## 1 Introduction  
Vehicular Ad hoc Networks (VANETs) is a type of Mobile Ad hoc Network (MANET) consisting of vehicles equipped with advanced communication devices and sophisticated features. VANETs provide a platform for various applications, such as safety, traffic efficiency, and infotainment services [1]. However, VANETs are subject to several kinds of attacks, including denial-of-service, jamming, black holes, and worm hole attacks, that might compromise the network's security and privacy [2]. To detect these attacks, various approaches based on machine learning algorithms are suggested [3]. These methods are proven to be effective in detecting both known and unknown attacks, but they face several challenges in VANET networks [4]. First, attack patterns may change over time, which may affect the performance of a model trained on a fixed dataset [5]. Second, the complexity of the data in VANET networks can increase rapidly over time, making it challenging to scale traditional machine learning algorithms to handle new patterns in the data. In that regard, incremental online learning algorithms can be an effective solution for real-time applications compared to traditional machine learning techniques, which typically require large training datasets. Incremental online learning algorithms allows the model to learn continuously over time, adapting to new data as they become available [6]. The core interest of this study is to explore incremental online learning algorithms in the context of attack detection in VANETs. More specifically, our research focuses on the detection of the black hole attack, estimated as the most damaging attacks that might compromise Ad hoc On Demand Distance Vector (AODV) routing protocol in VANETs in terms of data availability [7,8]. To this end, we have used data gathered from extensive simulations of realistic VANET scenarios based on two well-known simulators, namely SUMO [9] and NS-3 [10]. The collected data incorporate essential features which are relevant in capturing the behavior of VANET nodes under a black hole attack. We selected more appropriate features, namely CTRLpackets, CountRREQ, CountRREP, CountRERR, Throughput, SentPckts, ReceivedPckts and Dropping ratio. Further, the performance of two incremental online classifiers, namely Adaptive Random Forest (ARF) and K-Nearest Neighbors (KNN), is investigated [11,12]. Additionally, metrics such as Accuracy, Precision, Recall, and F1-score are assessed in order to track the classifiers' performance over time. The findings demonstrate that ARF outperforms the KNN algorithm in terms of Accuracy, Precision, Recall, and F1-score. However, the latter records a higher running time. Furthermore, this study outlines the effectiveness of the proposed approach as it enables the creation of constantly updated models by processing small amounts of data at a time, rather than the entire dataset at once, unlike traditional machine learning methods that require substantial computing resources when dealing with large datasets. Further, this approach is especially beneficial in dynamic applications such as VANET networks, where data are continuously generated in a streaming manner. Moreover, it is adaptive, allowing it to adapt and improve predictions or decisions as new data arrive, thereby accommodating changing data patterns over time. The main contributions of this paper are as follows:  
* We introduce a more dynamic approach for detecting attacks based on incremental online machine learning algorithms trained on data generated in real-time;
* We collect data form VANET scenarios using a robust methodology for VANET simulations based two well-known simulators, namely SUMO and NS-3;
* We select essential features that are relevant in capturing the behavior of black hole nodes in the AODV routing protocol;
* We assess the overall performance of classifiers in terms of multiple performance metrics, namely Accuracy, Precision, Recall and F1-score.