Development and Implementation of the Mail Security Guardian (MSG) System for Multi-Layer Proactive Email Protection Against Spam, Phishing and Malware

Abstract

Electronic mail remains the primary delivery mechanism for spam, phishing, business email compromise (BEC), and malware in enterprise environments. Existing Secure Email Gateways (SEGs) based on signature filtering and post-delivery analysis achieve approximately 0.91 F1-score under production conditions – a performance ceiling imposed by their reactive architecture. This paper presents the Mail Security Guardian (MSG), a distributed microservice-based platform implementing pre-delivery multi-layer email protection. MSG integrates five sequential analytical layers: pre-SMTP reputation filtering, protocol authentication (SPF, DKIM, DMARC), content and machine learning analysis, dynamic sandbox execution, and an evidence-aggregating decision engine. Evaluated on a corpus of 3.6 million messages collected over six months from a corporate infrastructure of approximately 2,500 users, the MSG machine learning pipeline achieved Precision of 0.992, Recall of 0.978, F1-score of 0.985, and AUC-ROC of 0.996 – an 7.5 percentage-point improvement over the conventional SEG baseline. Binary confusion matrix analysis confirmed legitimate email detection accuracy of 98.6% and malicious email detection accuracy of 99.3%. Production deployment produced reductions of 89.4% in spam prevalence (18.0% to 1.9%), 92.9% in phishing prevalence (4.2% to 0.3%), and 97.6% in malware prevalence (2.1% to 0.05%). End-to-end analysis latency ranges from 120 to 350 milliseconds, with per-node throughput of 50,000 messages per hour supporting linear horizontal scaling. Future directions include adversarial hardening against large language model (LLM)-generated phishing and federated learning for cross-deployment model updates.