Comparative Visualization of Phishing Email Embeddings Using VAE and UMAP

Abstract

Phishing emails remain a critical cybersecurity threat, highlighting the need for a deeper understanding of their linguistic and semantic structures. In this study, we investigate Japanese and English phishing emails using two types of distributed word representations: Word2Vec (W2V) and BERT. To facilitate interpretation, we apply and compare two dimensionality reduction strategies: (1) direct two-dimensional projection via a Variational Autoencoder (VAE), and (2) a twostep approach in which embeddings are first reduced to ten dimensions using VAE and then projected into two dimensions with UMAP. Experimental results show that VAE alone effectively captures an“inclusive relationship, ”where BERT embeddings consistently form a stable semantic core, while W2V embeddings display broader domain-specific variability. In contrast, the VAE+UMAP method highlights “separative relationship”between the two models, yielding clearer cluster boundaries and improved clustering indices. Importantly, these structural patterns were consistently observed in both Japanese and English datasets, suggesting the existence of a “universal structural relationship”between general-purpose and domain-specific embeddings. These findings demonstrate the complementary utility of VAE and VAE+UMAP, offering practical guidance for embedding compression and semantic feature analysis in phishing email detection across multiple languages.