Towards Adaptive and Explainable AI for Phishing Website Detection: A Comprehensive Review

Abstract

Phishing is one of the most common and rapidly evolving cyber threats. It exploits human behaviours and technical weaknesses to compromise critical information, such as passwords, financial data, and user names. Machine learning (ML) and deep learning (DL) techniques have dramatically improved phishing detection. But most AI models are trained on static data sets, features from the user’s interaction with the computer, supervised learning, or offline training, making them less likely to detect zero-day attacks and adapt to evolving phishing strategies. Most AI models are black boxes, highly computationally intensive, rely on third parties, and cannot be deployed in real time.

Each study was ranked according to feature extraction, learning methods, data sets, test results, detection accuracy, computation efficiency, interpretability, and deployment ease. The results suggest that hybrid and ensemble models perform best in terms of accuracy and robustness, but require static benchmark data and offline learning to scale up and generalise to new phishing attacks.

Based on the research gaps identified, this paper proposes a research roadmap that incorporates lifelong learning for model adaptation, hybrid supervised-unsupervised learning for anomaly and zero-day attack detection, Explainable Artificial Intelligence (XAI) for transparency and trust in models, and Natural Language Processing (NLP) for semantic analysis of webpage content, URLs, HTML code, and email text. A cloud-client collaborative model is recommended for scalable, low-latency phishing detection with real-time model updates across distributed environments. The integration of adversarial robust learning and automatic threat intelligence is also recommended.

Overall, our review suggests that future phishing detections should shift away from a static, accuracy-driven model toward one that is explainable and continuously learns, capable of recognising dynamic cyber threats, with real-time, trustworthy, and scalable real-world applications.