{"id":"https://openalex.org/W7167728256","doi":"https://doi.org/10.3390/info17111135","title":"Multi-Armed Bandit-Based Model Selection for Incremental Phishing Detection: An Empirical Study of Accuracy, Cost, and Concept Drift","display_name":"Multi-Armed Bandit-Based Model Selection for Incremental Phishing Detection: An Empirical Study of Accuracy, Cost, and Concept Drift","publication_year":2026,"publication_date":"2026-11-11","ids":{"openalex":"https://openalex.org/W7167728256","doi":"https://doi.org/10.3390/info17111135"},"language":"en","primary_location":{"id":"doi:10.3390/info17111135","doi":"https://doi.org/10.3390/info17111135","is_oa":true,"landing_page_url":"https://doi.org/10.3390/info17111135","pdf_url":null,"source":{"id":"https://openalex.org/S4210219776","display_name":"Information","issn_l":"2078-2489","issn":["2078-2489"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","norway-1","poland-40","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Information","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/info17111135","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5084256588","display_name":"Mutaz A. B. Al-Tarawneh","orcid":"https://orcid.org/0000-0002-8894-6946","observed_orcids":["https://orcid.org/0000-0002-8894-6946"]},"institutions":[{"id":"https://openalex.org/I2803079837","display_name":"American University of the Middle East","ror":"https://ror.org/02gqgne03","country_code":"KW","type":"education","lineage":["https://openalex.org/I2803079837"]}],"countries":["KW"],"is_corresponding":true,"raw_author_name":"Mutaz A. B. Al-Tarawneh","raw_affiliation_strings":["College of Engineering and Technology, American University of the Middle East, Egaila 54200, Kuwait"],"raw_orcid":"https://orcid.org/0000-0002-8894-6946","affiliations":[{"raw_affiliation_string":"College of Engineering and Technology, American University of the Middle East, Egaila 54200, Kuwait","institution_ids":["https://openalex.org/I2803079837"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5114344588","display_name":"Ajla Kulaglic","orcid":"https://orcid.org/0000-0003-3410-7079","observed_orcids":["https://orcid.org/0000-0003-3410-7079"]},"institutions":[{"id":"https://openalex.org/I2803079837","display_name":"American University of the Middle East","ror":"https://ror.org/02gqgne03","country_code":"KW","type":"education","lineage":["https://openalex.org/I2803079837"]}],"countries":["KW"],"is_corresponding":false,"raw_author_name":"Ajla Kulaglic","raw_affiliation_strings":["College of Engineering and Technology, American University of the Middle East, Egaila 54200, Kuwait"],"raw_orcid":"https://orcid.org/0000-0003-3410-7079","affiliations":[{"raw_affiliation_string":"College of Engineering and Technology, American University of the Middle East, Egaila 54200, Kuwait","institution_ids":["https://openalex.org/I2803079837"]}]},{"author_position":"last","author":{"id":null,"display_name":"Rand Ibrahim Al-Suhimat","orcid":"https://orcid.org/0009-0006-1869-3839","observed_orcids":["https://orcid.org/0009-0006-1869-3839"]},"institutions":[{"id":"https://openalex.org/I104941359","display_name":"Al-Ahliyya Amman University","ror":"https://ror.org/00xddhq60","country_code":"JO","type":"education","lineage":["https://openalex.org/I104941359"]}],"countries":["JO"],"is_corresponding":false,"raw_author_name":"Rand Ibrahim Al-Suhimat","raw_affiliation_strings":["Business School, Al-Ahliyya Amman University, Amman 19111, Jordan"],"raw_orcid":"https://orcid.org/0009-0006-1869-3839","affiliations":[{"raw_affiliation_string":"Business School, Al-Ahliyya Amman University, Amman 19111, Jordan","institution_ids":["https://openalex.org/I104941359"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5084256588"],"corresponding_institution_ids":["https://openalex.org/I2803079837"],"apc_list":{"value":1600,"currency":"CHF","value_usd":1930},"apc_paid":{"value":1600,"currency":"CHF","value_usd":1930},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"17","issue":"11","first_page":"1135","last_page":"1135"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9380000233650208,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9380000233650208,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.035599999129772186,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12101","display_name":"Advanced Bandit Algorithms Research","score":0.01940000057220459,"subfield":{"id":"https://openalex.org/subfields/1803","display_name":"Management Science and Operations Research"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/phishing-detection","display_name":"phishing detection","score":0.9869999885559082},{"id":"https://openalex.org/keywords/multi-armed-bandits","display_name":"multi-armed bandits","score":0.9470000267028809},{"id":"https://openalex.org/keywords/online-model-selection","display_name":"online model selection","score":0.9980000257492065},{"id":"https://openalex.org/keywords/incremental-learning","display_name":"incremental learning","score":0.9990000128746033},{"id":"https://openalex.org/keywords/ensemble-learning","display_name":"ensemble learning","score":0.5580000281333923},{"id":"https://openalex.org/keywords/data-streams","display_name":"data streams","score":0.6330000162124634},{"id":"https://openalex.org/keywords/thompson-sampling","display_name":"Thompson sampling","score":0.5809999704360962},{"id":"https://openalex.org/keywords/umbilical-cord-blood","display_name":"umbilical cord blood","score":0.7710000276565552},{"id":"https://openalex.org/keywords/linucb","display_name":"LinUCB","score":0.7049999833106995}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7455000281333923},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.6028000116348267},{"id":"https://openalex.org/C81917197","wikidata":"https://www.wikidata.org/wiki/Q628760","display_name":"Selection (genetic algorithm)","level":2,"score":0.5730999708175659},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.541100025177002},{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.5174000263214111},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.5153999924659729},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5134000182151794},{"id":"https://openalex.org/C93959086","wikidata":"https://www.wikidata.org/wiki/Q6888345","display_name":"Model selection","level":2,"score":0.4489000141620636},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.44200000166893005},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.4049000144004822},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3765999972820282},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3546999990940094},{"id":"https://openalex.org/C2780735816","wikidata":"https://www.wikidata.org/wiki/Q28324931","display_name":"Incremental learning","level":2,"score":0.34599998593330383},{"id":"https://openalex.org/C45804977","wikidata":"https://www.wikidata.org/wiki/Q7239673","display_name":"Predictive modelling","level":2,"score":0.33320000767707825},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.329800009727478},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.2896000146865845},{"id":"https://openalex.org/C2780102126","wikidata":"https://www.wikidata.org/wiki/Q10928179","display_name":"Online and offline","level":2,"score":0.2863999903202057},{"id":"https://openalex.org/C2780490138","wikidata":"https://www.wikidata.org/wiki/Q7079636","display_name":"Offline learning","level":3,"score":0.2815000116825104},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.28040000796318054},{"id":"https://openalex.org/C2781002164","wikidata":"https://www.wikidata.org/wiki/Q6822311","display_name":"Meta learning (computer science)","level":3,"score":0.2768000066280365},{"id":"https://openalex.org/C119898033","wikidata":"https://www.wikidata.org/wiki/Q3433888","display_name":"Ensemble forecasting","level":2,"score":0.262800008058548},{"id":"https://openalex.org/C2986087404","wikidata":"https://www.wikidata.org/wiki/Q15946010","display_name":"Online learning","level":2,"score":0.2574999928474426},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.2554999887943268},{"id":"https://openalex.org/C2775973920","wikidata":"https://www.wikidata.org/wiki/Q3252726","display_name":"Selection algorithm","level":3,"score":0.25029999017715454}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/info17111135","doi":"https://doi.org/10.3390/info17111135","is_oa":true,"landing_page_url":"https://doi.org/10.3390/info17111135","pdf_url":null,"source":{"id":"https://openalex.org/S4210219776","display_name":"Information","issn_l":"2078-2489","issn":["2078-2489"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","norway-1","poland-40","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Information","raw_type":"journal-article"},{"id":"doi:10.20944/preprints202607.0391.v1","doi":"https://doi.org/10.20944/preprints202607.0391.v1","is_oa":true,"landing_page_url":"https://doi.org/10.20944/preprints202607.0391.v1","pdf_url":null,"source":{"id":"https://openalex.org/S6309402219","display_name":"Preprints.org","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"}],"best_oa_location":{"id":"doi:10.3390/info17111135","doi":"https://doi.org/10.3390/info17111135","is_oa":true,"landing_page_url":"https://doi.org/10.3390/info17111135","pdf_url":null,"source":{"id":"https://openalex.org/S4210219776","display_name":"Information","issn_l":"2078-2489","issn":["2078-2489"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","norway-1","poland-40","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Information","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7160287300","https://openalex.org/W7216571886","https://openalex.org/W7134906174","https://openalex.org/W3028296005","https://openalex.org/W4408520399","https://openalex.org/W4411614876","https://openalex.org/W4412923396","https://openalex.org/W4396788207","https://openalex.org/W4411549390","https://openalex.org/W4388451289"],"abstract_inverted_index":{"Phishing":[0],"websites":[1],"are":[2,76],"generated":[3],"quickly":[4],"and":[5,41,50,55,80,109,115,124,140,155,163,178,181,202,208,214,329,367],"change":[6],"their":[7],"appearance":[8],"to":[9,24,34,302],"evade":[10],"detection,":[11,70],"so":[12],"detectors":[13],"must":[14],"keep":[15],"learning":[16,20],"after":[17],"deployment.":[18],"Incremental":[19],"allows":[21],"a":[22,43,58,81,182,216,280,313,349],"detector":[23],"update":[25,233,319],"with":[26,102,360],"every":[27],"labeled":[28],"instance,":[29],"but":[30],"which":[31,72],"incremental":[32,68,74,354],"learner":[33,86,244,257,366],"deploy":[35],"is":[36,132],"rarely":[37,259],"known":[38,303],"in":[39,71,248],"advance,":[40],"running":[42],"full":[44],"ensemble":[45,218],"of":[46,126,219,241,274,305,363,368],"learners":[47,75,198,222],"increases":[48],"latency":[49],"memory.":[51],"This":[52],"paper":[53],"proposes":[54],"empirically":[56],"evaluates":[57],"multi-armed":[59],"bandit":[60,82,96,235],"(MAB)-based":[61],"online":[62],"model":[63],"selection":[64,184,334,347],"framework":[65,93,131],"for":[66,353],"resource-aware":[67,331],"phishing":[69,137,204,316,355],"heterogeneous":[73],"treated":[77],"as":[78,348],"arms":[79],"policy":[83,282],"chooses":[84],"the":[85,118,121,127,152,191,196,211,234,242,255,269,275,291,299,322,330,361,364,369],"that":[87,254],"classifies":[88],"each":[89],"incoming":[90],"instance.":[91],"The":[92,130,250,318,343],"combines":[94],"ten":[95],"policies,":[97,101],"including":[98],"three":[99,103,110],"drift-aware":[100,281],"model-update":[104],"strategies":[105],"(selected-only,":[106],"hybrid,":[107],"all-model)":[108],"reward":[111,332],"designs:":[112],"accuracy-based,":[113],"cost-sensitive,":[114],"resource-aware,":[116],"where":[117,263],"last":[119],"penalizes":[120],"processing":[122,229,323],"time":[123],"memory":[125],"selected":[128],"learner.":[129,289],"evaluated":[133],"prequentially":[134],"on":[135,199,210,260,312],"two":[136,156],"datasets":[138],"(10,000":[139],"21,891":[141],"instances)":[142],"under":[143],"stationary":[144,212],"streams,":[145],"five":[146],"controlled":[147],"drift":[148,158,292],"scenarios":[149],"injected":[150],"into":[151],"real":[153],"datasets,":[154],"synthetic":[157],"benchmarks,":[159],"using":[160],"repeated":[161],"runs":[162],"non-parametric":[164],"statistical":[165],"tests,":[166],"against":[167],"six":[168,221],"individual":[169,197],"learners,":[170,338],"Adaptive":[171],"Random":[172,175],"Forest,":[173],"Streaming":[174],"Patches,":[176],"majority-vote":[177],"Hedge":[179,217],"ensembles,":[180],"warm-up":[183],"baseline.":[185],"An":[186],"Aggregated":[187],"Mondrian":[188],"Forest":[189],"achieved":[190],"highest":[192],"Cohen\u2019s":[193],"kappa":[194,240],"among":[195],"all":[200,220],"shuffled":[201],"drifting":[203],"streams":[205],"(kappa":[206],"0.907":[207],"0.457":[209],"streams),":[213],"only":[215],"matched":[223],"it,":[224],"at":[225],"2.5\u20134.7":[226],"times":[227],"its":[228],"time.":[230],"Under":[231],"all-model":[232],"came":[236],"within":[237],"about":[238],"0.02":[239],"best":[243,256,365],"without":[245],"knowing":[246],"it":[247,264],"advance.":[249],"oracle":[251],"analysis":[252],"showed":[253],"changed":[258],"most":[261,270],"streams;":[262],"did":[265],"change,":[266,306],"namely":[267],"when":[268],"informative":[271],"URL":[272],"features":[273],"second":[276],"dataset":[277],"became":[278],"unavailable,":[279],"made":[283],"fewer":[284],"errors":[285],"than":[286],"any":[287],"fixed":[288],"Because":[290],"was":[293],"injected,":[294],"these":[295],"results":[296,344],"show":[297],"how":[298,308],"policies":[300],"respond":[301],"types":[304],"not":[307],"they":[309],"would":[310],"perform":[311],"continuously":[314],"evolving":[315],"feed.":[317],"strategy":[320],"determined":[321],"cost":[324],"(0.9\u201312.6":[325],"ms":[326],"per":[327],"instance),":[328],"shifted":[333],"predictably":[335],"toward":[336],"cheaper":[337],"yielding":[339],"tunable":[340],"operating":[341],"points.":[342],"position":[345],"MAB-based":[346],"controllable":[350],"cost\u2013accuracy":[351],"mechanism":[352],"detection":[356],"whose":[357],"benefit":[358],"grows":[359],"variability":[362],"resource":[370],"budget.":[371]},"counts_by_year":[],"updated_date":"2026-11-12T12:28:57.059296","created_date":"2026-07-09T00:00:00"}