Adaptive and explainable machine learning for Indonesian SMS phishing detection: Few-shot prototype learning, simulated concept drift, and SHAP/LIME feature analysis

Abstract

Phishing delivered through short text messages evolves quickly, producing scarce and imbalanced labelled data and shifting lexical patterns that challenge conventional supervised detectors. This study develops and audits a transparent detection framework on a private corpus of 15,950 Indonesian-language SMS messages, of which 13,411 unique messages (8,091 phishing, 5,320 normal) remain after removing 3,771 normalized duplicates. A class-weighted Logistic Regression over TF-IDF unigram–bigram features serves as the primary detector, and it is subjected to a battery of scenario evaluations: stratified five-fold cross-validation, a 2-way one/five/ten-shot episodic protocol, a controlled simulated lexical-drift stream with adaptive and static online learners, a binary class-introduction test, and an explainability pipeline built from exact linear SHAP and perturbation-based LIME. The detector attained an accuracy of 0.9806, an F1-score of 0.9838, a Matthews correlation coefficient of 0.9598, a ROC-AUC of 0.9973, and a PR-AUC of 0.9983 on a stratified hold-out. Five-fold cross-validation confirmed consistent performance with F1 scores ranging from 0.9829 to 0.9888. Episodic evaluation showed monotonic improvement from the one-shot to the ten-shot setting. Under simulated lexical drift, an adaptive online learner preserved a post-drift F1 of 0.9808 against 0.9604 for a static learner. Exact linear SHAP reproduced the decision function to within 1.8 × 10^-15, LIME achieved a local fidelity of R² = 0.921, and SHAP-based selection retaining 500 of 10,000 features (a 95% reduction) reduced F1 only modestly to 0.9741 with a mean pairwise Jaccard stability of 0.818. The findings indicate that a compact, class-weighted linear model can deliver strong, stable, and auditable SMS phishing detection, while few-shot and drift experiments delineate the boundaries within which limited-support and non-stationary performance should be interpreted.