Adaptive Phishing Website Detection Using Incremental Machine Learning: A Dynamic Approach to Cybersecurity Threats

The rapid expansion of internet services and cloud-based platforms has increased cybersecurity threats, particularly phishing attacks that deceive users into disclosing sensitive information. Traditional phishing detection methods, including blacklists and batch-learning models, often struggle to adapt to the continuously evolving nature of these attacks. In order to address this challenge, this study proposes an adaptive phishing detection framework based on incremental machine learning techniques that enable real-time learning and dynamic adjustment to new attack patterns. A comprehensive evaluation of multiple incremental algorithms was performed using the River-ML framework and a publicly available phishing website dataset. The models were assessed based on accuracy, precision, recall, F1 score, Cohen’s kappa, and memory efficiency. Evaluation results demonstrate that models such as Aggregated Mondrian Forest, Extremely Fast Decision Trees, and Logistic Regression achieved strong classification performance, with the best accuracy reaching 90.15%, precision up to 91.05%, recall up to 89.42%, F1 score up to 88.75%, and Cohen’s kappa up to 79.99%, while lightweight models like ALMA maintained extreme memory efficiency, requiring as little as 1.81 KB. In general, the pro-posed incremental learning framework significantly improves the effectiveness of phishing detection and computational efficiency, providing a scalable and adaptive defense mechanism against evolving cyber threats.

@article{Kulaglic2026,
  title     = {Adaptive Phishing Website Detection Using Incremental Machine Learning: A Dynamic Approach to Cybersecurity Threats},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {17},
  number    = {4},
  year      = {2026},
  publisher = {The Science and Information Organization},
  author    = {Ajla Kulaglic and Mutaz A. B. Al-Tarawneh},
  doi       = {10.14569/IJACSA.2026.0170476},
  url       = {https://doi.org/10.14569/IJACSA.2026.0170476}
}