{
  "abstract": "The diversity of today’s malware and the conflicting criteria for predictive performance, computational efficiency, dependability, and interpretability have made the choice of a suitable malware detection model more complicated. Existing research focuses predominantly on predictive performance, while the multidimensional decision process required for practical model selection remains insufficiently addressed. To address this gap, this study provides an explainability-aware hybrid multi-criteria decision-making (MCDM) framework that systematically evaluates and ranks malware detection models across heterogeneous malware datasets. The methodology incorporates predictive performance, computational efficiency, false positive rate, and a composite Explainability Index into a single decision procedure. The Explainability Index integrates explanation stability, sparsity, and expert relevance, enabling interpretability to be explicitly considered in the model-selection process. The hybrid criteria weights are obtained by combining the Analytic Hierarchy Process (AHP) with the entropy weighting method, thereby integrating expert-driven criterion importance with data-driven variability. The final ranking is obtained using the Technique for Order Preference by Similarity to the Ideal Solution (TOPSIS). Four candidate detection models, including Random Forest, XGBoost, Convolutional Neural Network, and Long Short-Term Memory, are independently used to validate the framework on the CIC-MalMem-2022 and CICMalDroid2020 datasets. Under a harmonized evaluation protocol without assuming direct cross-dataset predictive transfer, the experimental results rank XGBoost first with a TOPSIS closeness score of 0.670, followed by Random Forest with 0.624. Sensitivity and ablation analyses further show that the model ranking remains stable while changes in criterion weighting and framework components produce measurable variations in the multi-criteria preference structure. Overall, the framework provides a transparent and multidimensional alternative to conventional performance-centered malware model evaluation.",
  "abstract_shown": true,
  "affiliations": [
    "Department of Cybersecurity Engineering, College of Engineering, Al-Karkh University of Science, Baghdad 10081, Iraq",
    "Cybersecurity Department, College of Computer Science and Information Technology, Wasit University, Al Kut 52001, Iraq",
    "Medical Instruments Techniques Engineering Department, Technical College of Engineering, Al-Bayan University, Baghdad 10001, Iraq",
    "Cybersecurity Research Centre, Universiti Sains Malaysia, Gelugor 11800, Penang, Malaysia"
  ],
  "article_type": null,
  "arxiv": null,
  "author_total": 4,
  "authors": [
    {
      "affs": [
        0
      ],
      "name": "Husam Jasim Mohammed"
    },
    {
      "affs": [
        1
      ],
      "name": "Riyadh Rahef Nuiaa Alogaili"
    },
    {
      "affs": [
        2
      ],
      "name": "Mohanad Sameer Jabbar"
    },
    {
      "affs": [
        3
      ],
      "name": "Selvakumar Manickam"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/88xmg6b1n6hhr.bib",
  "cited_by": 0,
  "doi": "10.3390/mca31050184",
  "fulltext_url": "https://www.mdpi.com/2297-8747/31/5/184",
  "id": "88xmg6b1n6hhr",
  "issns": [
    "2297-8747",
    "1300-686X"
  ],
  "landing_url": "https://doi.org/10.3390/mca31050184",
  "language": "en",
  "licence": "CC-BY",
  "licence_label": "CC BY",
  "licence_source": "journal",
  "licence_url": "https://creativecommons.org/licenses/by/4.0/",
  "metadata_licence": null,
  "native_subjects": [
    [
      "lcc",
      "QA1-939"
    ],
    [
      "lcc",
      "QA75.5-76.95"
    ],
    [
      "lcc",
      "T57-57.97"
    ],
    [
      "openalex",
      "1711|Advanced Malware Detection Techniques"
    ]
  ],
  "openalex": "W7211924107",
  "pdf_url": null,
  "pmcid": null,
  "pmid": null,
  "published": "2026-09-01",
  "publisher": "MDPI AG",
  "ris": "https://research.draconitic.com/paper/88xmg6b1n6hhr.ris",
  "sources": [
    {
      "first_seen": "2026-10-31T14:21:33Z",
      "native_id": "0434df92c5424f49b46be84b35a9255e",
      "source": "doaj",
      "url": "https://doi.org/10.3390/mca31050184"
    }
  ],
  "subjects": [
    {
      "field": "mathematics",
      "origin": "lcc:QA1-939",
      "subfield": "general"
    }
  ],
  "title": "An Explainable Multi-Criteria Decision-Making Framework for Evaluating Malware Detection Models Across Heterogeneous Datasets",
  "title_text": "An Explainable Multi-Criteria Decision-Making Framework for Evaluating Malware Detection Models Across Heterogeneous Datasets",
  "type": "peer-reviewed",
  "updated_at": "2026-10-31T14:21:33Z",
  "url": "https://research.draconitic.com/paper/88xmg6b1n6hhr",
  "venue": "Mathematical and Computational Applications",
  "versions": []
}