Optimizing Feature Selection for Intrusion Detection: A Hybrid Approach Using Cuckoo Search and Particle Swarm Optimization

The number of sensitive and secret data has increased as a result of increased internet usage, which presents security risks to hackers attempting to break into networks [1]. Intrusion detection systems' significance, which is crucial for protecting data and reducing the harm caused by attacks and network system penetrations, has increased with the implementation of the latest advanced web services laws, including government, banking, email, and marketing services [2]. An intrusion occurs when someone gains access to a network or a specific computer with the intent to steal data, alter the system, sabotage, or destroy it through security weaknesses in the operating system [3]. Very effective methods for detecting intrusions are machine learning and deep learning which are accustomed to categorize attacks and identify abnormalities [4].

Optimization is one of the most important topics in many scientific fields, where, optimization algorithms refer to methods for determining the best course of action in a given situation, frequently in the context of engineering, machine learning, artificial intelligence, and other domains where optimization is essential [5]. The optimization algorithm is a technique that iteratively evaluates many solutions to produce the optimal result under particular circumstances [6].

The study's objective is to take the most key components from the used intrusion detection dataset to build a reliable and efficient intrusion detection system. These contributions are:

• The study suggests a hybrid feature selection framework that integrates the worldwide search capabilities of Cuckoo Search with the regional search efficiencies of Particle Swarm Optimization. The intention behind this combination is to efficiently determine and rank the key characteristics for intrusion detection.

• Three different classifiers get the chosen features: AdaBoost, Random Forest (RF), and Multi-Layer Perceptron (MLP). It is shown that the CS-PSO hybrid model significantly enhances these classifiers' performance by decreasing computational complexity and increasing classification accuracy.

• The CICIoT2023 dataset, which covers an extensive range of IoT attack scenarios, is used to assess the method. This dataset provides a thorough foundation for evaluating the suggested feature selection method's effectiveness in actual settings in the Internet of Things.

The work’s remaining portion is described as like: Section 2 investigates the previous studies. Section 3 is methods and materials related. Section 4 explores the performance assessments and the suggested method. Section 5 addresses the conclusion and upcoming projects “form”.

3.1 The CICIoT2023 dataset

In 2023, the Canadian Institute for Cybersecurity (CIC) introduced the CICIoT2023 dataset, an innovative and compilation collection of IoT attack data [11]. This dataset captures attacks executed by compromised IoT devices targeting other IoT devices [12]. The CICIoT2023 dataset contains 232,885 connections across forty-seven different characteristics and encompasses thirty-three types of sub-attacks [13]. These attacks are categorized into 7 distinct classifications: DoS, DDoS, Web-based, Recon, Spoofing, Mirai, and Brute Force [11]. Dos has 4 sub-attacks, DDoS has 12 sub-attacks, Web-based has 6 sub-attacks, Recon has 5 sub-attacks, Spoofing has 2 sub-attacks, Mirai has 3 sub-attacks, while, Brute Force has no subtypes. The most dominant attack type in the dataset is DDoS with 169,276 instances and the least dominant is Brute Force with only 55 instances.

3.2 Cuckoo search optimization algorithm

Cuckoo Search (CS) is a developed meta-heuristic optimization algorithm that solves optimization issues by utilizing Levy flights' random walks and the brood parasitism of cuckoo species, drawing inspiration from nature [14]. Cuckoo bird species are brood parasites. They appear to lay eggs in the other host birds’ nests based on this. They procreate in this way to increase the likelihood that their eggs will survive. When host birds discover these kinds of eggs, they might relocate and build a new nest, or they'll throw out the alien eggs [15]. Certain species have unique egg-laying schedules; parasitic cuckoos frequently select nest sites where their host bird has recently produced eggs. After hatching, the chick increases its portion of nourishment by pushing out the host eggs. Cuckoo chicks can also imitate calls to increase their feeding opportunities [16]. Stochastic optimization is a technique used in CS; it simulates the compulsory brood parasitism behavior of cuckoo birds [17]. The CS uses the Lévy flight approach which is a strategy used in optimization and search algorithms inspired by the movement patterns of certain animals and insects [18]. It involves making random steps that follow a probability distribution with large tails is called a Lévy distribution. This means that the steps can vary widely in length, allowing the algorithm to investigate a wide region of the search space more effectively.

Based on the previous research [19], the core principles of CS are three highly idealized guidelines:

• Each cuckoo deposits one egg in an arbitrarily chosen nest.

• Retaining the nests with the best eggs for the following generation.

• There is a set quantity of provided nests, and each cuckoo's egg has a probability (between 0 and 1) of being detected by the host bird.

The algorithm of CS is as follows:

Initialization:

Set the number of nests to N and initialize them with random solutions.

Set the number of cuckoos M.

Define the probability Pa of egg discovery.

Egg Laying:

For each cuckoo i in M:

Randomly select a nest j from the N nests.

Place the cuckoo’s egg (new solution) in the selected nest j.

Egg Discovery:

For each nest j in N:

Determine whether the host bird finds the cuckoo’s egg based on Pa.

In case the bird discovers the egg (with probability Pa), replace the cuckoo’s egg with the host’s egg (current solution in the nest).

Selection of Best Nests:

Evaluate the quality of the eggs in all nests.

To preserve the best nests for the upcoming generation, pick the ones that produce the best eggs.

Repeat:

Repeat steps 2-4 until the convergence requirements are met or for a predetermined number of iterations.

3.3 Particle swarm optimization algorithm

Particle Swarm Optimization (PSO) is a swarm-based stochastic algorithm that exploits concepts related to animal social behavior, such as fish schools and bird flocks [20]. In PSO, potential solutions are modeled as particles moving through the problem space like a flock of birds, every single particle updates its place based on the best locations of other particles as well as its own best prior position in the swarm, with some random variations, after all particles update their positions, the process repeats, over time, the swarm collectively converges towards the optimal solution [21]. Based on previous research [22], the particles adjust their state based on three principles:

• Maintaining their current momentum;

• Adapting according to their own most well-known position;

• Adjusting based on the most well-known site in the whole swarm.

Each particle in the swarm has an impact on its position depending on the role and the specific experience of the most optimist particle in its immediate surroundings [23]. The Particle Swarm Optimization (PSO) algorithm is outlined as follows:

Initialization

• Set initial velocity (Vi) and position (Xi) for each particle i.

• Define the inertia weight (w), cognitive coefficient (c1), and social coefficient (c2).

For Each Particle i in the Swarm

Keep Inertia

• Update the velocity by retaining a fraction of the current velocity:

Vi(t+1) = w * Vi(t)

Update Based on Personal Best

Adjust the velocity to move towards the particle's personal best position (pbest_i):

Vi(t+1) = Vi(t+1) + c1 * r1 * (pbest_i - Xi(t))

where r1 is a random value between 0 and 1.

Update Based on Global Best

Further adjust the velocity to move towards the swarm’s best position (gbest):

Vi(t+1) = Vi(t+1) + c2 * r2 * (gbest - Xi(t))

where r2 is another random value between 0 and 1.

Update Position

Based on the updated velocity, update the particle's location:

Xi(t+1) = Xi(t) + Vi(t+1)

Repeat

Repeat the previous steps for each particle, continuing until the necessary number of iterations is achieved or the stopping condition is met.

This study's primary goal was to assess the efficacy of the recommended intrusion detection methodology across several classifiers. The results are presented according to the research questions addressed.

The parameter settings in the hybrid implementation of the CSA and PSO involve several key variables that influence the behavior of both the CSA and PSO, as detailed in Table 1.

Table 1. Parameters setting

Table 2 illustrates the features selected through the CS and PSO algorithms. The top features identified significantly contribute to model performance. The number of features selected by CS and PSO is 32, while the number of ignored features is 14.

Table 2. The selected features

The most important features resulting from CS and PSO are trained and tested with RF, AdaBoost, and MLP. The training and testing split ratio are 70:30, where 30% goes toward testing and 70% goes toward training. Table 3 and Table 4 illustrate the performance obtained from training and testing the classifiers.

Table 3. Evaluation measures in binary classification

Table 4. Evaluation measures in multi-classification

2.png

Figure 2. Confusion matrix of binary classification for RF classifier

It is clear from the above two tables that all the classifiers had superior results. Random Forest finds an equilibrium between robustness, efficiency, and ease of use, making it a strong performer in many scenarios. If computational efficiency and handling of high-dimensional or noisy data are key considerations, Random Forest often emerges as the best choice, especially when compared to AdaBoost and MLP, which may require more tuning and preprocessing to achieve comparable results. Figure 2 and Figure 3 show the confusion matrix for the best classifier in terms of results, which is Random Forest.

3.png

Figure 3. Confusion matrix of multi-classification for RF classifier

Table 5. Binary classification

Table 6. Multi classification

The False Positive Rate (FPR) and False Negative Rate (FNR) are crucial metrics for evaluating a classifier's performance, especially in applications where the cost of errors varies significantly. The FNR is the percentage of positive cases that are wrongly classified as negative, whereas the FPR is the percentage of many negative cases that are mistakenly labeled as positive. Table 5 and Table 6 show the proportions of FPR and FNR for the RF classifier.