Intrusion detection based Buzzards Optimization Algorithm and Artificial neural network.
1. INTRODUCTIONThe use of Internet is increasing daily. The Internet has emerged as a part of modern life of this generation. Currently, all online transactions in purchasing are enabled by the Internet in addition to social media interactions. Even though the Internet is well spread, a significant portion of people still lack the knowledge of its safety features and the associated threat of information misuse. In the usage of institutional resources, the concern of safeguarding information against every type of attack is the most critical. As a result, modern technology deploys two-level security systems to safeguard information and assets [1], [2]. Intrusion is a significant security threat and the essential element of security breaches since one intrusion may swiftly steal or damage information through networks and computer systems in seconds. Intrusion can destroy hardware in the system. Furthermore, intrusion may cause big financial losses and compromise important IT infrastructure, which may eventually compromise information integrity during cyber warfare. Therefore, infiltration needs to be identified and avoided. In spite of the availability of many intrusion detection systems, their reliability is still an issue because they are based on the false alarms and detection. To enhance the detection rate and reduce the incidence of false alarms, it is essential to address the issue of accuracy [3], [4].
To address these shortcomings, conventional machine learning techniques have been extensively utilized to differentiate various kinds of assaults. Conventional machine learning approaches typically prioritize feature selection and engineering over other factors. Furthermore, they typically fail to provide an adequate solution for the extensive categorization problem of intrusion data caused by the substantial volume of network application traffic [5]. The ANN is an efficient technique that has effectively solved several intricate practical issues that are challenging to handle through other methods. ANNs offer an effective approach for detecting intrusions. Additionally, ANNs have the capability to develop systems that learn from data, enabling them to identify individuals and extract unique information essential for decision-making and generalizing data. This ability to learn sets ANNs apart from conventional methods. Currently, a number of intrusion detection systems based on ANNs are still in the process of evolving. The educational process is a multifaceted system designed to establish connections between input data and corresponding outputs.
Hybrid problems continue to afflict the development of generic ANNs, with the main issue being optimization, particularly the identification of the ideal weight set during the training phase. In the setting of non-linear or complicated approximation issues, the training algorithm may become ensnared in a local minimum [6]. As a result, the training algorithms of ANNs may not succeed in locating the global optimal solution. Moreover, the training algorithm's convergence speed is unreasonably slow throughout its generating phase. The training of ANNs requires more robust optimization techniques. Consequently, we utilize certain traditional methods like back propagation (BP) to address that issue. The optimal local values resulting from the search process are sometimes considered as the steady state of the BP algorithm due to the algorithm working locally, and the final solution is greatly influenced by the initial weight settings. To address the challenges associated with training ANNs, there is a need for more robust optimization techniques.
This study examines the BUZOA [7], a unique natural EA. We combine it with ANNs to enhance advanced detection methods for IDS. The merging of ANNs with EAs produces an ENN. Our contribution in this piece of work is to include the ENN as a new methodological framework to alleviate the difficulties that accompany ANNs. The major aim of the current study is to use the BUZOA system to train a BUZOA-ANN architecture to detect emerging security threats.
RESEARCH SCOPE AND PAPER STRUCTURE
Unlike the rest of studies, this research focuses on the practical implementation of the BUZOA algorithm with the use of ANNs to improve IDS. The analysis uses the NSL-KDD dataset that is one of the most common benchmarks in the field of intrusion detection to test the model. Through the combination of evolutionary approaches and neural network design, the study aims to alleviate modern issues of the IDS models that comprise high false-positive rates and reduced detection rates. The expected outcomes of the findings are that they will create significant positive impacts on the sphere of cybersecurity, as well as on organizations that aim to develop flexible and effective defensive positions against dynamically changing cyber threats.
The major findings of this research are outlined below.
1) A new hybrid intrusion detection model is suggested which combines nature-based evolutionary heuristic, the Buzzards Optimization Algorithm (BUZOA), and a feedforward artificial neural network. The derived BUZOA-ANN model supplements the learning ability of the neural network and enables the identification of sophisticated dynamically changing cyber threats.
2) A viable training ANNs schedule is outlined. The use of BUZOA optimizes weights and biases of the network. The approach minimizes false positives and improves the ability to classify as compared to traditional training paradigms that are deployed in the current intrusion detection systems.
3) Experimental validation on the benchmark NSL-KDD data was done in large scale. The suggested BUZOA-ANN model shows an accuracy of 96.775. This outcome is higher than the performance of some of the machine-learning-based intrusion detection systems that are referred to in the academic literature.
The paper's structure, constructed to fulfill these study aims, is as follows:
* Section 2: Related Work In this section, the literature review on IDS has been comprehensively covered, whereby the emphasis of the studies reviewed has been on the one that has employed evolutionary algorithms and machine learning methodologies. By so doing, it outlines the achievements and limitations of existing strategies in terms of their successes in metrics like the detection accuracy, false alarm rates and computation efficiency.
* Section 3: Theoretical Backgrounds
The fundamental components of the suggested system are presented in this section. It starts with the NSL-KDD dataset, which is a standard for assessing intrusion detection techniques because of its balanced distribution and enhanced structure. The dataset is prepared for training by using data preparation techniques including encoding and normalization. To improve performance and decrease dimensionality, feature selection is carried out utilizing correlation and information gain techniques. To maximize learning, the BUZOA, which draws inspiration from buzzards' social behavior, is used. For classification, a multilayer perceptron-structured ANN is used. The core of the model is made up of these coupled elements, which allow for excellent detection accuracy.
* Section 4: Methodology The section at hand outlines the suggested methodology, according to which the BUZOA algorithm will be combined with an Artificial Neural Network to form an ENN. It lists the steps of the procedure including the data preprocessing, feature selection, and the training regimen using BU-ZOA. The experimental design is explained, with the dataset used, metrics of evaluation used, and training settings used.
* Section 5: Results and Analysis This section shows the experimental findings of the proposed BUZOA-ANN model. It provides a detailed assessment of the parameters of the model model by comparing it with well-established methodologies in major parameters such as accuracy, precision, sensitivity and specificity. In our analysis, we have included the discussion of the strengths and weaknesses of the method, and also we have factored the practicality of the method concerning its application in operations.
* Section 6: Conclusion and Future Recommendations The current research concludes with a summary of the major results and contributions based on the research. The possible future directions of the research include possible model extensions and the analysis of other strategies that can improve intrusion detection. The study will provide material information to practitioners and researchers in the field of cyberse-curity, hence enabling creation of more effective and dependable intrusion detection systems in the face of a growing number of cyber threats.
2. RELATED WORK
Over the past few years, Intrusion Detection Systems (IDS) have undergone significant development, especially with the incorporation of the deep learning methods. The researchers have applied diverse methods to enhance accuracy and effectiveness of IDS utilizing the potential of neural networks and machine learning systems. This discussion will review a few of the most critical studies that are in tandem with our research objectives.
In [8], the authors propose a feature-level IDS utilizing Convolutional Neural Networks (CharCNN-IDS). This model analyzes network traffic data from a natural language processing standpoint. The approach simplifies the IDS process by preprocessing data at the feature level. This model illustrates its characteristics by hiding vectors and excluding attributes and significance from the records.
In [9], A comparison of the efficacy of prevalent machine learning algorithms is presented. This necessitated extensive effort on the NSL-KDD dataset to integrate un-supervised feature learning with deep neural networks.To determine appropriate networks topologies and hyper parameters to use in machine-learn models, we ran a sequence of experiments. Deep neural network (DNN) that used fifteen features obtained in Principal Component Analysis (PCA) became the most useful modeling method.
The authors of [10] developed a DNN based classification and IDS. They used a standard anti-rectifier layer along with several noise and dropout layers. The current work attempts to resolve the issues of the deep neural networks namely co-adaptation and overfitting by concentrating on the performance of the attack detection and classification. We present the empirical study of the IDS and compare its results with conventional DNN and various machine learning methodologies. The researchers conducted a comparative analysis of the anti-rectifier layer utilizing conventional dropout, Gaussian noise, and dropout methodologies. The findings indicate that the AntiRectifier layer enhances the performance of DNN models configured with various dropout techniques.
The authors presented in [11] a hierarchical intrusion detection system based on the Extreme Learning Machine (ELM) and a nature-based optimisation algorithm. The proposed structure supports a multi-level detection system in order to enhance the classification performance by dividing the intrusion detection system into consecutive segments. ELM is the first classifier because it trains quickly and has a strong generalisation, and the nature-inspired optimisation algorithm is used to optimise the ELM parameters and provide a better detection accuracy. Empirical findings made on standard intrusion detection sets prove that the offered approach achieves high detection, as well as lower false alarms rates as compared with traditional machine learning-based intrusion detectors systems. However, the optimisation approach here only includes parameter optimization in ELM, whereby our proposed model of BUZOA-ANN focuses on the training of a multilayer neural network to enhance more detection accuracy and flexibility to changing cyber threats.
The authors in [12] introduce CLSTMNet an amalgamation of CNNs and LSTM networks into detecting and mitigating Distributed Denial of Service (DDoS) attacks as a part of network security. The model applies CNN layers to automatically identify spatial features of traffic information, and LSTM layers identify temporal dependencies and sequences that are relevant to DDoS activity. This mixed format allows the network to detect the dynamic short-term and long-term attacks. Benchmark results of experimental analysis and evaluations indicate that CLSTMNet achieves high levels of detection accuracy and high levels of robustness compared to standard machine-learning baselines and individual deep-learning models. In spite of its strong results, the method is based on an intricate deep-neural network that induces high computational costs; on the contrary, our proposed BUZOA-ANN architecture adapts evolutionary optimisation of a multilayer artificial neural network to obtain similar detection efficacy but address model complexity.
3. THEORETICAL BACKGROUNDS:
A. NSL-KDD Dataset
The NSL-KDD dataset is an improved iteration of the KDD Cup 1999 dataset, commonly employed for assessing network intrusion detection systems (NIDS). The original KDD Cup 1999 dataset was criticized because it had flaws like duplicate records and an uneven distribution of attack types, which often led to unfair results in machine learning models. The NSL-KDD dataset fixes these problems by getting rid of duplicate entries and making the distribution of data more fair. It then provides a more reliable starting point for research into intrusion detection [13].
The set of attributes, used to describe the network traffic and presented in Table I, contains 41 attributes, which are divided into three groups: fundamental characteristics (e.g., duration, protocol type), traffic characteristics (e.g., source bytes, destination bytes), and content characteristics (e.g., high-activity indicators, unsuccessful login attempts). Each record is classified as either normal or as one of four attack types: DoS (Denial of Service), Probe, Remote-to-Local (R2L), and User-to-Root (U2R) [13]. The NSL-KDD dataset is partitioned between training and testing subsets, facilitating effective model training and evaluation.
B. Data Preprocessing
Data preprocessing is essential in preparing an NSL-KDD dataset for analysis, as it involves converting raw data into a form convenient for machine learning algorithms. This process includes such key stages as dealing with missing values, coding categorical variables, and normalization of numerical characteristics.
NORMALIZATION
Normalization is a method utilized to adjust numerical properties to a specified range, generally between 0 and 1 or -1 and 1. This phase is crucial as the features in the NSL-KDD dataset display disparate scales, potentially compromising the efficacy of machine learning methods. Normalization guarantees that all features contribute uniformly to the model's learning process. Prevalent normalizing methods comprise min-max scaling and z-score normalization.
C. Feature Selection
Feature selection entails the identification and preservation of the most pertinent characteristics in a data set to improve model efficacy and decrease computational complexity. In the context of the NSL-KDD dataset, feature selection facilitates the removal of unnecessary or redundant characteristics; hence, it improves the accuracy of intrusion detection systems.
1) Information Gain
When a certain feature is used, information gain (IG) measures how much entropy or uncertainty about the target variable goes down. Features that acquire more information are thought to be more useful because they are better at telling the difference between different variables.
Differentiating between regular and attack traffic is crucial. In the NSL-KDD dataset, information gain may be utilized to prioritize features according to their significance for the classification job.
2) Correlation Method
The correlation approach assesses the intensity of the association between characteristics and the target variable. Features demonstrating a strong association with the target variable are deemed more pertinent. This approach may also detect multicollinearity, a condition in which two or more characteristics exhibit a high degree of correlation with one another. Removing strongly linked characteristics can decrease redundancy and improve model efficacy.
D. Buzzards Optimization Algorithm
The BUZOA is a nature-inspired metaheuristic introduced to address complex optimization challenges by emulating the foraging behaviors and social interactions of buzzards. Buzzards, known for their keen hunting strategies and competitive dynamics, serve as the foundational inspiration for this algorithm. The main structure of this algorithm is explained as follows:
* Population Initialization: BUZOA commences by generating a random population of candidate solutions, each representing a buzzard in the search space. This initialization ensures a diverse set of starting points for the optimization process.
* Fitness Evaluation: Each candidate solution's fitness is assessed based on a predefined objective function relevant to the problem domain. This evaluation determines the quality of each solution in relation to the optimization goals.
* Individual Experience: Buzzards adjust their positions in the search space based on their own experiences, reflecting personal learning and adaptation.
* Social Sharing: Information about successful foraging strategies is shared among buzzards, promoting collective learning and convergence towards optimal solutions.
* Predator Awareness: The algorithm incorporates mechanisms to simulate buzzards' awareness of predators, introducing perturbations that help in escaping local optima and enhancing exploration capabilities.
* Position Update: The positions of buzzards are updated by considering a combination of individual experiences, social interactions, and predator awareness. This flexible change encourages a balance between using known successful methods and exploring the search area.
* Termination Criteria: The iterative process continues until the specified termination criterion is achieved, whether by reaching a certain number of iterations or achieving a satisfactory degree of efficiency.
E. Multi-Layer Perceptron
The multi-layer perceptron (MLP) is regarded as a prevalent multi-layer perceptron of feedforward artificial neural networks that adeptly learns intricate systems. In MLP, the network comprises a minimum of three levels of neurons: 1) the input layer, 2) the hidden layer, and 3) the output layer. Except for neurons in the input layer, neurons in the hidden and output layers rely on a nonlinear activation function to distinguish data that cannot be linearly separated. This network is based on a supervised learning methodology called backpropagation for model training (see to 3-E) [13], [14], [15].
Figure 1 shows the three layers of MLP. The input layer ([x.sub.0],...,[x.sub.n]) is the first layer that inputs data to feed the network's neurons. The hidden layer ([a.sub.1],...,[a.sub.m]) is the second layer responsible for data processing, while the output layer ([a.sub.1],...,[a.sub.k]) is the third layer concerned with the output of the results [16].
Every neuron in the hidden layer receives input xi multiplied by a weight [w.sub.in], followed by the application of an activation function f to the product f([x.sub.i] * [w.sub.in]). MLP incorporates bias neurons [a.sub.0] inside the hidden or output layers. The bias neurons are interconnected with all hidden or output neurons. The aforementioned MLP diagram incorporates a bias neuron alone inside the output layer. Each neuron in the output layer computes the output of the hidden layer neurons [a.sub.i] multiplied by the weights [w.sub.h], in addition to the bias neuron [a.sub.0] multiplied by the weights [w.sub.h]. Subsequently, the activation function f is applied to the resultant expression f([a.sub.i] * [w.sub.h] + [a.sub.0] * [w.sub.h]). This results in a continuous shift of the function fin each output node by an amount ([a.sub.0] * [w.sub.h]) [13].
Artificial neural networks typically execute their functions through two fundamental processes: forward propagation and backpropagation.
FORWARD PROPAGATION
Forward propagation occurs within a neural network as it transitions from the input layer, which is the initial layer, to the output layer, representing its final stage. During this process, input data undergoes computation and storage before being directed forward to produce the intended output. In other words, the hidden layers in the feedforward network take the input data and process it, and then pass it to successive layers down to the output layer without forming any cycle during processing [18]. At each neuron, the processing is performed in two steps: preactivation and activation. The weighted sum of inputs is calculated before applying the activation function in preactivation, as shown in Equation (1) [19].
z = w * x + b (1)
Where: w is the weight vector, x represents the input vector, and b is the bias. At first, weights and biases parameters are initialized randomly. When the activation function f is utilized on the output derived from the preactivation phase, this condition is referred to as activation. The hidden activation vector results from this process, as illustrated in
Equation (2) [20].
h = f(z) (2)
The output of the neural network is generated from its final layer, where the sigmoid activation function is commonly employed. Each node's output in the network can be expressed using Equation (3) [20].
[Please download the PDF to view the formula] (3)
In forward propagation, the performance of a neural network is improved by defining some necessary parameters. Instead of feeding the neural network all the examples in the dataset at once, the batch size was suggested to control the number of examples that will be passed to the neural network at one time. In other words, it is not preferable to pass the entire dataset to the neural network at once; thus, by adjusting the batch size parameter, the dataset can be divided into a number of batches. The goal of dividing the dataset into batches is to facilitate the computational operations and thus improve the model's performance. At the conclusion of a batch, the anticipated values are assessed against the actual values to calculate the loss function [21]. Following this computation, the backpropagation phase commences. Generally, there are three prevalent methods associated with training neural networks: (1) Mini-batch gradient descent, which is utilized when the batch size exceeds one sample but remains smaller than that of the entire training set; (2) Batch gradient descent, applied when the batch size matches that of the complete training dataset; and (3) Stochastic gradient descent, used when dealing with a single sample as its batch size [20].
The loss function or so-called cost function is an important criterion for how well a neural network model is in a prediction task. As indicated in Equations (4) and (5), the loss function represents the absolute differentiation between the observed values and their anticipated counterparts for a specific instance within the dataset. The cost function is the aggregate of the discrepancies between the actual and anticipated values of all instances in the dataset, divided by the total number of occurrences [20].
loss = abs(predicted - Actual) (4)
[Please download the PDF to view the formula] (5)
Consequently, the cost value characterizes the error of the neural network, with its primary objective being to reduce this value. The loss function is primarily influenced by the parameters of the network, including biases and weights. So, this function was reduced by updating these parameters through learning or optimization methods (see backpropagation section). There are many types of loss functions. The most common are: (1) mean square error loss with regression task; (2) cross-entropy with a multi-classification task; (3) binary cross-entropy with binary classification task [22].
In binary classification tasks, the loss function known as binary cross-entropy is utilized to measure the disparity between predicted outcomes and actual values. The mathematical representation of binary cross-entropy can be stated as follows [22]:
[Please download the PDF to view the formula] (6)
BACKPROPAGATION
Unlike forward propagation, backpropagation always starts from the output layer (the last layer) and propagates backward to the input layer. Backpropagation serves as the fundamental mechanism of neural networks, tasked with adjusting the weights and biases associated with each layer. The desired output can be obtained from the neural network by adjusting these weights and biases. These parameters are updated by calculating the gradients efficiently [23].
To update the weights and biases, it is first necessary to calculate the cost function of the neural network (see Figure 2). The chain rule is employed to calculate the derivative of this function concerning weights and biases. Ultimately, the gradient (derivative) is utilized to derive new weights and biases. This procedure is applied to each neuron in the neural network to update its weights and biases [24].
Suppose that h = f(z) is the output of any neuron in the network with cost function C. Updating the weights w and biases b of this neuron is given by [24]:
[Please download the PDF to view the formula] (7)
[Please download the PDF to view the formula] (8)
The gradient descent (or any optimization algorithm) is then applied to obtain new weights and biases as follows [24]:
[Please download the PDF to view the formula] (9)
[Please download the PDF to view the formula] (10)
Where: [alpha] is a learning rate. The learning rate is an important hyper-parameter utilized to control the rate at which a neural network updates the values of the weights or biases at each epoch (epoch means one complete pass of all instances in the training set through the neural network). As shown in Figure 3, the challenge lies in choosing the ideal value for the learning rate because a value that is too small leads to a slowdown in the training of the neural network, while a value that is too large produces non-ideal weight [26].
F. Artificial Neural Network
A neural network is a machine-learning method designed to emulate the operations of neurons in the human brain for the goal of learning. Typically, a neural network is structured as layers of artificial neurons: an input layer, an output layer, and intermediary layers (hidden layers) situated between the input and output layers. Each neuron calculates a weighted sum of inputs and using an activation function to get the result.
ANNs are employed to create intrusion detection systems inside the NSL-KDD dataset architecture. The input layer acquires preprocessed characteristics, whereas the hidden layers discern intricate patterns within the data. The output layer generates predictions, including labeling network data as normal or as an attack. ANNs are effective in spotting difficult assaults as they can replicate non-linear interactions. Training an ANN reduces prediction error by means of gradient descent and other techniques of link weight modification.
Researchers should be able to make strong intrusion detection systems that find and stop network attacks using the NSL-KDD dataset, methods for preparing data, methods for choosing features, optimization algorithms like BOA, and artificial neural networks.
4. PROPOSED METHOD
The illustration in Figure 4 depicts the creation and execution of an IDS utilizing an ANN trained by BUZOA. The incorporation of ANNs offers a promising solution to address certain limitations present in existing intrusion detection techniques. These networks excel at identifying standard user behaviors while effectively detecting anomalies related to statistically relevant user activities. Furthermore, ANNs deliver adaptable, scalable, and intuitive topologies that facilitate the development of a comprehensive model encompassing environmental behavior and knowledge.
In order to determine the effectiveness of the suggested BUZOA-ANN intrusion detection model, a strict experimental procedure was used. The benchmark dataset of NSL-KDD was experimentally evaluated, and it is a generally accepted research test bed on intrusion detection due to its labelled traffic traces and its balanced representation of benign and malicious events. Before the model training, data preprocessing steps, including normalization and feature scaling were utilized in order to encourage stable learning dynamics. BUZOA was applied to optimize the weights and biases between the layers of a multilayer feedforward artificial neural network with two goals; to refine the convergence properties and reduce the false-alarm rate. All the experiments were carried out in the context of a typical machine-learning setup, and the regular metrics of model performance, including accuracy, precision, recall, and F1-score, were used to evaluate it. Also, the results of the empirical research were represented in the form of quantitative tables and graphical displays, which allowed condensed yet clear comparison of the suggested approach with the current approaches, which also promoted better interpretation of the effectiveness of the framework.
In order for the ANN to effectively learn the correlation between target outputs and input patterns, it is essential to calculate neuron parameters. Neural network training is a complicated and necessary task, particularly in the context of using the applications of the ANN. This can be modeled as an optimization problem with nonlinearity arising out of linear constraints and therefore requiring solution methods that are tailored to the training needs.
To this challenge a variety of evolutionary responses has been reported in the academic literature. These evolutionary algorithms (EAs) make use of stochastic, population-based search processes that are aimed at finding solutions that are either near-optimal or satisfactory in multimodal search spaces. The robustness of EAs is quite high and they can move towards a global optimum and therefore allow optimal solutions to be effectively achieved despite local minima in complex solution space.
Figure 4 shows the architecture of the proposed IDS, which consists of three main components, namely; the BUZOA module, the data input module, and the ANN component.
In the basic architectural design, a dataset is characterized as a set of allotted sets of testing and training that are the inputs to other modules of the artificial neural network system. Before the ANN module processes the data, data input module should first normalize the incoming data to make their values within the range (0,1) to ensure that the data is appropriate to be further processed.
In the next stage, the ANN module is used to extract the training feature vectors that are in the form of an N-dimensional dataset of the normalized dataset produced by the previous stage. ANN is developed following the feedforward design and it is implemented in the form of multilayer perceptron with an input layer, one or more hidden layer and an output layer (Table II details configuration).
The patterns of input received in the learning process in the neural network are created by the dataset generated by the training set. This training is coordinated by the BUZOA module which modulates the weight of synapses. It operates independently whereby the weights vary after each iteration.
The training process takes place in a series of iterations where, at each step of the training process, BUZOA sends a population of weights into the ANN module that then tests the consequent configurations on the training dataset and calculates their fitness scores. The end of the training process occurs when the maximum number of iterations has reached the set level, which will cause a review of the underlying knowledge components, such as biases and the weight parameters.
The last step involves the use of a trained ANN by using test data inputs to give the output prediction. The ANN testing process requires the validation of these predicted values by the closest similar target values. The predictive accuracy directly depends on the adjustment of the ANN weight and bias parameters, and the proposed algorithm, the BUZOA, does so as follows, as seen in Algorithm 1.
Algorithm 1 Buzzards Optimization Algorithm (BUZOA)
for ANN Training
1: Input: Training dataset D; ANN architecture
A; pop-ulation
size P; maximum iterations Tmax
2: Output: Optimized ANN weight vector W*
3: begin
4: Phase 1: Initialization
5: Initialize a population of candidate
solutions [{[W.sup.0.sub.i]}.sup.P.sub.i=1],
where each Wi encodes ANN weights and biases
6: Evaluate the fitness of each [W.sup.0.sub.i]
using the ANN loss
function on D
7: Set personal best positions
[Pbest.sub.i] [left arrow][W.sup.0.sub.i] for all individuals
8: Identify the global best solution
Gbest with minimum
fitness value
9: Phase 2: Evolutionary Optimization
10: for t = 1 to [T.sub.max] do
11: for each individual i = 1 to P do
12: Update the position [W.sup.t.sub.i]
using BUZOA exploration
and exploitation operators
13: Evaluate the fitness of the updated
solution [W.sup.t.sub.i]
14: if Fitness ([W.sup.t.sub.i]) <
Fitness([Pbest.sub.i]) then
15: Update personal best
position Pbesti [left arrow] ([W.sup.t.sub.i])
16: end if
17: end for
18: Update the global best
solution Gbest from
[{[Pbest.sub.i]}.sup.Pi.sub.=1]
19: end for
20: Phase 3: ANN Training
21: Assign optimized weights W (*) [left arrow] Gbest
22: Train the ANN model using W (*) as the initial weight
configuration
23: end
A. Data Pre-processing
This is a fundamental procedural step. Data preprocessing aims to convert raw data into a format that is more accessible and efficient for further processing steps. In the initial stage, we normalize the data using the min-max approach. Normalization improves training efficiency by ensuring that all training data is on a similar scale, such as within the range of 0-1. To substantiate this, we execute Equation (11), where [X.sub.norm] represents the normalization outcome and X denotes the initial quantity before normalization. [X.sub.max] and [X.sub.min] denote the maximum and minimum values of each characteristic, respectively [27], [28].
[Please download the PDF to view the formula] (11)
The second method of pre-processing using Minimum Description Length principle is data discretization. Through this, discretization of data involves conversion of continuous attribute values into a finite sequence of intervals with the aim of minimizing information loss.
B. Feature Selection
This study will compare two different approaches to feature selection, correlation based-selection and information gain, and at the same time compare their effects on the models of computational complexity and detection. The topicality of the given investigation is especially high when machine learning models are built in large-scale systems that produce high-dimensional data.
The initial technique, which is to be discussed, is the Information Gain-Based Feature Selection (IGBFS) algorithm. This method, as its name suggests, takes advantage of the ideas of information theory, such as mutual information and entropy, to identify the features to consider. IGBFS is used to rank the attributes by the number of bits of informational value they have with respect to the target class and include those with the highest value in the feature subset of the machine learning model. Then, feature relevance is assessed as an official term in the form of the Equation (12) [29]: (12)
Mutual information I(S; C) measures the association between the feature subset S and the class C, whereas H(S) denotes the entropy or uncertainty of the discrete feature subset S. H(S |C) represents the conditional entropy of S conditioned on class C. P([s.sub.i], [c.sub.j]) denotes the combined probability of feature amount [s.sub.i] and class [c.sub.j], P([s.sub.i]) represents the probability of feature amount [s.sub.i], and P([c.sub.j]) shows the probability of class [c.sub.j].
An alternative method for feature selection is referred to as correlation-based feature selection (CBFS). We utilize this approach because of its simplicity, which entails assessing attributes according to their correlation with a target class and then selecting those that rank highest. CBFS integrates characteristics into a subset when they are relevant particularly if they exhibit strong associations or predictive power for classification tasks. Moreover, CBFS employs Pearson's correlation coefficient as its evaluation metric for assessing each featured subset. This assessment process is therefore crucial [29].
[Please download the PDF to view the formula] (13)
The term MeritS denotes the benefit derived from the feature subset S. Here, k represents the total number of features within this subset. Additionally, [r.sub.cf] indicates the mean Pearson correlation associated with class features, while [r.sub.ff] refers to the average Pearson correlation concerning all features.
C. Artificial Neural Network Module
To increase the generalization ability of the ANN module, we chose single-hidden-layer ANNMLP ANN architecture in binary classification due to structural properties. Artificial neural networks consist of highly connected parallel processing units that take input data and give output values respectively. These neurons are formed in a specific layer which is interconnected with other neurons through one direction pathways only.
The ANN model architecture has three distinct layers, namely an input layer, a specified number of hidden layers and an output layer [30]. The number of neurons in the input layer is directly dependent upon the dimensionality of the input vector and the parameter M biases the network to have one hidden layer. Synaptic weights between the neurons in the hidden layer and that of the input layer are regarded as important.
The neural network is trained to give value to such weights during the training stage. The third component is the output layer, where the classes are represented by specific neurons, that is, when the classes are correctly classified (regular connections), the neuron returns 1 and when the classes are not, the neuron returns 0, which is determined by a single bias term.
When an incoming signal is multiplied by its respective weight, the cumulative weighted sum is obtained and processed with regard to an activation -or transfer-function. This aggregation consists of the addition of the products of the incoming signals and the fundamental weights to which they are associated, with an addition of an extra weight which is a bias weight, as described in Equation (14:
[Please download the PDF to view the formula] (14)
where[[omega].sub.ij] denotes the weight linked to the connection between input i and the neuron j, [[beta].sub.j] denotes the bias weight, and n refers to the total number of input neurons.
5. RESULT ANALYSIS
A. Dataset Description
We classify the NSL-KDD dataset as either normal or one of 24 distinct assault types. These 24 assaults can be categorized into four levels: U2R, Probe, DoS, and R2L.
B. Experimental Setup
This part examines the criteria used to assess classification models and their ability to accurately predict class labels. The evaluation metrics consist of precision (detection), sensitivity, resolution, accuracy, F-score, and G-mean. We denote the number of positive samples as P and negative samples as N. True positives (TP) indicate the count of positive instances that have been correctly classified by the model. Conversely, true negatives (TN) represent those adverse occurrences that were accurately identified by the classifier. False positives (FP) are defined as negative instances mistakenly categorized as positive by the classifier. Additionally, false negatives (FN) occur when positive samples are incorrectly classified as negative by the model. The overall accuracy of a classifier on a given dataset is calculated as the proportion of accurately identified instances relative to the total count of cases within the dataset.
[Please download the PDF to view the formula] (15)
When the class distribution isn t balanced, meaning that the primary and preferred class labels aren t seen very often in the samples, the negative class makes up most of the dataset, while the positive class stays in the minority. One can anticipate that high accuracy is advantageous for this category of data. In this scenario, the criteria of accuracy are inadequate, as the model has likely only accurately identified samples from the negative class while mislabeling all positive samples. Consequently, additional variables are necessary to evaluate classifier efficacy in differentiating between negative and positive cases. Here, we may utilize variables of sensitivity and resolution. Sensitivity is defined as the rate of genuine positives, whereas resolution is defined as the rate of true negatives. Sensitivity is defined as:
[Please download the PDF to view the formula] (16)
Specificity is defined in the following manner:
[Please download the PDF to view the formula] (17)
Categorization extensively uses precision and G-mean variables. We define precision as the accuracy variable, which measures the percentage of tuples labeled as positive and the degree of positivity.
[Please download the PDF to view the formula] (18)
The g-mean is described as:
[Please download the PDF to view the formula] (19)
Variable of F-score integrates 2 variables of sensitivity and precision is described as:
[Please download the PDF to view the formula] (20)
In addition to the mentioned criteria, the terms N, P, TP, TN, FP, FN are summarized in a matrix called the confusion matrix, which is shown in the figure below.
Although the aforementioned confusion matrix is intended for binary classification datasets, it may be readily adapted for datasets including multiple class labels. We executed the implementation using MATLAB 2021b on a seven-core 2.1 GHz Pentium processor with 12 GB of RAM. Initially, we designate 0.8% of the data as training data and allocate 0.2% as test data. We conduct all experiments in this study using the BUZOA algorithm, with a maximum iteration limit of 100 and 20 search agents. Table IV presents the parameters.
This paper considers the NSLKDD data as a multi-class classification task, and it splits the data into five different categories instead of just normal and pathological. We consider one class to be normal and regard the other classes as aberrant. Consequently, the original NSLKDD dataset undergoes processing before testing. We correlate the character attributes in the NSLKDD dataset with numerical characteristics. We employ the BUZOA neural network approach to evaluate the intrusion detection model. The testing environment is established through a simulation on a Windows 10 system using the MATLAB 2020b platform. This intrusion detection assessment employs the NSLKDD dataset.
A Deep Neural Network (DNN) produces the confusion matrix for the NSL dataset, illustrated in Figure 5. This indicates that the IDS attains a comprehensive accuracy of 96.8%. Furthermore, the Receiver Operating Characteristic (ROC) The graph depicts the correlation between True Positive Rate (TPR) and False Positive Rate (FPR), as represented in Figure 6 for the NSL dataset. Table V shows the evaluation of the suggested methodology to existing ones on the NSLKDD dataset. It shows the "Accuracy," "Precision," "Sensitivity," "Specificity," "Gmean," and "Fscore" values for four different algorithms. We reduced 41 attributes to 12 using information gain and correlation before feeding them to the ANN. The purpose of this study was to construct initial neural network weights in conjunction with BUZOA. We contrasted the outputs of the BUZOA+ANN-based IDS with novel machine learning approaches referenced in articles [8], [9], [10]. The results indicate that BU-ZOA+ ANN attains superior accuracy relative to machine learning approaches. BUZOA+ ANN achieves an accuracy of 96.775% on the NSL-KDD dataset. Ultimately, the results of the experimental simulation demonstrate that the model surpasses the conventional neural network model and has a superior diagnostic speed.
In intrusion detection training evaluations utilizing the NSL-KDD dataset, Figure 7 illustrates that the proposed methodology surpasses current techniques regarding the detection rate. Consequently, the suggested technique demonstrates unique utility and exceptional capacity for the intrusion detection system. A comparative analysis of the methods was made to obtain the average rate of the detection. As it is shown in Figure 7, the improvement that the proposed strategy produces is 6.25 percent.
The suggested plan grants a variety of advantages to the design of an effective intrusion detection system, particularly in the context of the increasing pace of the Internet of Things expansion that intensifies functional requirements that have to be met to ensure effective intrusion detection. The further empirical research will be conducted to improve the functioning of the described approach and to mitigate the existing intrusion detection systems. In addition, advancements in the sphere of Internet of Things have a positive impact on the enhancement of safety and security measures.
The experimental results have shown that the proposed BUZOA-ANN model has better performance compared to the current intrusion detection methodologies, most importantly in terms of accuracy, precision and false alarm reduction. The high level of detection indicates the effectiveness of evolutionary optimization to amplify neural network training and the generalization in complex intrusion detection setting. However, despite these positive results, there are a number of shortcomings that deserve a mention. To begin with, the test was done using NSL-KDD dataset, which, though widely used does not completely capture the diversity and magnitude of modern real-world network traffic. Second, the current implementation is focused on binary classification, which is an limitations that can hinder its use in situations that require a fine-grained attack taxonomy. Further, the computational cost of evolutionary optimization can be a chronic problem when applied in a resource-constrained environment with inherent resource constraints of real-time implementation. Future research projects are aligned to the further extension of the proposed framework to the multi-class intrusion detection systems, testing the model with the modern and realistic streams, assessing lightweight or hybrid optimization strategies to increase the scalability and real-time effectiveness.
6. CONCLUSION AND FUTURE RECOMMENDATIONS
The current situation evidences various ways of development and a strong improvement in the sophisticated processing technologies, such as intercommunication between heterogeneous networks; however, the system remains susceptible to attacks by enemies and evil forces. Well-trained attackers hinder the processes since they use innovative data-breach strategies on large networks. There are numerous available models of IDS that can detect network intrusion including false-positive detection rate and alert frequency based models. There is however a high chance of false-positive rate in these IDS models resulting in poor accuracy of the system and high vulnerability to a very large number of attack types.
The BUZOA denotes a unique natural biological zone. This study investigates the capability of artificial neural networks to enhance intrusion detection systems in recognizing more complex threats. The amalgamation of ANNS with evolutionary algorithms yields an evolved neural network. ENN employs an innovative way to address challenges encountered by ANNs.
The study's fundamental perspective involves using the BUZOA to train a BUZOA-ANN in order to identify novel attacks. Experiments on the NSL-KDD dataset demonstrate that the multi-class classification of our model has strong performance. In terms of accuracy, our model surpasses existing machine learning methods.
REFERENCES
[1] N. S. Bhati and M. Khari, "A new ensemble based approach for intrusion detection system using voting," Journal of Intelligent & Fuzzy Systems, vol. 42, no. 2, pp. 969-979, 2022.
[2] T. Wotaifi and B. N. Dhannoon, "Developed models based on transfer learning for improving fake news predictions." Journal of Universal Computer Science (JUCS), vol. 29, no. 5, 2023.
[3] I. Ahmad, M. Basheri, M. J. Iqbal, and A. Rahim, "Performance comparison of support vector machine, random forest, and extreme learning machine for intrusion detection," IEEE Access, vol. 6, pp. 33 789-33 795, 2018.
[4] T. A. Wotaifi and B. N. Dhannoon, "Attention mechanism based on a pre-trained model for improving arabic fake news predictions," Iraqi Journal of Science, pp. 6041-6054, 2023.
[5] I. Benmessahel, K. Xie, M. Chellal, and T. Semong, "A new evolutionary neural networks based on intrusion detection systems using locust swarm optimization," Evolutionary Intelligence, vol. 12, no. 2, pp. 131-146, 2019.
[6] Y. Ding and Y. Zhai, "Intrusion detection system for nsl-kdd dataset using convolutional neural networks," in Proceedings of the 2018 2nd International Conference on Computer Science and Artificial Intelligence, 2018, pp. 81-85.
[7] A. Arshaghi, M. Ashourian, and L. Ghabeli, "Buzzard optimization algorithm: a nature-inspired metaheuristic algorithm," Majlesi Journal of Electrical Engineering, vol. 13, no. 3, pp. 83-98, 2019.
[8] S. Z. Lin, Y. Shi, and Z. Xue, "Character-level intrusion detection based on convolutional neural networks," in 2018 International Joint Conference on Neural Networks (IJCNN). IEEE, 2018, pp. 1-8.
[9] S. Rawat, A. Srinivasan, V. Ravi, and U. Ghosh, "Intrusion detection systems using classical machine learning techniques vs integrated unsupervised feature learning and deep neural network," Internet Technology Letters, vol. 5, no. 1, p. e232, 2022.
[10] R. Lohiya and A. Thakkar, "Intrusion detection using deep neural network with antirectifier layer," in Applied Soft Computing and Communication Networks. Springer, Singapore, 2021, pp. 89-105.
[11] A. Alzaqebah, I. Aljarah, and O. Al-Kadi, "A hierarchical intrusion detection system based on extreme learning machine and nature-inspired optimization," Computers & Security, vol. 124, p. 102957, 2023.
[12] D. Danang and Z. Mustofa, "Clstmnet architecture: A cnn-lstm-based hybrid deep learning model for ddos attack detection and mitigation in network security," Journal of Artificial Intelligence and Technology, 2026.
[13] M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, "A detailed analysis of the kdd cup 99 data set," in 2009 IEEE symposium on computational intelligence for security and defense applications. Ieee, 2009, pp. 1-6.
[14] J.-F. Chen, Q. H. Do, and H.-N. Hsieh, "Training artificial neural networks by a hybrid pso-cs algorithm," Algorithms, vol. 8, no. 2, pp. 292-308, 2015. [Online]. Available: https://www.mdpi.com/1999-4893/8/2/292
[15] A. A. Heidari, H. Faris, S. Mirjalili, I. Aljarah, and M. Mafarja, Ant Lion Optimizer: Theory, Literature Review, and Application in Multi-layer Perceptron Neural Networks. Cham: Springer International Publishing, 2020, pp. 23-46. [Online]. Available: https://doi.org/10.1007/978-3-030-12127-3_3
[16] Y.-S. Park and S. Lek, "Chapter 7 - artificial neural networks: Multilayer perceptron for ecological modeling," in Ecological Model Types, ser. Developments in Environmental Modelling, S. E. Jcentsrgensen, Ed. Elsevier, 2016, vol. 28, pp. 123-140. [Online]. Available: https://www.sciencedirect.com/science/article/pii/B9780444636232000074
[17] S. Raschka and V. Mirjalili, Python machine learning: Machine learning and deep learning with Python, scikit-learn, and Tensor-Flow 2. Packt publishing ltd, 2019.
[18] M. Buscema, "Back propagation neural networks," Substance use & misuse, vol. 33, no. 2, pp. 233-270, 1998.
[19] A. Kag and V. Saligrama, "Training recurrent neural networks via forward propagation through time," in International Conference on Machine Learning. PMLR, 2021, pp. 5189-5200.
[20] O. A. Montesinos Lopez, A. Montesinos Lopez, and J. Crossa, Fundamentals of Artificial Neural Networks and Deep Learning. Cham: Springer International Publishing, 2022, pp. 379-425. [Online]. Available: https://doi.org/10.1007/978-3-030-89010-0_10
[21] M. Cilimkovic, "Neural networks and back propagation algorithm," Institute of Technology Blanchardstown, Blanchardstown Road North Dublin, vol. 15, no. 1, p. 18, 2015.
[22] S. Messaoud, A. Bradai, S. H. R. Bukhari, P. T. A. Quang, O. B. Ahmed, and M. Atri, "A survey on machine learning in internet of things: Algorithms, strategies, and applications," Internet of Things, vol. 12, p. 100314, 2020. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S2542660520301451
[23] T. P. Lillicrap, A. Santoro, L. Marris, C. J. Akerman, and G. Hinton, "Backpropagation and the brain," Nature Reviews Neuroscience, vol. 21, no. 6, pp. 335-346, 2020.
[24] D. Svozil, V. Kvasnicka, and J. Pospichal, "Introduction to multilayer feed-forward neural networks," Chemometrics and intelligent laboratory systems, vol. 39, no. 1, pp. 43-62, 1997.
[25] Baeldung, "Epoch in neural networks," https://www.baeldung.com/cs/epoch-neural-networks, 2023.
[26] Y. Zhang, "Assisting the visually impaired based on scene recognition and semantic segmentation," Ph.D. dissertation, 05 2021.
[27] A. Z. K. Matloob, M. I. Kareem, and H. K. Alwan, "Machine learning-based classification models for efficient ddos detection," International Journal of Computing and Digital Systems, vol. 17, no. 1, pp. 1-13, 2025. [Online]. Available: http://dx.doi.org/10.12785/ijcds/1571110617
[28] T. Ahmad and M. N. Aziz, "Data preprocessing and feature selection for machine learning intrusion detection systems," ICIC Express Letters, vol. 13, no. 2, pp. 93-101, 2019.
[29] M. Injadat, A. Moubayed, A. B. Nassif, and A. Shami, "Multi-stage optimized machine learning framework for network intrusion detection," IEEE Transactions on Network and Service Management, vol. 18, no. 2, pp. 1803-1816, 2020.
[30] I. Benmessahel, K. Xie, and M. Chellal, "A new evolutionary neural networks based on intrusion detection systems using multiverse optimization," Applied Intelligence, vol. 48, no. 8, pp. 2315-2327, 2018.
Zahraa Modher Nabat (1), Shaymaa AbdulHussein Shnain (1), Tahseen A. Wotaifi (2) and Ali Z.K. Matloob (2)
(1) University of Babylon, University Presidency, Babylon, Hilla, Iraq
(2) College of Information Technology, University of Babylon, Hillah, Babylon, 51002, Iraq
Received 18 March 2025, Revised 6 February 2026, Accepted 13 February 2026
http://dx.doi.org/10.12785/ijcds/1571128789
TABLE I. Feature List and Data Types No Features Form of value 1 Duration Integer 2 protocol type Nominal 3 Service Nominal 4 Flag Nominal 5 src bytes Integer 6 dst bytes Integer 7 land Integer 8 wrong fragment Integer 9 urgent Integer 10 hot Integer 11 num failed logins Integer 12 root shell Integer 13 num compromised Integer 14 roots hell Integer 15 su attempted Integer 16 num root Integer 17 num file creations Integer 18 num shells Integer 19 num access files Integer 20 num outbound cmds Integer 21 is host login Integer 22 is guest login Integer 23 count Integer 24 srv count Integer 25 serror rate Float 26 srv serror rate Float 27 rerror rate Float 28 srv rerror rate Float 29 same srv rate Float 30 diff srv rate Float 31 srv diff host rate Float 32 dst host count Float 33 dst host srv count Float 34 dst host same srv rate Float 35 dst host diff srv rate Float 36 dst host same src port rate Float 37 dst host srv diff port rate Float 38 dst host serror rate Float 39 dst host srv serror rate Float 40 dst host rerror rate Float 41 dst host srv rerror rate Float
TABLE II. Configuration parameters of the ANN module Parameter Value Number of layers 1 Number of neurons 128 Activation Function ReLU and Softmax Learning Rate 0.0001
TABLE III. Confusion Matrix
Predicted: No Predicted: Yes Total
Actual: Yes FN TP P
Actual: No TN FP N
Total N' P' P + N
TABLE IV. Initial Values of Parameters for BP Initial Values Parameters 0.8 Percentage of training data 0.2 Percentage of test data 20 Number of search agents 100 Maximum iterations 0 Lower bound (Lb) 1 Upper bound (Ub)
TABLE V. The comparison of classification accuracy of the proposed
method with existing methods
Dataset Evaluation Paper (14) Paper (15) Paper (16) Proposed
Criteria Method
NSLKDD Accuracy 85.07 79.3 95.94 96.775
Precision 91.68 - 99.60 98.914
Sensitivity 81.12 - 90.52 98.67
Specificity - - - 98.831
Gmean - - - 98.751
Recall - - - 95.001
Fscore 86.08 - 94.84 98.792
 Printer friendly
 Cite/link
 Email
 Feedback
| |
| Author: | Nabat, Zahraa Modher; Shnain, Shaymaa AbdulHussein; Wotaifi, Tahseen A.; Matloob, Ali Z.K. |
|---|---|
| Publication: | International Journal of Computing and Digital Systems |
| Article Type: | Report |
| Date: | Jan 1, 2026 |
| Words: | 8738 |
| Previous Article: | Harris-Augmented Block Matching for Depth Estimation Using Borobudur Temple Bas-Relief Stereo Images. |
| Next Article: | An IoT and Machine Learning-Based System for Real-Time Forest Fire Prediction and Monitoring. |
| Topics: | |