Knowledge modeling of phishing emails