Abstract
This research paper introduces a hybrid continuous learning platform using honeypots that will improve proactive cyber threat detection in dynamic environments. The proposed system combines a monitored warm-up step and an incremental semi- supervised learning route that constantly adapts to actual web traffic that has been gathered using a honeypot. The platform makes use of River framework and Multinomial Naive Bayes to process labeled and unlabeled HTTP request logs. The experimental findings across seventeen cycles of learning depict a definite enhancement in AUC, accuracy, precision and F1 following a shift from supervised to semi-supervised training. Confidence based filtering ensures that only trustworthy pseudo labels are used to update the model, which helps stabilize performance and reduces the risk of catastrophic forgetting. The paper has proven the hypothesis that incremental learning applied to real attack traffic offers quantifiable benefits over static batch learning. The findings show that a scalable, flexible and autonomous intrusion detection mechanism is practical and can improve itself over the long run.