A crossover-integrated Marine Predator Algorithm for feature selection in intrusion detection systems within IoT environments

Abstract

In recent times, there has been a significant rise in cyberattacks targeting the Internet of Things (IoT) and cyberspace in general. Detecting intrusions in a time series environment is a critical challenge for Network Intrusion Detection Systems (NIDS). Building an effective NIDS requires carefully establishing an efficient model, with machine learning (ML) playing a prominent role. The performance of ML models depends on selecting the most informative feature subset. Recently, metaheuristic (MH) optimization methods have been effective in identifying these key features. However, standard MH methods require adjustment to incorporate NIDS-specific knowledge for optimal results, improving both MH performance and ML accuracy. This paper introduces a novel NIDS framework based on three key phases: preprocessing, optimization, and generalization. In the preprocessing phase, several datasets undergo cleaning and under-sampling. In the optimization phase, an enhanced version of the Marine Predators Algorithm (MPA) is proposed, utilizing the crossover operator to identify the most relevant features. The proposed method is called MPAC. The crossover operator is utilized to boost the exploitation capabilities of the MPA and find the optimal local solution for the NIDS. Finally, the selected features are applied to the NIDS. Eight different datasets are employed for examination and evaluation using different evaluation measurements to assess the effectiveness of the proposed NIDS. The experimental evaluation is organized into three phases: evaluating the proposed crossover modification by applying it to five algorithms and comparing results to the originals, comparing the results of the proposed algorithms to prove the robust performance of the MPAC, and comparing the results obtained by the MPAC with the stat-of-the-arts. The proposed MPAC confirmed its demonstration and high performance in detecting network attacks, wherein in the first evaluation phase, the proposed approach obtained better results in almost 90% of the comparisons. In the second comparison phase, the proposed MPAC achieved better results in six datasets out of eight, and in the last phase, the MPAC outperforms all compared methods.