DMSALA: A Dynamic Multi-Subpopulation Artificial Lemming Algorithm for Feature Selection in IoT Intrusion Detection

1  Introduction

The Internet of Things (IoT) drives digital transformation through widespread sensor deployment, enabling comprehensive perception and intelligent processing. However, due to open interconnection and resource-constrained heterogeneous devices, IoT systems face a broader attack surface than traditional networks, making them difficult to secure through single preventive mechanisms [1]. Consequently, Intrusion Detection Systems (IDS) are essential for continuously monitoring network traffic to identify potential attacks and ensure overall IoT security [2].

Extensive research has explored machine learning-based IDS for IoT environments. Adewole et al. evaluated various ensemble learning models to construct a supervised framework for IoT network attack detection [3]. Eid et al. optimized several classical models with data preprocessing and class balancing strategies to counter typical DDoS threats in the Industrial IoT (IIoT) [4]. From an interpretability perspective, Jamshidi et al. comparatively analyzed the performance and resource overhead of different models in IoT edge gateways [5].

Deep learning methods have also been widely adopted to capture complex traffic patterns. Nandanwar and katarya proposed AttackNet, a hybrid Convolutional Neural Network (CNN)-Gated Recurrent Unit (GRU) model designed to extract spatial-temporal dependencies in IIoT scenarios [6]. To improve cross-scenario applicability, Ahmad et al. utilized deep transfer learning based on a pretrained CNN, enabling efficient generalization for unknown attacks [7]. Additionally, Abiha et al. proposed a cGAN-enhanced ensemble deep learning framework with adversarial training for resilient anomaly detection in heterogeneous IoT environments [8].

Despite these advancements, IoT traffic features are often high-dimensional and redundant. Modeling directly on such data can cause the curse of dimensionality, introduce noise, and increase deployment costs. Feature selection mitigates this by retaining the most informative subset, making the IDS more suitable for resource-constrained edge environments [9]. In this domain, Ayad et al. proposed a hybrid strategy combining correlation analysis and recursive feature elimination (RFE) to reduce inference overhead [10]. Wakili and Bakkali integrated statistical filtering, RFE, and tree-based embedding through an ensemble weighted ranking strategy [11]. For large-scale data, Wang et al. employed a multi-criteria Las Vegas Wrapper to iteratively screen optimal feature subsets [12]. In IIoT, Awotunde et al. utilized the χ2 statistic to remove redundant features before feeding the data into tree-based classifiers [13].

Metaheuristic algorithms provide another effective approach by formulating feature selection as an optimization problem to systematically explore high-dimensional spaces [14]. Gong et al. proposed HMDOA, which integrates multiple swarm algorithms (ABC, SSA, GTO) to optimize feature subsets and improve classification efficiency [15]. Abid et al. applied the grey wolf optimizer (GWO) alongside a Light Gradient Boosting Machine (LightGBM)-CNN hybrid detector to enhance IoT intrusion detection accuracy [16].

Our prior work [17–21] involves the application of metaheuristic optimization algorithms to feature selection, intrusion detection, and traffic identification in traditional network environments.

ALA is a swarm intelligence optimizer inspired by lemming behaviors, dynamically balancing exploration and exploitation via an energy factor [22]. Recent improvements to ALA include EALA, which incorporates Kent chaotic initialization and hybrid mutation for UAV path planning [23], and MsIALA, which combines cubic chaotic initialization and adaptive perturbation to accelerate convergence in complex routing environments [24].

To address feature redundancy and improve IDS efficiency in resource-constrained IoT environments, this paper proposes a Dynamic Multi-Subpopulation Artificial Lemming Algorithm (DMSALA) for feature selection. DMSALA employs an adaptive clustering-based dynamic multi-subpopulation structure to maintain population diversity, a cosine-based nonlinear weighting strategy for staged subpopulation guidance, and adaptive Gaussian perturbation to enhance local exploitation. Additionally, a Sigmoid function maps the continuous solution space into a binary space, yielding a compact and discriminative feature subset. Unlike operator-focused ALA variants, DMSALA innovates through a dynamic multi-subpopulation architecture that synergizes nonlinear weighting with Gaussian perturbation for superior exploration–exploitation balance.

The main contributions of this paper are summarized as follows:

(a) An adaptive clustering-based dynamic multi-subpopulation structure is proposed to reduce over-reliance on a single global optimum, thereby enhancing population diversity and mitigating premature convergence in multimodal scenarios.

(b) A DMSALA-based feature selection framework is constructed for IoT intrusion detection, effectively reducing computational costs while jointly considering classification performance and the number of selected features.

The remainder of this paper is organized as follows. Section 2 introduces the basic ALA. Section 3 details the proposed DMSALA method. Section 4 describes the IoT intrusion detection framework. Section 5 presents the experimental results and analysis. Finally, Section 6 concludes the paper and discusses future work.

2  Artificial Lemming Algorithm

ALA is a swarm intelligence method inspired by four lemming behaviors: migration, burrowing, foraging, and predator avoidance. The transition between global exploration and local exploitation is governed by a decaying energy factor E(t):

E(t)=4×arctan⁡(1−tTmax)×ln⁡(1rand).(1)

When E(t)>1, ALA performs the exploration phase. Depending on a random probability (e.g., rand<0.5), it expands the search space either through long-distance migration using Brownian motion (BM⟶) or through burrowing:

Z→i(t+1)={Z→best(t)+F×BM⟶,rand<0.5Z→i(t)+F×L×(Z→best(t)−Z→b(t)),rand>0.5(2)

where F∈{1,−1} is a directional sign, Z→best(t) is the current best individual, Z→b(t) is a randomly selected individual, and L is a cosine-based adjustment coefficient.

Conversely, when E(t)≤1, ALA enters the exploitation phase. It performs local search around the optimum via foraging (spiral wrapping) or predator avoidance (Lévy flight), dictated by another random probability (e.g., rand<0.3):

Z→i(t+1)={Z→best(t)+F×spiral×rand×Z→i(t),rand<0.3Z→best(t)+F×G×Levy(Dim)×(Z→best(t)−Z→i(t)),rand>0.3(3)

where spiral is a perturbation term for local search, G is a linearly decreasing escape coefficient, and Levy(Dim) provides random step sizes to prevent stagnation at local optima.

3  Proposed Improvement Strategies

3.1 Dynamic Multi-Subpopulation Structure

To overcome the original ALA’s premature convergence caused by over-reliance on a single global optimum, we introduce an adaptive clustering-based dynamic multi-subpopulation structure [25,26]. At iteration t, the population is partitioned into K(t) independent subpopulations Pk(t). For each Pk(t), its centroid ck(t), local optimal individual Lk(t), and the global optimum G∗(t) are defined as:

ck(t)=1|Pk(t)|∑x∈Pk(t)x,Lk(t)=arg⁡minx∈Pk(t)f(x),G∗(t)=arg⁡minx∈P(t)f(x).(4)

To avoid stagnation, a dynamic reconstruction strategy is employed (Fig. 1). Subpopulations i and j are merged to reduce search overlap if their centroids are too close, where the merge threshold is set to 0.05 times the search-space scale. Conversely, subpopulation k is split to improve local search precision if its individuals are overly dispersed, with the split threshold set to 0.15 times the search-space scale. The merge and split criteria are respectively defined as:

‖ci(t)−cj(t)‖<dmerge,maxx∈Pk(t)‖x−ck(t)‖>rsplit.(5)

Figure 1: Schematic of dynamic merging and splitting mechanisms.

3.2 Hybrid Guidance with Cosine-Based Nonlinear Weighting Strategy

Based on the dynamic multi-subpopulation structure, to achieve a phased balance that emphasizes subpopulation-level exploration in the early stage and global convergence in the later stage, a cosine-based nonlinear weighting strategy is designed.

w(t)=12(1+cos⁡(πtT)),0≤t≤T,(6)

where t is the current iteration number, and T is the maximum iteration number. This weight satisfies w(0)=1 and w(T)=0, indicating that the search prioritizes subpopulation-level guidance in early iterations and gradually shifts to global guidance as iterations proceed.

Based on this weight, a hybrid guidance vector Bi(t) is constructed for an individual xi(t) (belonging to subpopulation k(i)):

Bi(t)=w(t)Lk(i)(t)+(1−w(t))G∗(t).(7)

3.3 Adaptive Gaussian Perturbation

To mitigate the decline in exploitation capability during the later stages, an adaptive Gaussian random perturbation is introduced in the exploitation phase. It is designed to decay progressively with iterations, enhancing fine-tuning capabilities and solution stability without disrupting the convergence trend [27,28]. While converging toward the subpopulation optimum, a time-decaying Gaussian micro-perturbation is superimposed to improve final convergence accuracy. When an individual triggers exploitation behavior, the following update rule is applied:

Xi(t+1)=Xi(t)+α(t)(Lk(i)(t)−Xi(t))+εi(t),(8)

where α(t) is a contraction coefficient that increases with iterations, driving individuals to gradually approach the subpopulation optimum:

α(t)=αmin+(αmax−αmin)tT,0<αmin<αmax≤1.(9)

The perturbation term εi(t) employs zero-mean Gaussian noise, with its scale adaptively decaying over time:

εi(t)∼𝒩(0, diag(σ2(t))),σ(t)=η(t)(1−tT)(ub−lb),(10)

where η(t) is a perturbation scaling factor that can be adjusted in conjunction with stagnation detection.

3.4 Time Complexity Analysis

Time complexity is a crucial metric for evaluating algorithmic efficiency. Let N be the population size, T be the maximum number of iterations, D be the problem dimension, and K be the number of subpopulations. The maximum number of function evaluations is tmax=NT. In each generation, DMSALA primarily consists of three phases: dynamic multi-subpopulation reconstruction, position updating, and fitness evaluation.

Specifically, the reconstruction phase involves updating centroids and local optima, as well as splitting and merging subpopulations, which take O(ND+K2D) time per generation. The position updating requires a D-dimensional vector operation for N individuals, taking O(ND) time. Assuming the cost of a single function evaluation is constant, the fitness evaluation takes O(N) time per generation.

By aggregating the computational cost of these three phases over T iterations, the overall time complexity of DMSALA can be expressed as:

O(DMSALA)=O(T(ND+K2D))⏟Reconstruction+O(TND)⏟Update+O(TN)⏟Evaluation≈O(TND)=O(tmaxD).(11)

Since the number of subpopulations is typically much smaller than the population size (K≪N), the additional overhead introduced by the dynamic multi-subpopulation reconstruction is negligible. Consequently, DMSALA maintains the same dominant asymptotic time complexity as the original ALA.

3.5 Algorithm Pseudocode

Algorithm 1 outlines the main framework of DMSALA. By introducing dynamic multi-subpopulation reconstruction, hybrid guidance, and adaptive perturbation, the proposed method improves the balance between exploration and exploitation. These strategies enhance population diversity and help the algorithm avoid premature convergence.

4  Construction of the IoT Intrusion Detection Framework

Fig. 2 illustrates the proposed IoT intrusion detection framework. To tackle the high dimensionality and redundancy of IoT traffic, we design a three-phase framework: data preprocessing, feature selection, and classification. The dataset is split into training and test sets at a 4:1 ratio. Data preprocessing is performed on the training dataset, while feature selection and model training are conducted exclusively on the training set; classification and evaluation are carried out on the held-out test set.

Figure 2: Overall workflow of the proposed IoT intrusion detection framework based on DMSALA.

Raw IoT traffic is heterogeneous and noisy, causing modeling biases if used directly [29,30]. This phase standardizes the data by cleaning duplicates and missing values, applying Label Encoding to categorical data, and normalizing numerical features to eliminate dimensional discrepancies and provide a unified baseline. To prevent data leakage, all preprocessing is fitted only on the training dataset.

Redundant IoT features increase computational overhead and blur classification boundaries [31]. To address this, we utilize DMSALA as a wrapper-based feature selector. It employs a Sigmoid function to binarize continuous positions and optimizes a fitness function balancing classification error and feature count. DMSALA’s dynamic multi-subpopulation structure effectively compresses the feature space, outputting a low-redundancy, highly discriminative subset.

The original dataset is projected onto the selected feature subspace to train the classifier. Eliminating redundant noise enhances the signal-to-noise ratio, enabling the classifier to focus on the essential distribution differences between normal traffic and various attacks (e.g., DDoS, Backdoor). The finalized classifier can efficiently categorize unknown traffic and detect complex IoT attacks. Both phases adopt the same base classifier, a Decision Tree (DT) with Gini impurity, unlimited depth, and the default minimum split of 2 samples per node and 1 sample per leaf.

5  Experiments

5.1 Experimental Setup

For a fair comparison, all algorithms were implemented in Python and evaluated on a unified platform: Intel Core i5-12600KF (3.70 GHz), 32 GB RAM, Windows 11 (64-bit). In addition, all algorithms were run 30 times using the same randomly selected seeds.

Feature subset quality depends on the classification error rate and subset size. Thus, the fitness function combines them via a weighted sum:

fitness=α⋅error+β⋅|Nf|D,(12)

where error denotes the classification error rate, |Nf| is the selected feature count, D is the original dimension, and the weights are set to α=0.99 and β=0.01. This weighting scheme prioritizes classification performance while retaining a small penalty on subset size, thereby encouraging the algorithm to obtain an accurate yet compact feature subset [18–20].

To evaluate the classification performance comprehensively, four standard evaluation metrics are employed in our experiments: Accuracy, Precision, Recall, and F1-score.

5.2 Ablation Study on Improvement Strategies

Ablation experiments on CEC2017 compare three variants: ALA-C (linear weighting), ALA-CW (cosine weighting, Eq. (6)), and ALA-P (Gaussian perturbation). As shown in Fig. 3, DMSALA outperforms all variants, and ALA-CW consistently surpasses ALA-C, confirming that all strategies contribute positively and their combination is complementary.

Figure 3: Friedman rank and radar chart comparison of different DMSALA strategies on CEC2017 functions.

5.3 Experimental Results and Analysis on CEC2017 Test Functions

DMSALA is evaluated on the CEC2017 benchmark suite against fungal growth optimizer (FGO) [32], multi-subswarm cooperative particle swarm optimization (MCS-PSO) [33], projection-iterative-methods-based optimizer (PIMO) [34], grey wolf optimizer (GWO) [35], and ALA. All algorithms use 500 iterations, a population size of 30, and 30 independent runs [20,21]. As Table 1 shows, at D=50, it still obtains better Ave with low Std on several difficult functions.

To illustrate the optimization performance of DMSALA on CEC2017, Figs. 4 and 5 present the convergence curves and boxplots of six representative functions (F1, F3, F12, F19, F24, and F28) at D=50 over 30 independent runs. DMSALA converges faster and more steadily than the compared algorithms, with rapid early descent indicating efficient exploration and sustained late-stage improvement reflecting strong exploitation. The boxplots further confirm that DMSALA achieves the lowest median fitness with compact interquartile ranges, demonstrating superior convergence accuracy and stability.

Figure 4: Convergence curves of DMSALA and other algorithms on six representative CEC2017 functions (D=50).

Figure 5: Boxplots of DMSALA and other algorithms on six representative CEC2017 functions (D=50).

Fig. 6 presents the radar chart and average-rank bar chart based on Friedman tests for CEC2017. A smaller radius in Fig. 6a indicates a better rank, and DMSALA shows smaller and more stable radii on most functions. Fig. 6b further confirms that DMSALA achieves the best average rank across dimensions, especially in higher dimensions. Overall, these results demonstrate the strong optimization capability and robustness of DMSALA on CEC2017.

Figure 6: Friedman rank and radar chart comparison of DMSALA and other algorithms on CEC2017 functions.

5.4 Parameter Sensitivity Analysis

As shown in Table 2, the default setting dmerge=0.05 and rsplit=0.15 achieves the lowest Mean Rank of 3.1, indicating the best performance among all tested combinations.

5.5 Comparison with Other Metaheuristic Optimization Algorithms

The NF-ToN-IoT-v2 dataset is derived from the ToN-IoT testbed and transforms raw Packet Capture (PCAP) traffic into NetFlow records more suitable for high-throughput edge networks. It provides a unified extended feature set with 43 NetFlow features and corresponding intrusion labels,and the NF-BoT-IoT-v2 dataset is derived from the BoT-IoT dataset. Both transform raw PCAP traffic into NetFlow records, improving reproducibility [36].

Tables 3 and 4 present the binary classification results on the NF-ToN-IoT-v2 and NF-BoT-IoT-v2 datasets, respectively. DMSALA achieves the highest accuracy, precision, recall, and F1-score on both datasets, with the fewest selected features and lowest evaluation time. The Receiver Operating Characteristic (ROC) curves in Fig. 7 further confirm its superior discriminative ability.

Figure 7: ROC curves comparison of DMSALA and other algorithms.

As shown in Table 5, DMSALA achieves strong multiclass detection performance on NF-ToN-IoT-v2, with high Recall, Precision, and F1-score on most attack classes. It performs especially well on DDoS, DoS, MITM, and XSS, and attains the highest overall Accuracy of 97.235% among all methods. Moreover, DMSALA selects only 7.40 features on average, the fewest among all methods, and achieves the lowest Eval time of 0.006 s. Overall, it maintains a good balance among detection accuracy, feature reduction, and inference efficiency.

On NF-BoT-IoT-v2 (Table 6), DMSALA also achieves the highest overall Accuracy of 99.155% and the best F1-score on Reconn, DDoS, and DoS classes, while selecting only 8.35 features with competitive training and evaluation times, further confirming its robustness across IoT environments.

The Friedman average ranking results, calculated using Accuracy, Precision, Recall, and F1-score, are shown in Table 7, where DMSALA achieves the best overall rank of 1.63 among all compared algorithms. Excluding selected features, training time, and evaluation time, the Friedman test confirms that the performance differences are statistically significant, with p=4.16×10−20.

5.6 Comparison with Recent IoT Intrusion Detection Methods

To further validate the effectiveness of DMSALA, it is compared with four recent IoT intrusion detection methods. EGWO-RF enhances standard GWO with an omega wolf for binary feature selection and employs Random Forest as the classifier. SDFC is a two-layer feature selection framework combining statistical filters with Support Vector Machine (SVM)-RFE and Particle Swarm Optimization (PSO), followed by a two-stage LightGBM–eXtreme Gradient Boosting (XGBoost) classifier. DTXGRF uses a soft-voting ensemble of Decision Tree, XGBoost, and Random Forest with Mutual Information (MI)-based feature ranking. CorChi selects features via the union of Chi-square and Pearson correlation and trains a lightweight Decision Tree.

Tables 8–11 present the experimental results. On the binary NF-ToN-IoT-v2 task, DMSALA leads across all metrics with the fewest features. On the multiclass NF-ToN-IoT-v2 task, DMSALA outperforms all methods in accuracy, precision, recall, and F1-score; SDFC selects marginally fewer features but suffers from notably low classification performance. On NF-BoT-IoT-v2, DTXGRF achieves slightly higher accuracy than DMSALA in both binary and multiclass tasks, yet requires approximately three times as many features with substantially longer training and evaluation times. Overall, DMSALA offers the most favorable trade-off among detection accuracy, feature reduction, and computational efficiency.

5.7 Performance Evaluation of Feature Selection

To evaluate DMSALA’s feature selection capability, we compare the full feature set (Orig) and the subset selected by DMSALA across models regarding classification performance, time, and resource overhead. We first assess whether the subset maintains or improves detection capability after dimensionality reduction.

Fig. 8 shows that DMSALA achieves comparable or better performance on most models. In binary classification, DT, K-Nearest Neighbors (KNN), Random Forest (RF), and XGBoost yield slightly higher Accuracy, Precision, Recall, and F1-score, while LightGBM remains on par with the baseline. In multiclass classification, the DMSALA subset improves all four metrics for DT, KNN, RF, and LightGBM, with only XGBoost showing a marginal decline. Overall, DMSALA enhances detection performance on most models while maintaining high accuracy.

Figure 8: Performance comparison of DMSALA against the baseline across different machine learning models.

Table 12 shows that DMSALA generally reduces evaluation time across most models in both tasks. In binary classification, DT, KNN, RF, and XGBoost run faster with DMSALA, while LightGBM shows a slight increase. This stems from LightGBM’s leaf-wise growth, which produces deeper trees with fewer features, while its exclusive feature bundling already alleviates high-dimensional overhead, reducing the marginal gain of feature reduction. In multiclass classification, all models achieve lower evaluation time. Overall, DMSALA reduces inference cost for most models without sacrificing performance.

Table 13 shows DMSALA generally reduces model storage costs. In binary tasks, all models shrink except RF, notably KNN. In multiclass tasks, only LightGBM slightly increases. Overall, DMSALA effectively compresses models while maintaining performance.

6  Conclusions

To reduce computational overhead arising from high-dimensional IoT intrusion detection data, we propose a lightweight feature selection and detection framework based on DMSALA. Experiments show that DMSALA achieves superior convergence and stability on the CEC2017 benchmark. On NF-ToN-IoT-v2 and NF-BoT-IoT-v2, it significantly reduces dimensionality and overhead while maintaining high classification performance, demonstrating its viability for resource-constrained edge deployment.

Future work includes: (1) online feature selection and concept drift adaptation for data streams; (2) cost-sensitive or multi-objective constraints for class imbalance; (3) although real IoT deployment validation is still lacking, deploying the trained feature subset and classifier on resource-constrained edge devices such as IoT gateways and Software-Defined Networking (SDN) controllers, where feature selection is performed offline on historical traffic while online detection runs directly on lightweight edge nodes to evaluate end-to-end latency and energy efficiency in real-world environments.

Acknowledgement: The authors would like to take this opportunity to express their sincere gratitude to all those who provided valuable suggestions and support for the completion of this manuscript. The authors also acknowledge the use of GPT-5.4 (OpenAI) for language polishing during the preparation of this manuscript.

Funding Statement: The authors received no specific funding for this study.

Author Contributions: Study conception and design: Hui Xu, Ruiqi Qu; data collection: Hui Xu, Ruiqi Qu, and Xinlu Zong; analysis and interpretation of results: Hui Xu, Ruiqi Qu; draft manuscript preparation: Hui Xu, Ruiqi Qu, and Xinlu Zong. All authors reviewed and approved the final version of the manuscript.

Availability of Data and Materials: The dataset used in this study is openly accessible and reliable. The NF-ToN-IoT-v2 dataset can be obtained from the following website: https://doi.org/10.48610/38a2d07. The NF-BoT-IoT-v2 dataset can be obtained from the following website: https://doi.org/10.48610/ec73920. The CEC2017 benchmark functions can be obtained from the following website: https://github.com/P-N-Suganthan/CEC2017-BoundContrained.

Ethics Approval: Not applicable.

Conflicts of Interest: The authors declare no conflicts of interest.

References

1. Furstenau LB, Rodrigues YPR, Sott MK, Leivas P, Dohan MS, López-Robles JR, et al. Internet of Things: conceptual network structure, main challenges and future directions. Digit Commun Netw. 2023;9(3):677–87. doi:10.1016/j.dcan.2022.04.027. [Google Scholar] [CrossRef]

2. Heidari A, Ali Jabraeil Jamali M. Internet of Things intrusion detection systems: a comprehensive review and future directions. Cluster Comput. 2023;26(6):3753–80. doi:10.1007/s10586-022-03776-z. [Google Scholar] [CrossRef]

3. Adewole KS, Jacobsson A, Davidsson P. Intrusion detection framework for internet of things with rule induction for model explanation. Sensors. 2025;25(6):1845. doi:10.3390/s25061845. [Google Scholar] [CrossRef]

4. Eid AM, Soudan B, Bou Nassif A, Injadat M. Comparative study of ML models for IIoT intrusion detection: impact of data preprocessing and balancing. Neural Comput Appl. 2024;36(13):6955–72. doi:10.1007/s00521-024-09439-x. [Google Scholar] [CrossRef]

5. Jamshidi S, Nafi KW, Nikanjam A, Khomh F. Evaluating machine learning-driven intrusion detection systems in IoT: performance and energy consumption. Comput Ind Eng. 2025;204(1):111103. doi:10.1016/j.cie.2025.111103. [Google Scholar] [CrossRef]

6. Nandanwar H, Katarya R. Deep learning enabled intrusion detection system for Industrial IOT environment. Expert Syst Appl. 2024;249(11):123808. doi:10.1016/j.eswa.2024.123808. [Google Scholar] [CrossRef]

7. Ahmad B, Wu Z, Huang Y, Rehman SU. Enhancing the security in IoT and IIoT networks: an intrusion detection scheme leveraging deep transfer learning. Knowl Based Syst. 2024;305(1):112614. doi:10.1016/j.knosys.2024.112614. [Google Scholar] [CrossRef]

8. Abiha UE, Rehman A, Abbas A, Haider MA, Al-Yarimi FAM, Gul MU, et al. Improving adversarial resilience for anomaly detection in the heterogeneous Internet of Things through ensemble models. Future Gener Comput Syst. 2026;178(4):108299. doi:10.1016/j.future.2025.108299. [Google Scholar] [CrossRef]

9. Li J, Othman MS, Chen H, Yusuf LM. Optimizing IoT intrusion detection system: feature selection versus feature extraction in machine learning. J Big Data. 2024;11(1):36. doi:10.1186/s40537-024-00892-y. [Google Scholar] [CrossRef]

10. Ayad AG, Sakr NA, Hikal NA. A hybrid approach for efficient feature selection in anomaly intrusion detection for IoT networks. J Supercomput. 2024;80(19):26942–84. doi:10.1007/s11227-024-06409-x. [Google Scholar] [CrossRef]

11. Wakili A, Bakkali S. A resilient IoT intrusion detection system using hybrid feature selection and explainable ensemble learning. Results Eng. 2025;28(13):107392. doi:10.1016/j.rineng.2025.107392. [Google Scholar] [CrossRef]

12. Wang J, Xiong X, Chen G, Ouyang R, Gao Y, Alfarraj O. Multi-criteria feature selection based Intrusion detection for internet of things big data. Sensors. 2023;23(17):7434. doi:10.3390/s23177434. [Google Scholar] [CrossRef]

13. Awotunde JB, Folorunso SO, Imoize AL, Odunuga JO, Lee CC, Li CT, et al. An ensemble tree-based model for Intrusion detection in industrial internet of things networks. Appl Sci. 2023;13(4):2479. doi:10.3390/app13042479. [Google Scholar] [CrossRef]

14. Ahsan MS, Islam S, Shatabda S. A systematic review of metaheuristics-based and machine learning-driven intrusion detection systems in IoT. Swarm Evol Comput. 2025;96(22):101984. doi:10.1016/j.swevo.2025.101984. [Google Scholar] [CrossRef]

15. Gong X, Yang Y, Zhang Y, Li N, Guan Y, Jiang RK. Feature selection method for network intrusion based on hybrid meta-heuristic dynamic optimization algorithm. Comput Secur. 2025;156(10):104512. doi:10.1016/j.cose.2025.104512. [Google Scholar] [CrossRef]

16. Abid T, Ahmim A, Maazouzi F, Chefrour D, Ullah I, Ahmim M, et al. A novel IoT threat detection using GWO feature selection and CNN-enhanced LightGBM. J Cloud Comput. 2025;14(1):72. doi:10.1186/s13677-025-00785-2. [Google Scholar] [CrossRef]

17. Xu H, Przystupa K, Fang C, Marciniak A, Kochan O, Beshley M. A combination strategy of feature selection based on an integrated optimization algorithm and weighted K-nearest neighbor to improve the performance of network Intrusion detection. Electronics. 2020;9(8):1206. doi:10.3390/electronics9081206. [Google Scholar] [CrossRef]

18. Xu H, Hu Y, Cao W, Han L. An improved jump spider optimization for network traffic identification feature selection. Comput Mater Contin. 2023;76(3):3239–55. doi:10.32604/cmc.2023.039227. [Google Scholar] [CrossRef]

19. Xu H, Lu Y, Guo Q. Application of improved butterfly optimization algorithm combined with black Widow optimization in feature selection of network Intrusion detection. Electronics. 2022;11(21):3531. doi:10.3390/electronics11213531. [Google Scholar] [CrossRef]

20. Xu H, Huang W, Bai L. AI-integrated feature selection of intrusion detection for both SDN and traditional network architectures using an improved crayfish optimization algorithm. Comput Mater Contin. 2025;84(2):3053–73. doi:10.32604/cmc.2025.064930. [Google Scholar] [CrossRef]

21. Xu H, Chen J, Hu Z. Metaheuristic-driven abnormal traffic detection model for SDN based on improved tyrannosaurus optimization algorithm. Comput Mater Contin. 2025;83(3):4495–513. doi:10.32604/cmc.2025.062189. [Google Scholar] [CrossRef]

22. Xiao Y, Cui H, Abu Khurma R, Castillo PA. Artificial lemming algorithm: a novel bionic meta-heuristic technique for solving real-world engineering optimization problems. Artif Intell Rev. 2025;58(3):84. doi:10.1007/s10462-024-11023-7. [Google Scholar] [CrossRef]

23. Zhu X, Jia C, Zhao J, Xia C, Peng W, Huang J, et al. An enhanced artificial lemming algorithm and its application in UAV path planning. Biomimetics. 2025;10(6):377. doi:10.3390/biomimetics10060377. [Google Scholar] [CrossRef]

24. Xie Y, Sun Z, Sun Z, Yuan K, Sun Z, Sun Z. 3D UAV route optimization in complex environments using an enhanced artificial Lemming algorithm. Symmetry. 2025;17(6):946. doi:10.3390/sym17060946. [Google Scholar] [CrossRef]

25. Ding Z, Cao L, Chen L, Sun D, Zhang X, Tao Z. Large-scale multimodal multiobjective evolutionary optimization based on hybrid hierarchical clustering. Knowl Based Syst. 2023;266(1):110398. doi:10.1016/j.knosys.2023.110398. [Google Scholar] [CrossRef]

26. Long S, Zheng J, Deng Q, Liu Y, Zou J, Yang S. A similarity-detection-based evolutionary algorithm for large-scale multimodal multi-objective optimization. Swarm Evol Comput. 2024;87(3):101548. doi:10.1016/j.swevo.2024.101548. [Google Scholar] [CrossRef]

27. Zheng J, Yuan T, Xie W, Yang Z, Yu D. An enhanced flower Pollination algorithm with Gaussian perturbation for node location of a WSN. Sensors. 2023;23(14):6463. doi:10.3390/s23146463. [Google Scholar] [CrossRef]

28. Choi KP, Kam EHH, Tong XT, Wong WK. Appropriate noise addition to metaheuristic algorithms can enhance their performance. Sci Rep. 2023;13(1):5291. doi:10.1038/s41598-023-29618-5. [Google Scholar] [CrossRef]

29. Cao Z, Zhao Z, Shang W, Ai S, Shen S. Using the ToN-IoT dataset to develop a new intrusion detection system for industrial IoT devices. Multimed Tools Appl. 2025;84(16):16425–53. doi:10.1007/s11042-024-19695-7. [Google Scholar] [CrossRef]

30. Luo Y, Chen X, Ge N, Feng W, Lu J. Transformer-based device-type identification in heterogeneous IoT traffic. IEEE Internet Things J. 2023;10(6):5050–62. doi:10.1109/jiot.2022.3221967. [Google Scholar] [CrossRef]

31. Walling S, Lodh S. A review on feature selection techniques and its significance on IoT IDS. SN Comput Sci. 2025;6(8):935. doi:10.1007/s42979-025-04480-6. [Google Scholar] [CrossRef]

32. Abdel-Basset M, Mohamed R, Abouhawwash M. Fungal growth optimizer: a novel nature-inspired metaheuristic algorithm for stochastic optimization. Comput Meth Appl Mech Eng. 2025;437(10):117825. doi:10.1016/j.cma.2025.117825. [Google Scholar] [CrossRef]

33. Tang Y, Huang K, Tan Z, Fang M, Huang H. Multi-subswarm cooperative particle swarm optimization algorithm and its application. Inf Sci. 2024;677(1):120887. doi:10.1016/j.ins.2024.120887. [Google Scholar] [CrossRef]

34. Yu D, Ji Y, Xia Y. Projection-iterative-methods-based optimizer: a novel metaheuristic algorithm for continuous optimization problems and feature selection. Knowl Based Syst. 2025;326(2):113978. doi:10.1016/j.knosys.2025.113978. [Google Scholar] [CrossRef]

35. Mirjalili S, Mirjalili SM, Lewis A. Grey wolf optimizer. Adv Eng Softw. 2014;69:46–61. doi:10.1016/j.advengsoft.2013.12.007. [Google Scholar] [CrossRef]

36. Sarhan M, Layeghy S, Portmann M. Towards a standard feature set for network intrusion detection system datasets. Mob Netw Appl. 2022;27(1):357–70. doi:10.1007/s11036-021-01843-0. [Google Scholar] [CrossRef]