The evaluation and benchmarking framework that was developed relies on MCDM techniques. This study’s strategy is formulated by combining FWZIC to assign weights and MABAC for ranking, enabling the identification of optimal alternatives within the suggested decision matrix. The literature analysis on MCDM techniques highlights FWZIC and MABAC as suitable methods for benchmarking and ranking DDoS detection models. The mathematical model of MABAC is proposed for addressing specific issues, such as simultaneously handling multiple evaluation criteria within the suggested decision matrix, even in cases of conflict among the requirements. Furthermore, FWZIC is utilized to assign weights to criteria, addressing the understanding of the significance of these criteria within the proposed decision matrix. Therefore, integrating FWZIC and MABAC methodologies is suitable for assessing and comparing DDoS detection models and their hierarchical ranking.

Table 1 shows the suggested decision matrix. The rows represent the classifier’s metrics (criteria), while the columns represent the classifiers (alternatives). The values of this matrix are obtained after executing the first part of Fig. 1.

To get the decision matrix. The CiC-DDoS2019 dataset has been used. Preprocessing this dataset may reveal irregularities, missing values, outliers, and similar issues that necessitate correction before analysis or modeling endeavors (see Fig. 2). After processing the dataset, it was divided into two parts: 80% for training and 20% for testing.

Different five machine learning algorithms, DPRCT, SVM, LR, NB, KNN, and Stacked Classifiers (SCs), were used to train and test the CiC-DDoS2019 dataset; SC is an ensemble technique that aims at improving the accuracy of results in models by combining multiple classifiers instead of using a single classifier [35]. After that, a set of metrics (ACC, REC, F1, and T) was applied to the classifiers to assess their quality and performance criteria. The decision matrix can be constructed from the measurements obtained. All work was done using Python.

The second part of Fig. 1 represents the implementation of the FWZIC method, which can be summarized in five steps as follows: 1.

Collection of evaluation criteria (from the decision matrix) •

Examination of the pre-agreed set of evaluation criteria.

Transforming a language scale into a corresponding numerical scale is necessary to facilitate further research. Therefore, during this stage, the experts reported that the level of importance or significance for each criterion on the Likert linguistic scale is transformed into a corresponding numerical scale, as depicted in Table 2. The Likert scale is predicated on the notion that varying levels of relevance are associated with the evaluation criteria. The spectrum of importance levels spans from the lowest to the highest.

3.

Constructing the evaluation decision matrix

During this process, the evaluation decision matrix is fabricated. Table 3 presents the fundamental components of this matrix, including the criteria and alternatives.

4.

Utilization of a decentralized membership function

The fuzzy membership function is applied to the data of the previous step, followed by a defuzzification procedure. This transformation aims to enhance precision and facilitate further data analysis. The fuzzy technique offers the benefit of handling unclear situations by employing ambiguous numbers instead of crisp ones to ascertain the relative value of the criteria. Due to their conceptual and computational simplicity, the primary type of fuzzy number used in fuzzy MCDM is the Triangular Fuzzy Number (TFN). The TFNs are represented as A = (a, b, c), as shown in Fig. 3.

The TFN membership function (x) is defined as: (1)μA(x)={0 if x<ax−ab−a if a≤x≤bc−xc−b if b≤x≤x where a≤b≤c0 if x>c

Based on the findings shown in Table 4, it is recommended that all linguistic variables be converted into triangular fuzzy numbers. This translation assumes that the fuzzy number is equivalent to the variable linked to each criterion for expert K.

5.

Make the weight coefficients associated with the evaluation criteria ultimate values

The weight coefficients for the evaluation criteria (w1,w2,…,wn) are concluded using the fuzzification data acquired in the preceding step. The ratio of fuzzification data can be calculated using Eq. (2), which is commonly employed in conjunction with TFNs, as illustrated in Table 5. (2)Imp(Em/Cn)∑j=1kImp(Em/Cj)

k is the number of criteria, m = 1, 2, 3 (the current expert), n = 1, 2, 3 (the current criteria).

The mean values must be found to get the values of the evaluation criteria’s weight coefficients (w1,w2,…,wn). Each column in the fuzzy expert decision matrix in Table 5 has its elements added together, and the sum is divided by the number of experts. For instance, w1 will represent the final fuzzy weight of the criteria C1.

Compared to the Technique for Order Preference by Similarity to Ideal Solution (TOPSIS) and VlseKriterijumska Optimizacija I Kompromisno Resenje (VIKOR) methods, MABAC is a recent method introduced MABAC is grounded in the measurement of the distance of alternatives from the Border Approximation Area (BAA). It follows a systematic process with a straightforward computational procedure, making it competent in addressing real-world decision-making problems. The steps of the MABAC method are as follows: 1.

Get the decision matrix obtained from Section 2.1.

The weight values obtained from the FWZIC method will be multiplied by the normalized decision matrix. Table 6 shows the output of the decision matrix.

4.

Calculate the border approximation area (BAA).

For simplicity, let us assume the BAA is the mean value of the weighted normalized decision matrix for each criterion by applying Eq. (6). Table 7 shows the BAA matrix.(6)Gj=∑CjN

Gj represents the current element of a BAA array.

∑Cj The sum of elements of column j for the weighted normalized decision matrix.

N The number of alternatives.

Rank the alternatives in descending order of Qi, where a higher score indicates a better alternative.

Table 8 presents the algorithm of the proposed work, which is divided into three sections. The first section explains how to obtain the decision matrix, the second section shows the FWZIC method, and the third section offers the MABAC method.

The current section presents the results of six classifiers evaluated according to the identified criteria in Table 9. The numerical values in the matrix cells represent the performance values of each detection classifier, depending on the corresponding criteria.

The SC with the classification group (DT, SVM, LR, and KNN) outperformed all other classifiers, achieving an accuracy of 99.57%, the highest value obtained in this study. The LR appears consistently in high-performing stacks, indicating its strength across different combinations and its effectiveness in complementing other classifiers. This analysis confirms that utilizing diverse classifiers in stacking can significantly enhance accuracy, underscoring the importance of carefully selecting model combinations to achieve optimal results. Conversely, the NB single classifier was more conservative, reaching the lowest accuracy of 76.22%. The algorithms are ordered from best to worst performance, according to accuracy: SC > SVM > LR > KNN > DT > NB.

Regarding execution time, the KNN algorithm was the fastest (3.9 s), whereas the SC took the longest. It takes the longest (143.5 s) because it deals with several classifiers. This time is relatively long compared with the rest of the classifier implementation times. Also, this conflicts with one of the interests of this work, in which the time factor is essential for eliminating the attack as quickly as possible.

The superiority of the single linear SVM classifier over the other single classifiers highlights the dataset’s inherently linear nature. This conclusion arises from the linear SVM’s ability to effectively establish clear boundaries among different categories via linear techniques. Therefore, classifiers based on the linear data separation technique are the best choice for this problem. In contrast, the naive Bayes (NB) single classifier, which relies on a probabilistic approach, demonstrated the lowest performance with the given problem because it is incompatible with the dataset structure. This contradiction suggests the limitations of probability-based classifiers when applied to challenges of this nature.

All the other mixed classifiers accuracy values except the value of the combination “DT + SVM + LR + KNN” are less than the accuracy value of the SVM single classifier (99.32%), so the work does not rely on them; also, their implementation time is larger than the SVM implementation time due to the integration of more than one classifier in Table 10.

The weights of the evaluation criteria utilize the FWZIC approach. The first process begins with FWZIC by identifying the evaluation criteria (ACC, PREC, REC, F1, and T). The relevance level of each evaluation criterion is determined by gathering the viewpoints of three professional specialists using a specially designed evaluation form. The recommendations provided by experts are subsequently converted into a standardized scoring scale, as seen in Table 4, Section 2.2. Afterward, the expert decision matrix (EDM) is built, as shown in Table 11. The numbers in Table 11 indicate the significance levels for each evaluation attribute, as determined by expert judgment. As in step four of the FWZIC steps, the EDM is transformed into a Fuzzy Matrix, as illustrated in Table 12. The procedure involves converting crisp values into fuzzy numbers with equal values. The final weight is ultimately determined by applying it throughout the defuzzification process. Table 13 displays the ultimate weights assigned to the five evaluation criteria of the DDoS detection models.

The final weights indicate that all experts have close opinions in Table 9. The highest weight values correspond to time and accuracy, two crucial elements in detecting DDoS attacks. Coordination between these two criteria is essential. High accuracy is required in detecting the attacks, but the time the classifier takes during the detection is also crucial. This dispute is referred to as a “criteria conflict”, which involves calibrating all criteria to achieve optimal results.

The MABAC method calculates the ranking of the DDoS detection models based on determined criteria. The MABAC results are in Table 14. They demonstrate that the SVM algorithms achieved the best ranking among other algorithms. This algorithm is the most suitable for our work (DDoS attack detection) because it has high accuracy and a short execution time compared to other algorithms.

So after training and testing with the CiCDDoS2019 dataset, passing them to many classifiers, taking the opinions of the experts, and putting it all in MCDM, it turns out that the SVM classifier is the most ideal for working in the environment of DDoS attacks, no wonder, it has many characteristics and good compatibility between all criteria so, the sound tuning of this classifier has made it stand out from the rest. This result, in turn, does not diminish the status of the other classifiers; if the goal is high detection accuracy, then the SC classifier can be chosen, of course, provided the time factor is not a significant concern in this case.

Below is a description of the two methods used to verify the results.