$$\rightleftharpoonup{xx}$$
$$\longleftharp{xx}$$,
$$\longrightharp{xx}$$,
In the contemporary digital era, characterized by the rapid evolution of the internet and digital technologies, email has remained an indispensable cornerstone in the domains of electronic transactions and corporate communication, despite the continuous emergence and innovation of instant messaging and social media platforms1. Its ability to transcend temporal and spatial boundaries endows it with unique advantages, allowing seamless communication across the globe at any time. However, this extensive adoption has given rise to a pressing and detrimental issue-the rampant spread of spam. Malicious actors have exploited email systems as vehicles to distribute vast quantities of unsolicited commercial advertisements, malicious software, and illegal content. According to research, from 2012 to 2023, the proportion of global spam in total email traffic skyrocketed by 7700%2,3. This inundation of spam not only severely disrupts users' normal email operations but also poses multifaceted threats. It undermines personal privacy by potentially exposing sensitive information, jeopardizes corporate security through the risk of data breaches and malware infections, and even destabilizes the economic order by facilitating fraudulent activities4,5. Effective spam classification reduces phishing-related financial losses by 40-60%6, highlighting the practical value of efficient, accurate filtering methods. Consequently, developing an efficient and accurate spam detection model has emerged as a crucial research area for ensuring network security and enhancing efficiency.
A substantial body of existing research on spam detection has centered around machine learning and deep learning methodologies. In the field of traditional machine learning, a diverse array of techniques has been explored and applied. Rule-based methods, such as decision trees7, have been utilized to make classification decisions based on predefined rules derived from data features. Boosting methods8,9,10,which aggregate multiple weak learners into a strong one, and rough set theory11, which deals with uncertainty and imprecision in data, have also shown potential. Additionally, statistical methods including logistic regression, K-nearest neighbors (KNN)12,13, Naive Bayes14,15,16, and SVM17,18,19 have been widely employed. These approaches commonly rely on traditional feature extraction methods like TF-IDF. While TF-IDF is effective in quantifying the importance of words in a document, it struggles to capture the intricate semantic relationships and contextual nuances inherent in email texts. Moreover, when confronted with high-dimensional and sparse data, which is typical in email feature spaces, these methods often encounter computational bottlenecks. Their limited robustness can lead to getting trapped in local optimal solutions during the training process, thereby severely restricting the classification accuracy and generalization ability of the models.
Deep learning, with its remarkable capacity for automatic feature extraction, has emerged as a powerful alternative in spam detection. Algorithms, such as Convolutional Neural Networks (CNN)20,21,22, Recurrent Neural Networks (RNN)23, and Long Short-Term Memory networks (LSTM)24,25, as well as more recent Transformer-based models such as Word2vec and BERT26,27, have made significant strides in improving classification performance. CNNs are adept at extracting local features from data, RNNs and LSTMs can handle sequential data well, capturing temporal dependencies in text, and Transformer-based models excel at mining complex semantic relationships and context information. Recent efficient NLP methods, such as TinyML-based text classifiers28, offer strong baselines for spam classification. TinyML models are optimized for edge devices with limited memory. We compare our method to these approaches in the Results section, highlighting trade-offs between accuracy, computational efficiency, and deployment flexibility. However, these deep learning models come with their own set of limitations. They typically require a large number of training parameters, resulting in high computational resource demands and extended training times. Deep learning models like BERT require 3-5x more memory and 10x longer training times than traditional SVMs29, making them less suitable for resource-constrained environments. This makes them less practical for deployment in resource-constrained environments, such as mobile devices or low-end servers. Moreover, their complex architectures often render them less interpretable, which can be a significant drawback in applications where understanding the decision-making process of the model is crucial.
Against this backdrop, the overarching goal of this study is to develop an innovative approach that can overcome the limitations of existing methods and effectively address the challenges posed by the high-dimensional and sparse nature of spam data. The proposed Van der Waerden Rank Score Feature Attention-Enhanced SVM (VWR-Attn-SVM) represents a novel integration of techniques aimed at enhancing spam detection performance (Figure 1). The fundamental principle behind the VWR-Attn-SVM lies in its unique design that combines the strengths of multiple components.

Figure 1: Overall flow chart of research on spam classification with VWR-Attn-SVM. This flowchart illustrates the workflow of spam classification based on the Van der Waerden rank score and feature attention-enhanced SVM, covering data preparation (loading, splitting, preprocessing), experimental preparation, verification of TF-IDF feature-label statistical correlations, attention-enhanced SVM-based spam detection, and multi-classifier comparison. Please click here to view a larger version of this figure.
The core Enhanced Feature Attention Mechanism processes individual email samples with a specific dimensionality. By applying the Van der Waerden rank transformation, it normalizes the email text features distorted by abnormal word frequencies into a standard normal distribution-like form. This transformation significantly enhances the model's robustness, enabling it to better handle the variability of email data. Van der Waerden rank scores were preferred over log-scaling and quantile transforms for three reasons: (1) Robust to spam feature outliers (e.g., extreme word frequencies), unlike log-scaling which amplifies low-frequency noise; (2) Preserve feature ordinal relationships (critical for spam indicator hierarchy like "free" vs. "win"), whereas quantile transforms flatten distributions; (3) Normalize to [0,1], easing attention mechanism integration and ensuring consistent weighting (Figure 2).

Figure 2: Experimental Flowchart. (A-C) Workflows for spam classification, covering data handling, feature selection, model training, evaluation, and comparison with/without Van der Waerden rank score transformation. Please click here to view a larger version of this figure.
Structurally, the mechanism features a two-layer fully connected network for non-linear feature transformation (Figure 2). The first layer, equipped with a LeakyReLU activation function, reduces the input dimensions while introducing non-linearity and incorporates a Dropout layer to mitigate overfitting. The second layer, using a Sigmoid function, outputs attention weights that can precisely quantify the importance of each feature. An L1/L2 regularization strategy is integrated into the model to optimize feature selection, where L1 regularization promotes sparsity, effectively screening out less relevant features, and L2 regularization prevents overfitting by constraining the magnitude of the weights. During the training phase, a multi-task learning framework is adopted, combining feature reconstruction loss and classification loss to optimize the model parameters. This allows the VWR-Attn-SVM to adapt precisely to the high-dimensional, sparse TF-IDF features of email texts, which are characteristic of the complex nature of email content.
Our method is optimized for text-based spam datasets ranging from several thousand to ten thousand (e.g., Spambase, Indonesian Spam dataset (Supplemental File 1)) and requires standard computational resources (Intel Core i7 processor, 16 GB RAM) for training; inference can be run on a standard laptop (Intel Core i5, 8 GB RAM) with sub-second latency. Key constraints include limited performance on non-text spam (e.g., image-embedded spam) and reliance on structured text features. Compared with existing alternative technologies, VWR-Attn-SVM has several remarkable advantages. Different from traditional machine learning methods, it does not solely rely on basic feature extraction but actively learns to weight features according to their importance through the enhanced attention mechanism, to better capture features more relevant to spam classification. In contrast to deep learning models, it achieves a favorable balance between performance and computational efficiency. It requires fewer computational resources and shorter training times, making it more suitable for a wide range of applications, especially those with limited resources. This innovative approach is applicable not only to the specific task of spam detection in email systems but also holds potential for extension to other text-based communication channels, such as instant messaging apps, social media platforms, and SMS services, where similar issues of unwanted and malicious content dissemination exist. Overall, the VWR-Attn-SVM represents a significant advancement in the field of spam detection, offering a more practical, efficient, and versatile solution to combat the persistent problem of spam in the digital communication landscape.