## 4 Experimental Settings and Results
### Experimental Evaluation of the Proposed Method  
To experimentally evaluate the performance of the proposed method, we used the ToN_IoT network dataset. In our test scenario, all ten classes of network traffic are observed, but enterprise infrastructure is very sensitive to \"injection,\" \"password,\" and \"ransomware\" attacks. Moreover, the recall parameter, which represents the percentage of the accurately identified observations for each actual class of traffic, is very important. Security experts at the enterprise compared the sensitivity to all types of attacks and obtained the AHP judgment matrix presented in Equation (4). All experimental evaluations, including AHP score-based adaptive learning, utilized this matrix. \[J=\left( \begin{array}{ccccccccc}1&1&2&1/5&2&2&1/8&1/7&1&1/3\\ 1&1&1&1/8&1/2&3&1/5&1/7&1/2&1/3\\ 1/2&1&1&1/8&1/2&3&1/5&1/7&1/2&1/3\\ 5&8&8&1&3&9&1&1&7&8\\ 1/2&2&2&1/3&1&1&1/8&1/9&2&1\\ 1/2&1/3&1/3&1/9&1&1&1/8&1/9&1/2&1/3\\ 8&5&5&1&8&8&1&1&6&7\\ 7&7&7&1&9&9&1&1&9&8\\ 1&2&2&1/7&1/2&2&1/6&1/9&1&2\\ 3&3&3&1/8&1&3&1/7&1/8&1/2&1\end{array} \right) \tag{4}\]  
The consistency ratio (CR) of the judgment matrix presented in Equation (4) is 6.26%, which is sufficient for AHP (a CR of less than 10% is required). \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & \multicolumn{2}{c}{**Full**} & \multicolumn{2}{c}{**Training**} & \multicolumn{2}{c}{**Testing**} \\ \hline
**Class** & **Count** & **\%** & **Count** & **\%** & **Count** & **\%** \\ \hline backdoor & 508,116 & 2.275 & 409,764 & 2.276 & 98,352 & 2.267 \\ ddos & 6,165,008 & 27.597 & 4,967,755 & 27.599 & 1,197,253 & 27.593 \\ dos & 3,375,328 & 15.110 & 2,719,941 & 15.111 & 655,387 & 15.104 \\ injection & 452,659 & 2.026 & 364,816 & 2.027 & 87,843 & 2.024 \\ mitm & 1052 & 0.005 & 859 & 0.005 & 193 & 0.004 \\ password & 1,718,568 & 7.693 & 1,384,077 & 7.689 & 334,491 & 7.709 \\ ransomware & 72,805 & 0.326 & 58,548 & 0.325 & 14,257 & 0.329 \\ scanning & 7,140,161 & 31.963 & 5,752,791 & 31.960 & 1,387,370 & 31.974 \\ xss & 2,108,944 & 9.441 & 1,699,502 & 9.442 & 409,442 & 9.436 \\ normal & 796,380 & 3.565 & 641,947 & 3.566 & 154,433 & 3.559 \\ \hline
**Total** & **22,339,021** & \multicolumn{2}{c}{**18,000,000**} & \multicolumn{2}{c}{**4,339,021**} \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The main characteristics of ToN_IoT network traffic dataset. A classification algorithm's ultimate objective is to obtain the highest possible classification accuracy for a problem. It is important to note that there is no classification algorithm that is totally suitable for all issues. The goal of a classification algorithm is to optimize the classification process. The error-correcting output code (ECOC) technique is a method that is able to overcome the difficulty of classification, particularly in situations where there are significant numbers of classes [36]. We used the MATLAB (v. R2024b) multi-class ECOC classification model, which employs binary learners for the incremental learning function, to evaluate how the proposed method influences the results of adaptive incremental learning. To initiate incremental learning, the initial step must involve the inclusion of the names of all expected classes or the maximum number of classes that are expected to be present in the data during the process of incremental learning. The ToN_IoT network traffic dataset was divided randomly, allocating 80% for the training dataset and 20% for the testing dataset. The calculation of the total number of records in the training dataset resulted in a figure of 18,000,000. To facilitate incremental learning, the entire training dataset was divided into chunks. The selection of 36 chunks was based on empirical analysis, with the aim of maintaining a consistent record count of 500,000 in each training chunk. We derived this figure by dividing the total number of records from the training dataset by 36. We performed incremental learning in 36 steps using data chunks of 500,000 records.