trusted digital communication channels, which also makes it a prime target for cyberattacks. Adversaries exploit email through phishing campaigns, sender spoofing, malicious links, malware attachments, and social engineering to steal sensitive information or compromise systems. As these threats grow in volume and sophistication, manual inspection by security analysts becomes slow, error-prone, and unable to keep pace with modern attacks—creating a pressing need for automated, intelligent detection systems. To address this, this work proposes an AI-Powered Email Threat Detection, Geolocation, and Forensic Intelligence Platform that combines three core capabilities into one system: automated threat detection, geographic origin analysis, and digital forensic investigation. The platform uses AI and machine learning to analyze email characteristics such as header metadata, sender authentication signals, IP addresses, embedded URLs, and domain registration details. A classification model then labels each email as safe, suspicious, or malicious, allowing security teams to prioritize responses based on actual risk rather than manually reviewing every message. For emails flagged as suspicious or malicious, the platform performs geolocation analysis on sender IP addresses, mapping them to their likely geographic and network origin. This spatial context helps analysts identify attack patterns linked to specific regions, infrastructure providers, or known threat actors. The forensic layer further supports evidence correlation across incidents, helps trace the scope of larger campaigns, and maintains a documented trail for post-incident reporting. By integrating AI-driven detection, geolocation intelligence, and forensic analysis into a single platform, this system offers a faster, more comprehensive approach to identifying and investigating email-based threats—reducing analyst workload, improving threat awareness, and strengthening organizational resilience against evolving attack vectors.
References
S. Salloum, T. Gaber, S. Vadera, and K. Shaalan, “A Systematic Literature Review on Phishing Email Detection Using Natural Language Processing Techniques,” IEEE Access, vol. 10, pp. 65703–65727, 2022.
D. Rathee and S. Mann, “Detection of E-Mail Phishing Attacks – Using Machine Learning and Deep Learning,” International Journal of Computer Applications, vol. 183, no. 47, pp. 1–7, 2022.
P. H. Kyaw, J. Gutierrez, and A. Ghobakhlou, “A Systematic Review of Deep Learning Techniques for Phishing Email Detection,” Electronics, vol. 13, no. 19, Sep. 2024.
D. Popescul and L. D. Radu, “AI in Phishing Detection: A Bibliometric Review,” Frontiers in Artificial Intelligence, vol. 8, Oct. 2025.
H. Hu, P. Peng, and G. Wang, “Towards the Adoption of Anti-Spoofing Protocols,” arXiv:1711.06654, Feb. 2018.
S. Shukla, M. Misra, and G. Varshney, “Spoofed Email Based Cyberattack Detection Using Machine Learning,” Journal of Computer Information Systems, vol. 65, no. 2, pp. 159–171, Oct. 2023.
S. Shukla, M. Misra, and G. Varshney, “Forensic Analysis and Detection of Spoofing Based Email Attack Using Memory Forensics and Machine Learning,” Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, pp. 491–509, 2023.
A. Jadhav and Pankaj Chandre, “A Hybrid Heuristic-Machine Learning Framework for Phishing Detection Using Multi-Domain Feature Analysis,” Engineering Technology & Applied Science Research, vol. 15, no. 5, pp. 27219–27226, Oct. 2025.
M. Aljabri et al., “An Assessment of Lexical, Network, and Content-Based Features for Detecting Malicious URLs Using Machine Learning and Deep Learning Models,” Computational Intelligence and Neuroscience, vol. 2022, Aug. 2022.
N. Jindal, “Email Header Analysis in Cybercrime Investigations,” Hawk Eye Forensic, Feb. 2026.
A. S, M. M, P. R, and S. M. M, “AI Based E-Mail and Domain Spoofing Detection,” Research and Reviews: Advancement in Cyber Security, vol. 2, no. 3, Jun. 2025.
S. Gopali, A. Namin, F. Abri, and K. Jones, “The Performance of Sequential Deep Learning Models in Detecting Phishing Websites Using Contextual Features of URLs,” ACM Reference Format, 2024.
S. Rashed and C. Ozcan, “A Comprehensive Review of Machine and Deep Learning Approaches for Cyber Security Phishing Email Detection,” Al-Iraqia Journal of Scientific Engineering Research, vol. 3, no. 3, Jan. 2025.
H. Fares et al., “Machine Learning Approach for Email Phishing Detection,” Procedia Computer Science, vol. 251, pp. 746–751, Dec. 2024.
M. T. Banday, “Technology corner: Analysing e-mail headers for forensic investigation,” Journal of Digital Forensics, Security and Law, vol. 6, no. 2, p. 5, 2011.
