https://orcid.org/0000-0003-0549-7493
Figures
Abstract
Due to the huge number of connected Internet of Things (IoT) devices within a network, denial of service and flooding attacks on networks are on the rise. IoT devices are disrupted and denied service because of these attacks. In this study, we proposed a novel hybrid meta-heuristic adaptive particle swarm optimization–whale optimizer algorithm (APSO-WOA) for optimization of the hyperparameters of a convolutional neural network (APSO-WOA-CNN). The APSO–WOA optimization algorithm’s fitness value is defined as the validation set’s cross-entropy loss function during CNN model training. In this study, we compare our optimization algorithm with other optimization algorithms, such as the APSO algorithm, for optimization of the hyperparameters of CNN. In model training, the APSO–WOA–CNN algorithm achieved the best performance compared to the FNN algorithm, which used manual parameter settings. We evaluated the APSO–WOA–CNN algorithm against APSO–CNN, SVM, and FNN. The simulation results suggest that APSO–WOA–CNf[N is effective and can reliably detect multi-type IoT network attacks. The results show that the APSO–WOA–CNN algorithm improves accuracy by 1.25%, average precision by 1%, the kappa coefficient by 11%, Hamming loss by 1.2%, and the Jaccard similarity coefficient by 2%, as compared to the APSO–CNN algorithm, and the APSO–CNN algorithm achieves the best performance, as compared to other algorithms.
Citation: Bahaa A, Sayed A, Elfangary L, Fahmy H (2022) A novel hybrid optimization enabled robust CNN algorithm for an IoT network intrusion detection approach. PLoS ONE 17(12): e0278493. https://doi.org/10.1371/journal.pone.0278493
Editor: Sathishkumar V. E., Hanyang University, REPUBLIC OF KOREA
Received: October 14, 2022; Accepted: November 16, 2022; Published: December 1, 2022
Copyright: © 2022 Bahaa et al. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
Data Availability: Datasets are available from the N_BaIoT Data Set: https://archive.ics.uci.edu/ml/datasets/detection_of_IoT_botnet_attacks_N_BaIoT, Y. Meidan, M. Bohadana, Y. Mathov, Y. Mirsky, D. Breitenbacher, A. Shabtai, and Y. Elovici 'N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoders', IEEE Pervasive Computing, Special Issue - Securing the IoT (July/Sep 2018).
Funding: The authors received no specific funding for this work.
Competing interests: The authors have declared that no competing interests exist.
1. Introduction
The Internet of Things (IoT), cloud computing, mobile technology, and artificial intelligence will play a significant role in Klaus Schwab’s Fourth Industrial Revolution, which will make our society more intelligent [1–3]. The IoT is a technology that is growing quickly, with fifty billion devices expected to be in use worldwide [4, 5]. IoT devices have become easy targets for attackers because they do not have basic security protocols [6, 7]. According to Statistica [8, 9], 5200 attacks are launched against IoT devices monthly. Following the spread of COVID-19, it was found that 71% of security specialists believe that security vulnerabilities in IoT networks are increasing [10, 11]. Some studies [12–14] describe the attacks and security vulnerabilities of each IoT layer and suggest ways to protect privacy [15–17]. Attacks on Internet of Things devices have increased and several studies have developed intrusion detection systems [18–24].
An intrusion detection system (IDS) scans networks or systems for malicious activity and policy violations and generates alerts and reports of malicious activity [25, 26]. Multiple systems are able to conceal suspicious network activity, hence an intelligent IDS is required. Network intrusion detection system (NIDS) and host intrusion detection system (HIDS) are two main types of IDS [27].
Several researchers have used the same botnet virus N-BaIoT dataset as in this study to examine their own techniques. Bahsi et al. [28] used feature selection to reduce the total number of features utilized in the IoT bot detection process and this resulted in higher accuracy rates. Meidan et al. [29] extracted statistical characteristics that define normal IoT traffic and trained a deep autoencoder to identify DDoS attacks. According to the experimental results, the anomaly detection techniques may significantly enhance the detection accuracy of attack traffic.
In fact, as shown in [30–32], machine learning (ML) technologies are used in intrusion detection systems, but dataset pre-processing and anomaly traffic detection are time-consuming and complex [33, 34]. However, using deep learning (DL) technologies [35–38], features may be mapped to a higher degree with more distinct feature spaces. Combining DL technologies and a traditional ML model reduces the preprocessing time [39]. Support vector machines (SVM), k-nearest neighbors (KNN), naïve Bayes, and other algorithms were used to detect IoT attacks on networks, decrease the false alarm rate, and improve the detection rate [40–46]. A CNN is a deep learning approach that uses a convolution layer to automatically extract useful features from the authentic data feature plane through the convolution layer.
The hyperparameters should be tuned throughout the neural network training and weight learning operations. For this reason, several researchers used adadelta, rmsprop, adamax, adagrad, and Adam for tuning hyperparameters [47–49]. There are several hyperparameters that should be tuned for neural network structure, including the pooling layer, hidden layers, convolutional layer, and the number of neurons in the full connected layer.
To improve a CNN’s adaptability when the hyperparameters are unknown, it is prudent to conceive of unknown hyperparameter optimization techniques. Biological heuristic techniques, such as the ant colony algorithm, genetic algorithm, artificial bee colony algorithm, PSO algorithm, whale optimization algorithm, and biogeography-based optimization algorithm, improve the performance of deep learning models [50–53]. The WOA algorithm mimics the behavior of humpback whales, using a collection of random candidate solutions, and three rules are utilized to update and enhance the position’s candidate solutions [54]. The PSO algorithm is an evolutionary algorithm based on the behavior of birds when hunting [55]. The APSO algorithm improves the PSO algorithm by changing the method of calculating the inertial weight factor [56].
In this research, the researchers propose a neural network-based optimized method adaptive particle swarm optimization–whale optimizer algorithm (APSO-WOA) for convolutional neural network (APSO-WOA-CNN) to identify hyperparameters for detecting various network attacks. The following is a summary of the novel aspects of this research:
- A novel hybrid meta-heuristic APSO-WOA for optimization of the hyperparameters of a convolutional neural network (APSO-WOA-CNN) is presented.
- We compare our proposed optimization algorithm with others, such as the APSO algorithm, for optimization of the hyperparameters of a convolutional neural network.
- We evaluate the APSO–WOA–CNN algorithm against SVM, APSO–CNN, and feedforward neural network (FNN) using five evaluation indicators.
The remainder of this paper is structured in six sections as follows. Section 2 discusses the literature review. Section 3 discusses datasets and data preprocessing techniques for detecting network attacks. Section 3 discusses the framework of the 1D CNN algorithm and APSO–WOA and APSO optimization algorithms. Section 4 discusses the experiment that depends on the APSO–WOA–CNN and APSO–CNN algorithms. Section 5 discusses the results and performance analysis, based on the APSO–WOA–CNN, APSO–CNN, SVM, and FNN algorithms. Section 6 summarizes the paper and provides recommendations for future work.
2. Literature review
Recently, researchers in the area of network security have given greater attention to intrusion detection systems due to their increasing use [57]. We have published a systematic literature review (SLR) in monitoring real time security attacks for IoT systems [45]. The aim of SLR is to identify studied used machine learning algorithms for the detection of IoT attacks. This SLR helps us to identify the gaps in machine learning algorithms for the detection of IoT attacks. We identified forty-nine primary studies depend on the quality criteria. We summarized these primary studies based on the machine learning algorithms, datasets, IoT attack types, evaluation metrics, and monitoring real time security attacks via DevSecOps pipelines. The results show that more data preprocessing techniques should be applied to enhance the quality of public datasets. Furthermore, hybrid deep learning models must be used to keep improving the performance of IoT attack detection models.
ML methods are used in intrusion detection systems, but dataset pre-processing and anomaly traffic detection are time-consuming and complex [58]. However, using DL methods [59], features may be mapped to a higher degree with more distinct feature spaces. A CNN is a deep learning approach that uses a convolution layer to automatically extract useful features from the authentic data feature plane through convolution layer. Choosing optimal hyperparameters for deep learning models is crucial [60]. There are two main kinds of techniques for optimizing hyperparameters: automatic search methods and manual search methods. The manual configuration method makes it difficult to randomly find a good network structure. It is difficult to automatically tune hyperparameters for the optimal model structure. Tuning hyperparameters is an optimization issue in which the objective function is uncertain. It is impossible to use traditional optimization approaches such as the gradient descent or Newton method [61]. Biological heuristic techniques, such as the ant colony algorithm, genetic algorithm, artificial bee colony algorithm, PSO algorithm, whale optimization algorithm, and biogeography-based optimization algorithm, improve the performance of deep learning models by hyperparameter tuning.
Caroline et al. [62] proposed hybrid optimization techniques based on particle swarm and genetic optimization to discover optimal hyperparameters for the fully connected layers. This study improves the F1-score by 0.90 for all three networks: ResNet-50, VGG-16, and DenseNet-201.
Gurukumar et al. [63] proposed the fitness sorted rider optimization algorithm (FS-ROA) to discover optimal hyperparameters such as the pooling layer, hidden layers, convolutional layer, and the number of neurons in the full connected layer. This study achieved a good recognition rate of more than ninety seven percentage.
Lee et al. [64] used parameter-setting-free harmony search (PSF-HS) to increase CNN performance via hyperparameter adjustment in feature extraction. However, to train the PSF-HS algorithms for image recognition, a host requires reasonably powerful computing resources.
Wu Chen et al. [65] used Bayesian optimization to discover the optimal hyperparameters for machine learning algorithms. According to the experiment, the proposed model can determine the optimal hyperparameters for popular machine learning models such as neural networks and the random forest algorithm.
Amirabadi et al. [66] introduced two suboptimal grid search algorithms to modify deep learning network hyperparameters for optical communication (OC) systems. However, results demonstrate a significant decrease in computational complexity.
Lokku et al. [67] introduced a CNN-based classifier for an optimal face recognition network to identify facial images affected by occlusion and high noise.
Elmasry et al. [68] proposed a model based on PSO to identify hyperparameters and feature subsets in a single process for deep learning models such as the long short-term memory recurrent neural networks (LSTM-RNN), deep belief networks (DBN), and deep neural networks (DNN). Sakr et al. [69] tuned the SVM algorithm based on smart particle swarm optimization (SPSO). Xiu Kan et al. [56] proposed the APSO convolutional neural network algorithm to identify various types of IoT network attacks.
Alharbi et al. [70] proposed a model based on local-global best bat algorithm, PSO, and bat algorithm (BA) to identify neural network hyperparameters used for IoT attack detection. The proposed LGBA-NN achieved better accuracy than BA-NN and PSO-NN.
Sajjad et al. [71] proposed a method to identify hyperparameters of ML algorithms based on the genetic algorithm (GA) and grey wolf optimization (GWO). According to experimental findings, the training phases perform better in every trial. Additionally, GWO performs better with a p-value of 2.6E. Andrzej et al. [72] proposed a 3D search space whale optimization algorithm that used hyperparameter optimization, but this achieved low accuracy. Ali et al. [73] proposed an evolutionary sparse convolution network IDS to identify various types of IoT network attacks. This model decreased the false alarm rate and improved the detection rate. However, this model is time-consuming and requires complex computation. Abdullah et al. [74] proposed a modified GWO to identify hyperparameters of Extreme Learning Machine. The propsed model decrease false positive rate to less than thiry presentage. Vartouni et al. [75] suggested a technique for feature learning based on deep neural networks with an isolation forest as a classifier. Fereshteh et al. [76] proposed an IDS model based on two methods: the first method used Logistic Regression (LR) for feature selection and the second method used ANN for classification. Gonzalo et al. [77] provide a system for cloud-based distributed deep learning with the goal of detecting and mitigating phishing and botnet attacks.
Unlike these research studies, we proposed a novel meta-heuristic hybrid adaptive particle swarm optimization–whale optimizer algorithm (APSO–WOA) for optimization of the hyperparameters of a convolutional neural network (APSO-WOA-CNN). In this study, we tried to find ten hyperparameters for the CNN model by using the N-BaIoT dataset.
3. Datasets and data preprocessing
3.1. Datasets
Mohammed et al. [78] created the N-BaIoT dataset, which has one hundred and fifteen features within its data samples. The ports of all IoT devices were mirrored to acquire the dataset. After setting up the network, benign data were instantly gathered to guarantee that the data comprised normal traffic. For each statistical value, the times between the packet arrivals were extracted for two kinds of packet sizes (both inbound and outbound/only inbound), packet jitters, and packet counts. Each of the five time-windows (1 min, 10 s, 100 ms, 500 ms, and 1.5 s) had twenty-three features extracted from them, with a total of one hundred and fifteen features. All one hundred and fifteen features were used in our model. According to Table 1, a total of twenty-three statistical characteristics were computed from each window.
3.2. Data preprocessing
The Danmini Doorbell dataset was used for the multiclassification tasks. The original dataset used in this study contained 90,000 samples, which were generated from 10,000 random records that were selected from every type of dataset. Different sample values for the same feature differed greatly, and some unusually small or large pieces of data deceived the model’s training process. Additionally, the dispersed distribution had an effect on the training outcomes. This process generated a dataset consisting of 115 characteristic dimensions. Every feature in the dataset was standardized by mutating data into a standard normal distribution with a unit variance and a mean of zero.
The generated data matrix illustrates Xnxp, where p and n are the feature and sample numbers, respectively. The following is a description of the primary standardization process:
3.2.1. Calculate each feature’s mean.
(1)
where n represents the total samples, μj represents each feature’s mean, j represents the feature, i represents the sample, and
represents the feature of the sample.
3.2.3. Calculate the feature’s standardization characteristics for each sample.
(3)
where
represents the feature’s standardization characteristics for each sample.
Ninety-thousand records were divided into nine-thousand validation and eighty-one-thousand training samples after feature standardization.
4. Methodology
In this section, we discuss the framework of the one-dimensional CNN algorithm and APSO–WOA and APSO optimization algorithms.
4.1. CNN Algorithm (1D)
A CNN is a multi-layered neural network, and each network layer is made up of various two-dimensional planes [80]. Using the weighted total of the previous layer’s elements, each neuron’s output and activation can be calculated. In this study, we employed a 1D CNN, which was constructed using the Keras library, to identify the different types of IoT network attacks. Fig 1 illustrates the detailed network structure model of CNN’s one-dimensional framework.
4.1.1. First layer.
The characteristics of the N-BaIoT dataset’s attributes extract 23 statistical characteristics in five time-windows. In this study, each sample’s input dimension was allocated in the 23 × 5 feature plane. As illustrated below, the neuron’s output on the feature plane in the C1 layer was :
(4)
where
represents the convolution kernel’s weight, fl represents the filter’s length, and
represents the feature of the characteristic plane’s position. In this study, tanh, sigmoid, and relu non-linear activation functions are designated by Fi(⋅)(i = 1,2,3), as shown below [54]:
(5)
(6)
(7)
The original data’s deeper and more complex features are obtained by the convolution layer. Before connecting a layer to the following layer, the feature plane is flattened as well. During the training process for a network, overfitting happens when the training set is very accurate but the validation set is not. To enhance the network’s capacity for generalization, Hinton advocated in [81] that 50% of feature detectors fail during training, also known as dropout. So, some neurons may not use in other layer, and each training cycle has a different set of neuron nodes that work. So, not all neurons working together improve network generalization.
4.1.2. Second layer (F2 layer).
This layer is the first that has a full connection. In the connective layer, the neuron activation mode and number are set. In each training batch, every connective neuron is coupled to the layer below it. represents the output of the m-th neuron in the second layer, as described below:
(8)
where
is the neuron’s offset value in the second layer, nkeep is the neuron number that remains after flattening and dropout are performed, keepn is the neuron used that remains from the past layer, and
is the connection weight between the neuron of the second layer and the working neuron remaining from the previous layer.
4.1.3. Third layer (F3 layer)
This layer is the second layer that has a full connection. In this layer, the neuron activation mode and number are set. All neurons in this layer are linked to the second layer neurons. The last two full connection layers enhance the learning of the flattened features.
4.1.4. Fourth layer (output layer).
The third layer’s output is passed to the fourth layer, and the multi-classification task categories determine the number of fourth-layer neurons. As shown below, the softmax formula is utilized to assign the probability of every network attack in the fourth layer:
(9)
where kind is the volume of the network attack types, and softmax (y)i is the i-th neuron’s output value in the fourth layer. The prediction outcomes from the training have the greatest probability. The difference between the two probability distributions for the actual and estimated values is measured by cross-entropy, as shown below:
(10)
In this study, SGD was chosen to enhance the model’s training process to increase the detection accuracy; SGD adjusts the bias value of neurons and the connection weight.
4.2. Adaptive particle swarm algorithm
Eberhart and Kennedy proposed the PSO algorithm, which is an evolutionary algorithm based on the behavior of birds when hunting [55]. The method of birds searching for food is similar to that of finding optimal particle solutions. Every particle’s speed can be calculated using only the best global fitness values and the local optimal fitness value achieved in that iteration. There are two parameters for each particle, namely, the position parameter, represented by , and the velocity parameter, represented by
. The formula used to update the position and velocity of each particle throughout an iteration is as follows:
(11)
(12)
where
and
are the previous positions and velocity of the particle i,
and
are the position and velocity of the particle i during iteration t + 1, t represents the current iteration number, c2 and c1 are represented by the acceleration coefficients, pbestid represents the i-th particle’s optimal position during the present iteration, w represents the inertial weight, gbestd represents the population’s optimal global position, and the two random values r1 and r2 are equally distributed between zero and one.
Particles may readily escape the current optimal local value when the inertial weight is enormous and may not converge later. When the inertial weight is in an optimal state, particles fall towards the optimal local value. Consequently, the inertial weight must be adjusted dynamically. An algorithm called APSO for dynamic inertial weight was developed based on these characteristics [56]. It adapts the inertial weight based on the fitness value. The formula to calculate adaptive inertial weight is as follows:
(13)
The present particle’s fitness value is given by fcur. The present population’s average fitness value is given by favg. The lowest particle fitness value in the current population is given by fmin.
4.3. Whale optimization algorithm
The WOA algorithm is a kind of bio-inspired meta-heuristic algorithm, proposed by Lewis and Mirjalili, that mimics the behavior of humpback whales [54]. Whales are exceptional creatures, not just because they are the largest mammals in the world but also because they are extremely intelligent and have developed social behaviors. The WOA algorithm employs a collection of randomly selected candidate solutions, and three rules are utilized to update and enhance the positions of these candidate solutions. The WOA has three steps: identification (encircling prey), exploitation (bubble-net attack), and exploration (search for prey), which will be discussed in the subsections below.
4.3.1. Identification (encircling).
Humpback whales can detect their prey’s location and encircle it. Target hunting is assumed to be the best current candidate solution for the whale optimization algorithm because the optimal prey location in the search space is unclear. The reminder agents adjust their positions depending on the position of the best search prey, as illustrated below:
(14)
(15)
where t represents the current iteration number, X* represents the best solution location vector, X represents the position vector,
is the position of the whale at each iteration, and C and A are the coefficient vectors. Eqs (16) and (17) are calculated using coefficient vectors C and A.
In the aforementioned equations, r represents a random vector with values between zero and one, and the value of a parameter is lowered linearly from two to zero during the exploitation and exploration steps.
4.3.2. Exploitation (bubble-net attack).
Two mathematical models exist for humpback whale bubble-net behavior:
- The shrinking encircling mechanism: To activate the shrinking encircling mechanism, we must lower the value of a in Eq (16). It is important to note that the parameter a has a significant impact on the change in the range of A. During iterations, a parameter declines between zero and two, and A is a random number between -a and a. By picking random values for A between one and negative one, the updated search agent position can be anywhere among the primary agent positions and the best agent positions.
- The spiral updating position: This technique is used to calculate the distance between the X* and Y* coordinates of the prey and the X and Y coordinates of the whale. To imitate a humpback whale’s helical motion, spiral equations are expressed for the prey and whale’s positions:
where the constant b represents the spiral-shaped route path and L represents a number between negative one and one, which is chosen at random. Depending on Eq (20), the WOA chooses either the spiral-shaped or the encirclement mechanism to move the whales and each mechanism has a probability of 50%. The P parameter is assigned a random number between one and zero.
4.3.3. Exploration (search for prey).
The search behavior of humpback whales is random and is determined by the location of each individual whale relative to its neighbors. Therefore, vector A is employed with random values that are either more than one or less than one. The random movement of the whales is determined using Eqs (21) and (22).
In the above equation, Xrand represents a random population position vector. A collection of random solutions is utilized to initiate the WOA algorithm. The positions of the search agents are modified depending on the best current solution or the random selection of the search agent in each iteration. Parameter a is reduced from two to zero to enable recognition of the exploitation and exploration phases. If is less than or equal to one, the search agent is chosen at random. However, if
is more than one, the best solution is selected when the search agent’s position is modified. Based on the value of p, the algorithm chooses a circular or spiral motion.
4.4. Hybrid APSO-WOA algorithm
A hybrid APSO–WOA set is made up of independent APSO and WOA algorithms. WOA is employed for the exploration phase since its logarithmic spiral function covers more of an unclear search space. The exploration phase implies that an algorithm may attempt to provide several solutions. To solve a complicated non-linear issue, the particle position is changed to the whale position, which is identical to the particle position but is much more effective in moving the solution towards the optimal one. WOA accelerates the movement of particles toward the best value and decreases the computing time. As is known, APSO exploits the optimal solution in an unknown search space. Thus, obtaining the best feasible optimal solution to the problem, while avoiding local optima or local stagnation, is guaranteed by combining the best characteristics (exploitation with APSO and exploration with WOA). Moving towards the most optimal solutions, hybrid APSO–WOA combines the strengths of both WOA during the exploration phase and APSO during the exploitation phase.
4.5. APSO-WOA-CNN and APSO-CNN algorithms
In this study, the APSO–WOA–CNN and APSO–WOA algorithms are utilized by the parameters of a 1D convolutional neural network and identify the right hyperparameters to minimize the high effort of manually tweaking the parameters that are needed to discover the detection task that is suited to the various types of IoT network attacks. The position of the particles is used to build each layer’s parameters in the CNN. Furthermore, the position parameter components for each dimension are set. Tables 2 and 3 illustrate the particle swarm parameter setting range.
In Algorithm 1, we describe the procedure of the APSO–WOA–CNN algorithm to discover the best hyperparameters. In Algorithm 2, we describe the procedure of the APSO–CNN algorithm to discover the best hyperparameters. The position parameter of each particle correlates with the CNN network structure, and continuous iterative searches may be used to identify the best network structure parameters. In order to recognize all of the potential forms of IoT network attacks, researchers need to develop a model that has a powerful predictive analysis capacity. The loss function measures the variance between the actual and expected values. When the variance degree is at its lowest, the model performs well. The value of the cross-entropy function from the first training cycle of CNN is used as the fitness function value to evaluate particle quality and to reduce it. The softmax layer is used to determine each category’s prediction probability. Fig 2 illustrates the APSO–CNN flowchart. Fig 3 illustrates the APSO–WOA–CNN flowchart.
Algorithm 1. The APSO-WOA-CNN Algorithm to Determine the Hyperparameters.
Input: N = Total populations, d, tmax
1. Generate the position parameter depending on Table 2.
2. Generate the velocity parameter depending on Table 3.
3. While (t < tmax)
4. Calculate the fitness for each particle, identify fmin, favg, fcur.
5. Update gbestd, and pbestid.
6. X* = gbestd.
7. For each particle in APSO particles.
8. Update a, A(Eq (16)), C (Eq (17)), l.
9. If 1(p < 0.5).
10. If2 (|A|< 1).
11. Update the current particle’s position by (Eq (15)).
12. Else if2 (|A| ≥ 1).
13. Choose a random search agent .
14. Update the current particle’s position by (Eq (22)).
15. End if2.
16. Else if1 (p ≥ 0.5)
17. Update the current particle’s position by (Eq (20)).
18. End if1.
19. End for.
20. Update the value of W depending on (Eq (13)).
21. Update the velocity and position
depending on (Eq (23)) and (Eq (12)).
23. t = t + 1.
24. End while.
25. Return X*.
Algorithm 2. The APSO-CNN Algorithm to Determine the Hyperparameters.
Input: N = Total populations, d, tmax
1. Generate the position parameter depending on Table 2.
2. Generate the velocity parameter depending on Table 3.
3. While (t < tmax)
4. Calculate the fitness for each particle, identify fmin, favg, fcur.
5. Update pbestid, and gbestd.
6. Update the value of W depending on (Eq (13)).
7. Update the velocity and position
depending on (Eqs (11) and (12)).
9. t = t + 1.
10. End while.
11. Return gbestd
As illustrated in Fig 2, the APSO-CNN algorithm’s position parameters are initialized in the first phase based on Tables 2 and 3. During the first training period, the value of the cross-entropy loss function is calculated using 10 position parameters for each particle to figure out the fitness value of each particle for the current iteration. Store each particle’s minimal fitness value, the global minimum, and compute the average. The inertia weight is changed in the third stage using the Eq (13). The fourth stage involves updating the position and velocity parameters in the APSO-CNN using the Eqs (11) and (12). Increase the number of iterations by one in the fifth step. The iteration should proceed to the next step if the extreme number of iterations has not been reached. If not, the process should end by stopping the loop and putting out the fitness value with the lowest score.
As illustrated in Fig 3, the APSO-WOA-CNN algorithm’s position parameters are initialized in the first phase based on Tables 2 and 3. During the first training period, the value of the cross-entropy loss function is calculated using 10 position parameters for each particle to figure out the fitness value of each particle for the current iteration. Store each particle’s minimal fitness value, the global minimum, and compute the average. The best whale from gbest and all whale from PSO particles are determined in the second step. In the third step, update all the values of a, A, C, and l. If the p value is less than 0.5, the current particle’s position is updated using Eqn (20). otherwise, If is less than or equal to one, the search agent is chosen at random using Eq (22). However, if there is more than one, the best solution is selected when the search agent’s position is modified using Eq (15). The inertia weight is changed in the next stage using Eq (13). The next stage involves updating the position and velocity parameters in the APSO-CNN using Eqs (11) and (12). In the next step, increase the number of iterations by one. The iteration should proceed to the next step if the extreme number of iterations has not been reached. If not, the process should end by stopping the loop and putting out the fitness value with the lowest score.
5. Experiments
5.1. Hardware and software
The Python 3.7 and Keras 2.3 libraries were used to carry out all of the experiments, and the models were trained on an NVIDIA Quadro P1000 Super GPU (4 GB), which had 32 GB of RAM and an eight-core Xeon E5-2690 processor.
5.2. Simulation and discussion
In this study, the APSO–WOA–CNN and APSO–CNN algorithms’ parameter settings were configured as follows. The size of the population was 20, the maximum number of particle swarm iterations was 30, the C1 and C2 coefficient values were both 2, the maximum weight of inertia was 0.9, and the minimum weight of inertia was 0.4. As illustrated in Fig 4, the APSO–WOA–CNN algorithm’s minimal fitness value was adjusted over iterations. As illustrated in Fig 5, the APSO–CNN algorithm’s minimal fitness value was adjusted over iterations.
The best particle fitness value was achieved by the APSO–CNN algorithm at 0.1431772 and by the APSO–WOA–CNN algorithm at 0.1319339 after iterative optimization. Thus, the APSO–WOA–CNN performed better than the APSO–CNN algorithm. Based on the best particle location, each dimension’s components may be identified. Table 4 shows the CNN’s optimal hyperparameters using the APSO–CNN algorithm. Table 5 shows the CNN’s optimal hyperparameters using the APSO–WOA–CNN algorithm.
Putting in the parameters given in Tables 4 and 5, which come from the APSO–WOA–CNN and APSO–CNN algorithms, into the network structure shown in Section 3.1 increases the value of the accuracy and loss function of the validation and training datasets throughout each training cycle for both the APSO–WOA–CNN and APSO–CNN algorithms. The benefits of the proposed method are also apparent in comparison to the same four indices generated from FNN training with manually chosen parameters. Additionally, we compared the CNN’s optimal hyperparameters using the APSO–CNN algorithm and the CNN’s optimal hyperparameters using the APSO–WOA–CNN algorithm. In order to expedite the training process, an early stop mechanism was established in the network structure program. The training was halted and the best model of the network was preserved if the validation set accuracy did not increase during one training cycle.
As illustrated in Figs 6 and 7 in the training set, the value of the APSO–WOA–CNN algorithm’s cross-entropy loss was much lower than that of the FNN algorithm, but its accuracy was significantly greater. This shows that the proposed APSO–WOA–CNN algorithm had a better training effect. Similarly, as illustrated in Figs 8 and 9 in the validation set, the proposed APSO–WOA–CNN algorithm achieves higher accuracy and decreases the value of the cross-entropy loss on the validation set.
In respect of the validation set and the training set, higher accuracy and lower cross-entropy loss were attained through the APSO-CNN algorithms compared to the FNN algorithm, as illustrated in Figs 10–13. This shows that the suggested APSO-CNN algorithm has a greater training impact, demonstrating its effectiveness in training models.
In the model training, the APSO–WOA–CNN and APSO–CNN algorithms performed significantly better than the FNN algorithm with higher accuracy, and the models’ overall detection rates were also better. The APSO–WOA–CNN algorithm has higher accuracy and a smaller cross-entropy loss than the APSO-CNN algorithm, as illustrated in Figs 14–17. Thus, the APSO–WOA–CNN algorithm can detect multi-type network attacks better than APSO–CNN algorithms.
5.3. Results and performance analysis
To determine the successfulness of various classification approaches to identify network attacks, we evaluated both the APSO–WOA–CNN and APSO–CNN algorithms against SVM and FNN. Then, five evaluation indicators were used to evaluate the performance of four algorithms.
5.3.1. Classification accuracy.
(24)
where ntrue represents the number of corrected samples classified, and the total sample is represented by ntotal.
Accuracy measures the fraction of properly classified samples among all samples. In addition, a high percentage of the correct numbers must be found, which means the model is effective and dependable for IoT attack detection.
5.3.2. Kappa coefficient.
(25)
where
represents the actual quantum of samples, and
represents the predicted quantum of samples.
The kappa coefficient evaluates whether the model’s prediction outcomes and actual classification results are consistent. The values might be between negative one and one. However, in practice, the values might be between zero and one. The kappa coefficient’s accuracy can only be used to detect the correct overall network mode. Obviously, the greater the value of the kappa coefficient, the greater the consistency achieved and the more effective the model’s classification impact.
5.3.3. Average precision.
(26)
where class indicates the different types of network attacks,
is the division in the number of corrected samples and the i-th category, and
is the division of the number of error samples and i-th category.
The number of network traffic types found in each actual network traffic class is the average precision. For this study, it was necessary to detect particular network attack types, which can dictate subsequent steps. It was also necessary to determine the accuracy of the detection for each different network attack type. Due to this, the low average detection accuracy across all the categories illustrates the high identification rate of each network attack type.
5.3.4. Hamming loss.
(27)
where ntotal is the number of total samples,
is the i-th sample’s actual label, count(.) indicates the number of one, class indicates the quantum of sample categories, and
is the i-th predicted label.
Multiple classifications are a challenge that can be solved using Hamming loss. This calculates the distance between the actual and predicted label. Its values are in the range [0,1]. A value equal to one denotes that the model has the opposite outcome to what is expected, and a value equal to zero denotes that the predicted and real results are the same. For practical purposes, the model was solved to accurately predict the type of network attack. Hamming loss is the count of actual labels that do not match the predicted labels. In addition, Hamming loss may validate the model’s ability to accurately identify real network attack types. As a result, with respect to detecting network attacks, a classifier is considered to be more effective when its indication is less significant.
5.3.5. Jaccard similarity coefficient.
From the formula’s characteristics, it can be observed that when the predicted label matches the actual label, the value is one or zero. Therefore, the Jaccard similarity coefficient reflects the model’s quality.
The proposed APSO–WOA–CNN and APSO–CNN algorithms were compared to SVM and FNN using the five evaluation metrics listed above. The results of the comparison using five indicators for each algorithm are shown graphically in Fig 18. The results show that the APSO–WOA–CNN algorithm improves accuracy by 1.25%, average precision by 1%, the kappa coefficient by 11%, Hamming loss by 1.2%, and the Jaccard similarity coefficient by 2%. Compared to the APSO-CNN algorithm, the APSO-CNN algorithm has the highest performance of the algorithms. Thus, the APSO–WOA–CNN algorithm can detect multi-type network attacks better than other algorithms. Tables 6 illustrate the results of several measures of SVM, FNN, APSO-CNN, and APSO-WOA-CNN. Table 7 compares the results of the proposed model with other methods using the same datasets. Tables 6 and 7 show that the proposed model, APSO-WOA-CNN, is more accurate than other methods.
6. Discussion
In this study, we proposed a novel hybrid meta-heuristic APSO-WOA for optimization of the hyperparameters of a CNN (APSO-WOA-CNN). With the proposed APSO-WOA optimization algorithm, the hyperparameters of a 1D CNN structural network can be optimized. The APSO–WOA optimization algorithm’s fitness value is defined as the validation set’s cross-entropy loss function during CNN model training. We compare our proposed optimization algorithm with others, such as the APSO algorithm, for optimization of the hyperparameters of a convolutional neural network. The best particle fitness value was achieved by the APSO–CNN algorithm at 0.1431772 and by the APSO–WOA–CNN algorithm at 0.1319339 after iterative optimization. Thus, the APSO–WOA–CNN performed better than the APSO–CNN algorithm. We evaluated the APSO–WOA–CNN algorithm against APSO–CNN, SVM, and FNN. The results show that the APSO–WOA–CNN algorithm improves accuracy by 1.25%, average precision by 1%, the kappa coefficient by 11%, Hamming loss by 1.2%, and the Jaccard similarity coefficient by 2%, as compared to the APSO–CNN algorithm, and the APSO–CNN algorithm achieves the best performance, as compared to other algorithms.
7. Conclusions and future work
Until recently, intrusion detection systems have primarily used deep learning algorithms. A hybrid APSO–WOA–CNN algorithm was presented in this study. It detects multi-type attacks of IoT network attacks. With the proposed APSO-WOA optimization algorithm, the hyperparameters of a 1D CNN structural network can be optimized. In the first training stage of the CNN algorithm, the APSO–WOA optimization algorithm fitness value is the cross-entropy loss function value. The loss function measures the variance between the actual and expected values. When the variance degree is at its lowest, the model performs well. In the model training, the APSO–WOA–CNN algorithm had the best performance in comparison to the FNN algorithm, which used manual parameter settings. We compared our optimization algorithm to other optimization algorithms, including the APSO–CNN algorithm. The results show that the APSO–WOA–CNN algorithm improves accuracy by 1.25% and average precision by 1%, as compared to the APSO-CNN algorithm, because the APSO–CNN algorithm has the highest performance among the other algorithms. Thus, the APSO–WOA–CNN algorithm can detect multi-type network attacks better than the other algorithms.
In future work, we plan to use other optimization algorithms, such as the ant colony algorithm, genetic algorithm, artificial bee colony algorithm, Henry gas solubility algorithm, red fox, and grey wolf optimization algorithm to optimize the one-dimensional CNN’s structural parameters and to reduce the time complexity. Furthermore, more data preprocessing techniques will be included to filter and merge the network attack datasets and to choose the most effective features.
References
- 1.
<References>. World Economic Forum. Available online: https://www.weforum.org/focus/fourth-industrial-revolution (accessed on 8 July 2022).
- 2. Fallahpour A.; Wong K.Y.; Rajoo S.; Fathollahi-Fard A.M.; Antucheviciene J.; Nayeri S. An integrated approach for a sustainable supplier selection based on Industry 4.0 concept. Environ. Sci. Pollut. Res. 2021, volume, 1–19. pmid:34792774
- 3.
Patel N.A.; Parekh D.A.; Shah Y.A.; Mangrulkar R. 4S Framework: A Practical CPS Design Security Assessment & Benchmarking Framework. In Cyber Security and Digital Forensics: Challenges and Future Trends; Wiley: New York, NY, USA, 2022; pp. 163–204.
- 4. Attaran M. The internet of things: Limitless opportunities for business and society. J. Strateg. Innov. Sustain. 2017, 12, 11–29.
- 5. Ortega F.; González-Prieto Á.; Bobadilla J.; Gutiérrez A. Collaborative Filtering to Predict Sensor Array Values in Large IoT Networks. Sensors 2020, 20, 4628. pmid:32824579
- 6. Bout E.; Loscri V.; Gallais A. Evolution of IoT Security: The Era of Smart Attacks. IEEE Internet Things Mag. 2022, 5, 108–113.
- 7. Memos V.A.; Psannis K.E. NFV-Based Scheme for Effective Protection against Bot Attacks in AI-Enabled IoT. IEEE Internet Things Mag. 2022, 5, 91–95.
- 8.
Symantec Internet Security Threat Report. Available online: https://docs.broadcom.com/doc/istr-24-2019-en (accessed on 20 November 2022).
- 9. Alsheikh M.; Konieczny L.; Prater M.; Smith G.; Uludag S. The State of IoT Security: Unequivocal Appeal to Cybercriminals, Onerous to Defenders. IEEE Consum. Electron. Mag. 2021, 11, 59–68, https://doi.org/10.1109/mce.2021.3079635.
- 10.
A Perfect Storm: The Security Challenges of Coronavirus Threats and Mass Remote Working. Available online: https://blog.checkpoint.com/2020/04/07/a-perfect-storm-the-security-challenges-of-coronavirus-threats-and-mass-remoteworking/ (accessed on 30 June 2022).
- 11. Raponi S.; Sciancalepore S.; Oligeri G.; di Pietro R. Road Traffic Poisoning of Navigation Apps: Threats and Countermeasures. IEEE Secur. Priv. 2022, 20, 71–79.
- 12. Goudarzi A.; Ghayoor F.; Waseem M.; Fahad S.; Traore I. A Survey on IoT-Enabled Smart Grids: Emerging, Applications, Challenges, and Outlook. Energies 2022, 15, 6984.
- 13. Hireche R.; Mansouri H.; Pathan A.-S.K. Security and Privacy Management in Internet of Medical Things (IoMT): A Synthesis. J. Cybersecur. Priv. 2022, 2, 640–661.
- 14. Abbas G.; Mehmood A.; Carsten M.; Epiphaniou G.; Lloret J. Safety, Security and Privacy in Machine Learning Based Internet of Things. J. Sens. Actuator Netw. 2022, 11, 38.
- 15. Zhang C.; Zuo W.; Yang P.; Li Y.; Wang X. Outsourced privacy-preserving anomaly detection in time series of multi-party. China Commun. 2022, 19, 201–213.
- 16. Yin X.; Wang S.; Shahzad M.; Hu J. An IoT-Oriented Privacy-Preserving Fingerprint Authentication System. IEEE Internet Things J. 2022, 9, 11760–11771.
- 17. Zhang C.; Zhu L.; Xu C. BPAF: Blockchain-Enabled Reliable and Privacy-Preserving Authentication for Fog-Based IoT Devices. IEEE Consum. Electron. Mag. 2021, 11, 88–96.
- 18.
Hunter J.; Huber B.; Kandah F. Towards feasibility of Deep-Learning based Intrusion Detection System for IoT Embedded Devices. In Proceedings of the 2022 IEEE 19th Annual Consumer Communications & Networking Conference (CCNC), Las Vegas, NV, USA, 8–11 January 2022; pp. 947–948.
- 19. Awad M.; Fraihat S.; Salameh K.; Al Redhaei A. Examining the Suitability of NetFlow Features in Detecting IoT Network Intrusions. Sensors 2022, 22, 6164. pmid:36015924
- 20. Alani M.M.; Miri A. Towards an Explainable Universal Feature Set for IoT Intrusion Detection. Sensors 2022, 22, 5690. pmid:35957249
- 21. Al-rawashdeh M.; Keikhosrokiani P.; Belaton B.; Alawida M.; Zwiri A. IoT Adoption and Application for Smart Healthcare: A Systematic Review. Sensors 2022, 22, 5377. pmid:35891056
- 22. Breitenbacher D.; Homoliak I.; Aung Y.L.; Elovici Y.; Tippenhauer N.O. HADES-IoT: A Practical and Effective Host-Based Anomaly Detection System for IoT Devices (Extended Version). IEEE Internet Things J. 2021, 9, 9640–9658.
- 23. Dutta V.; Choraś M.; Pawlicki M.; Kozik R. A Deep Learning Ensemble for Network Anomaly and Cyber-Attack Detection. Sensors 2020, 20, 4583. pmid:32824187
- 24. Muthanna M.S.A.; Alkanhel R.; Muthanna A.; Rafiq A.; Abdullah W.A.M. Towards SDN-Enabled, Intelligent Intrusion Detection System for Internet of Things (IoT). IEEE Access 2022, 10, 22756–22768.
- 25. Gao B.; Bu B.; Zhang W.; Li X. An Intrusion Detection Method Based on Machine Learning and State Observer for Train-Ground Communication Systems. IEEE Trans. Intell. Transp. Syst. 2021, 23, 6608–6620.
- 26. Abdel-Basset M.; Moustafa N.; Hawash H.; Razzak I.; Sallam K.M.; Elkomy O.M. Federated Intrusion Detection in Blockchain-Based Smart Transportation Systems. IEEE Trans. Intell. Transp. Syst. 2021, 23, 2523–2537.
- 27.
Aribisala A.; Khan M.S.; Husari G. Feed-Forward Intrusion Detection and Classification on a Smart Grid Network. In Proceedings of the 2022 IEEE 12th Annual Computing and Communication Workshop and Conference (CCWC), Virtual, 26–29 January 2022.
- 28. Pektaş A.; Acarman T. Deep learning to detect botnet via network flow summaries. Neural Comput. Appl. 2018, 31, 8021–8033.
- 29.
Torre F.B.L.; Nõmm S.; Bahsi H. Dimensionality reduction for machine learning based IoT botnet detection. In Proceedings of the International Renewable and Sustainable Energy Conference, Rabat, Morocco, 5–8 December 2018.
- 30. Sattari F.; Farooqi A.H.; Qadir Z.; Raza B.; Nazari H.; Almutiry M. A Hybrid Deep Learning Approach for Bottleneck Detection in IoT. IEEE Access 2022, 10, 77039–77053.
- 31. Nguyen T.N.; Ngo Q.-D.; Nguyen H.-T.; Nguyen G.L. An Advanced Computing Approach for IoT-Botnet Detection in Industrial Internet of Things. IEEE Trans. Ind. Inform. 2022, 18, 8298–8306.
- 32. Jiang S.; Firouzi F.; Chakrabarty K.; Elbogen E.B. A Resilient and Hierarchical IoT-Based Solution for Stress Monitoring in Everyday Settings. IEEE Internet Things J. 2022, 9, 10224–10243.
- 33. Jamalipour A.; Murali S. A Taxonomy of Machine-Learning-Based Intrusion Detection Systems for the Internet of Things: A Survey. IEEE Internet Things J. 2021, 9, 9444–9466.
- 34. Zhou X.; Liang W.; Li W.; Yan K.; Shimizu S.; Wang K.I.-K. Hierarchical Adversarial Attacks Against Graph-Neural-Network-Based IoT Network Intrusion Detection System. IEEE Internet Things J. 2022, 9, 9310–9319.
- 35. Elsaeidy A.A.; Jamalipour A.; Munasinghe K.S. A Hybrid Deep Learning Approach for Replay and DDoS Attack Detection in a Smart City. IEEE Access 2021, 9, 154864–154875.
- 36. Huang Y.; Qiao X.; Dustdar S.; Zhang J.; Li J. Toward Decentralized and Collaborative Deep Learning Inference for Intelligent IoT Devices. IEEE Netw. 2022, 36, 59–68.
- 37. Zhang S.; Wang Z.; Zhou Z.; Wang Y.; Zhang H.; Zhang G., et al. Blockchain and Federated Deep Reinforcement Learning Based Secure Cloud-Edge-End Collaboration in Power IoT. IEEE Wirel. Commun. 2022, 29, 84–91.
- 38. Kumar P.; Gupta G.P.; Tripathi R. PEFL: Deep Privacy-Encoding-Based Federated Learning Framework for Smart Agriculture. IEEE Micro 2022, 42, 33–40.
- 39. Ahmed A. and Tjortjis C., "Machine Learning based IoT-BotNet Attack Detection Using Real-time Heterogeneous Data," 2022 International Conference on Electrical, Computer and Energy Technologies (ICECET), 2022, pp. 1–6.
- 40. Aslam M.; Ye D.; Tariq A.; Asad M.; Hanif M.; Ndzi D., et al. Adaptive Machine Learning Based Distributed Denial-of-Services Attacks Detection and Mitigation System for SDN-Enabled IoT. Sensors 2022, 22, 2697. pmid:35408312
- 41. Zeeshan M.; Riaz Q.; Bilal M.A.; Shahzad M.K.; Jabeen H.; Haider S.A., et al. Protocol-Based Deep Intrusion Detection for DoS and DDoS Attacks Using UNSW-NB15 and Bot-IoT Data-Sets. IEEE Access 2022, 10, 2269–2283.
- 42. Alothman Z.; Alkasassbeh M.; Baddar S.A.-H. An efficient approach to detect IoT botnet attacks using machine learning. J. High Speed Netw. 2020, 26, 241–254.
- 43. Popoola S.I.; Ande R.; Adebisi B.; Gui G.; Hammoudeh ; Jogunola O. Federated Deep Learning for Zero-Day Botnet Attack Detection in IoT-Edge Devices. IEEE Internet Things J. 2022, 9, 3930–3944.
- 44. Booij T.M.; Chiscop I.; Meeuwissen E.; Moustafa N.; Hartog F.T.H.D. ToN_IoT: The Role of Heterogeneity and the Need for Standardization of Features and Attack Types in IoT Network Intrusion Data Sets. IEEE Internet Things J. 2021, 9, 485–496.
- 45. Bahaa A.; Abdelaziz A.; Sayed A.; Elfangary L.; Fahmy H. Monitoring Real Time Security Attacks for IoT Systems Using DevSecOps: A Systematic Literature Review. Information 2021, 12, 154.
- 46. Huancayo Ramos K.S.; Sotelo Monge M.A.; Maestre Vidal J. Benchmark-Based Reference Model for Evaluating Botnet Detection Tools Driven by Traffic-Flow Analytics. Sensors 2020, 20, 4501. pmid:32806550
- 47. He X.; Zheng Z.; Chen C.; Zhou Y.; Luo C.; Lin Q. Distributed Evolution Strategies for Black-Box Stochastic Optimization. IEEE Trans. Parallel Distrib. Syst. 2022, 33, 3718–3731.
- 48. Qu Z.; Yuan S.; Chi R.; Chang L.; Zhao L. Genetic Optimization Method of Pantograph and Catenary Comprehensive Monitor Status Prediction Model Based on Adadelta Deep Neural Network. IEEE Access 2019, 7, 23210–23221.
- 49.
ŞEN S.Y.; ÖZKURT N. Convolutional Neural Network Hyperparameter Tuning with Adam Optimizer for ECG Classification. In Proceedings of the 2020 Innovations in Intelligent Systems and Applications Conference (ASYU), Istanbul, Turkey, 15–17 October 2020.
- 50. Yan Z., Liu X., Ji W., Liu Y., Han G. and Xie Y. "Stacked Autoencoders-Based Localization Without Ranging Over Internet of Things," in IEEE Internet of Things Journal, vol. 9, no. 10, pp. 7826–7841, 15 May15, 2022.
- 51. Ahn S.; Kim J.; Park S.Y.; Cho S. Explaining Deep Learning-Based Traffic Classification Using a Genetic Algorithm. IEEE Access 2020, 9, 4738–4751.
- 52. Ullah A.; Javaid N.; Asif M.; Javed M.U.; Yahaya A.S. AlexNet, AdaBoost and Artificial Bee Colony Based Hybrid Model for Electricity Theft Detection in Smart Grids. IEEE Access 2022, 10, 18681–18694.
- 53. Keohane I.; White S. Chimney Identification Tool for Automated Detection of Hydrothermal Chimneys from High-Resolution Bathymetry Using Machine Learning. Geosciences 2022, 12, 176.
- 54. Mirjalili S.; Lewis A. The whale optimization algorithm. Adv. Eng. Softw. 2016, 95, 51–67.
- 55.
Eberhart R.; Kennedy J. A New Optimizer Using Particle Swarm Theory. In Proceedings of the Sixth International Symposium on Micro Machine and Human Science, Nagoya, Japan, 4–6 October 1995; pp. 39–43.
- 56. Kan X.; Fan Y.; Fang Z.; Cao L.; Xiong N.N.; Yang D., et al. A novel IoT network intrusion detection approach based on Adaptive Particle Swarm Optimization Convolutional Neural Network. Inf. Sci. 2021, 568, 147–162.
- 57. Ferrag M.; Shu L.; Djallel H.; Choo K.-K. Deep Learning-Based Intrusion Detection for Distributed Denial of Service Attack in Agriculture 4.0. Electronics 2021, 10, 1257.
- 58. Thapa N.; Liu Z.; Shaver A.; Esterline A.; Gokaraju B.; Roy K. Secure Cyber Defense: An Analysis of Network Intrusion-Based Dataset CCD-IDSv1 with Machine Learning and Deep Learning Models. Electronics 2021, 10, 1747.
- 59. Ahmed N.; bin Ngadi A.; Sharif J.M.; Hussain S.; Uddin M.; Rathore M.S., et al. Network Threat Detection Using Machine/Deep Learning in SDN-Based Platforms: A Comprehensive Analysis of State-of-the-Art Solutions, Discussion, Challenges, and Future Research Direction. Sensors 2022, 22, 7896. pmid:36298244
- 60. Abdelmoumin G.; Rawat D.B.; Rahman A. On the Performance of Machine Learning Models for Anomaly-Based Intelligent Intrusion Detection Systems for the Internet of Things. IEEE Internet Things J. 2022, 9, 4280–4290.
- 61. Lin W.-H.; Wang P.; Chao K.-M.; Lin H.-C.; Yang Z.-Y.; Lai Y.-H. Deep-Learning Model Selection and Parameter Estimation from a Wind Power Farm in Taiwan. Appl. Sci. 2022, 12, 7067.
- 62. Gonçalves C.B.; Souza J.R.; Fernandes H. CNN architecture optimization using bio-inspired algorithms for breast cancer detection in infrared images. Comput. Biol. Med. 2022, 142, 105205. pmid:35065408
- 63. Lokku Gurukumar, Harinatha Reddy G., Giri Prasad M.N., OPFaceNet: OPtimized Face Recognition Network for noise and occlusion affected face images using Hyperparameters tuned Convolutional Neural Network, Applied Soft Computing, Volume 117,2022,108365, ISSN 1568-4946.
- 64. Lee W.Y.; Park S.; Sim K.B. Optimal hyperparameter tuning of convolutional neural networks based on the parameter-setting-free harmony search algorithm. Int. J. Light Electron. Opt. 2018, 172, 359–367.
- 65. Wu J.; Chen X.Y.; Zhang H.; Xiong L.D.; Lei H.; Deng S.H. Hyperparameter optimization for machine learning models based on Bayesian optimization. J. Electron. Sci. Technol. 2019, 17, 26–40.
- 66. Amirabadi M.A.; Kahaei M.H.; Nezamalhosseini S.A. Novel suboptimal approaches for hyperparameter tuning of deep neural network. Phys. Commun. 2020, 41, 101057.
- 67. Lokku G.; Reddy G.H.; Prasad M.G. OPFaceNet: Optimized Face Recognition Network for noise and occlusion affected face images using Hyperparameters tuned Convolutional Neural Network. Appl. Soft Comput. 2022, 117, 108365.
- 68. Elmasry W.; Akbulut A.; Zaim A.H. Evolving deep learning architectures for network intrusion detection using a double PSO metaheuristic. Comput. Netw. 2020, 168, 107042.
- 69. Sakr M.M.; Tawfeeq M.A.; El-Sisi A.B. Network Intrusion Detection System based PSO-SVM for Cloud Computing. Int. J. Comput. Netw. Inf. Secur. 2019, 11, 22–29.
- 70. Alharbi A.; Alosaimi W.; Alyami H.; Rauf H.; Damaševičius R. Botnet Attack Detection Using Local Global Best Bat Algorithm for Industrial Internet of Things. Electronics 2021, 10, 1341.
- 71. Nematzadeh S.; Kiani F.; Torkamanian-Afshar M.; Aydin N. Tuning hyperparameters of machine learning algorithms and deep neural networks using metaheuristics: A bioinformatics study on biomedical and biological cases. Comput. Biol. Chem. 2021, 97, 107619. pmid:35033837
- 72. Brodzicki A.; Piekarski M.; Jaworek-Korjakowska J. The Whale Optimization Algorithm Approach for Deep Neural Networks. Sensors 2021, 21, 8003. pmid:34884004
- 73. Ali M.H.; Jaber M.M.; Abd S.K.; Rehman A.; Awan M.J.; Damaševičius R., et al. Threat Analysis and Distributed Denial of Service (DDoS) Attack Recognition in the Internet of Things (IoT). Electronics 2022, 11, 494.
- 74. Alzaqebah A.; Aljarah I.; Al-Kadi O.; Damaševiˇcius R. A Modified Grey Wolf Optimization Algorithm for an Intrusion Detection System. Mathematics 2022, 10, 999.
- 75.
Vartouni A.M., Kashi S.S., Teshnehlab M. An anomaly detection method to detect web attacks using stacked auto-encoder. In: 2018 6th Iranian Joint Congress on Fuzzy and Intelligent Systems (CFIS). 2018, IEEE, pp. 131–134.
- 76. Abbasi Fereshteh, Naderan Marjan, Seyed Enayatallah Alavi. Intrusion Detection in IoT With Logistic Regression and Artificial Neural Network: Further Investigations on N-BaIoT Dataset Devices, Journal of Computing and Security,2021.
- 77. Gonzalo De La Torre Parra, Paul Rad, Kim-Kwang Raymond Choo, Nicole Beebe. Detecting Internet of Things attacks using distributed deep learning, Journal of Network and Computer Applications, Volume 163, 2020.
- 78. Bohadana M.; Meidan Y.; Mathov Y.; Shabtai A.; Mirsky Y.; Breitenbacher D. N-BaIoT: network-based detection of IoT botnet attacks using deep autoencoders. IEEE Pervasive Comput. 2018, 17, 12–22.
- 79. Masoudi-Sobhanzadeh Y.; Emami-Moghaddam S. A real-time IoT-based botnet detection method using a novel two-step feature selection technique and the support vector machine classifier. Comput. Netw. 2022, 217, 109365.
- 80. Hsieh T.-H.; Chou C.-L.; Lan Y.-P.; Ting P.-H.; Lin C.-T. Fast and Robust Infrared Image Small Target Detection Based on the Convolution of Layered Gradient Kernel. IEEE Access 2021, 9, 94889–94900.
- 81. Hinton G.E., Srivastava N., Krizhevsky A., Sutskever I., Salakhutdinov R.R. Improving neural networks by preventing co-adaptation of feature detectors, Computer Science 3 (4) (2012).