## 4 Experimental Settings and Results
### Experimental Evaluation of the Proposed Method
After each step, the performance characteristics of the model were calculated using the test dataset, which included 4,339,021 records. The main performance metrics used for ML models are accuracy, precision, recall, and F1. Accuracy is the number of correct predictions compared to the total expected predictions. Precision is the measure of true positives compared to all predicted positives. Recall (known as true positive rate or sensitivity) shows how many actual positive cases were correctly identified. F1 is the harmonic mean of precision and recall. Researchers use accuracy metrics for balanced datasets and F1-scores for imbalanced datasets. In our experiments, an original ToN_IoT network traffic dataset was used, but the main goal was to create an ML model that can predict the most important classes with high priority. Due to that reason, recall, defined here as the percentage of positive cases accurately anticipated, is the most appropriate performance metric for the method we have proposed. Two learning scenarios were used. The first was traditional unconditional incremental learning using all available data. The second scenario employed AHP decision-making to determine the preference for including each data chunk in the updated prioritized model. The main criterion used for AHP's evaluation of performance was the recall metric. The results of this experiment are summarized in Figures 4 and 5 and Table 3.  
Figure 4a shows the confusion matrix after the first step. Both scenarios follow the same step, using the initial data chunk to initiate incremental model training. Figure 4b,c show the confusion matrices after the last step. These were created using unconditional and AHP-based adaptive incremental learning, respectively. One can observe that the use of AHP-based adaptive incremental learning slightly improves the recall results of the most prioritized classes according to our test scenario. The recall value of the \"injection\" class increased from 59.5% to 61.8%, the recall of the \"password\" class increased from 86.7% to 88.6%, and the recall of the \"ransomware\" class increased from 0 to 23.6%. On the other hand, only some of the performance characteristics of the classes \"not so very prioritized\" decreased (i.e., recall of \"ddos\" decreased from 90.5% to 90.4%). Table 3 presents a more detailed, step-by-step flow of the AHP-based adaptive incremental learning process. Figure 4: Comparison of confusion matrices using unconditional and AHP-based adaptive incremental learning: (**a**) confusion matrix after the first step, which is the same in both cases; (**b**) confusion matrix after the final step when using unconditional incremental learning; (**c**) confusion matrix after the final step when using adaptive incremental learning based on AHP. Figure 5: Comparison of changes in three most prioritized recall values during incremental learning process: (**a**) unconditional incremental learning using all available data; (**b**) adaptive incremental learning based on AHP score. This table shows the recall values after each step of adaptive incremental learning for the important attack classes that were prioritized (e.g., injection, password, and ransomware). The column titled \"AHP score\" indicates the score related to the decision to include the last chunk of new data in the updated prioritized ML model or not include it. The decision is positive if the AHP score is >0.5, as only two alternatives exist. The \"Include the new data\" column signifies the incorporation of the new data into the updated prioritized ML model. The last row (no. 37) shows the results of the updated prioritized ML model, which are the same as the results after step no. 32, because the new data from the last four chunks were not added to the updated prioritized ML model since their AHP scores were below 0.5. Table 4 presents other metrics for comparison.