In order to effectively detect malicious phishing behaviors, a phishing detection method based on the uniform resource locator （URL） features is proposed. First, the method compares the phishing URLs with legal ones to extract the features of phishing URLs. Then a machine learning algorithm is applied to obtain the URL classification model from the sample data set training. In order to adapt to the change of a phishing URL, the classification model should be constantly updated according to the new samples. So, an incremental learning algorithm based on the feedback of the original sample data set is designed. The experiments verify that the combination of the URL features extracted in this paper and the support vector machine （SVM） classification algorithm can achieve a high phishing detection accuracy, and the incremental learning algorithm is also effective.
