Design of Network Intrusion Detection System Using Lion Optimization-Based Feature Selection with Deep Learning Model

Abstract

In the domain of network security, intrusion detection systems (IDSs) play a vital role in data security. While the utilization of the internet amongst consumers is increasing on a daily basis, the significance of security and privacy preservation of system alerts, due to malicious actions, is also increasing. IDS is a widely executed system that protects computer networks from attacks. For the identification of unknown attacks and anomalies, several Machine Learning (ML) approaches such as Neural Networks (NNs) are explored. However, in real-world applications, the classification performances of these approaches are fluctuant with distinct databases. The major reason for this drawback is the presence of some ineffective or redundant features. So, the current study proposes the Network Intrusion Detection System using a Lion Optimization Feature Selection with a Deep Learning (NIDS-LOFSDL) approach to remedy the aforementioned issue. The NIDS-LOFSDL technique follows the concept of FS with a hyperparameter-tuned DL model for the recognition of intrusions. For the purpose of FS, the NIDS-LOFSDL method uses the LOFS technique, which helps in improving the classification results. Furthermore, the attention-based bi-directional long short-term memory (ABiLSTM) system is applied for intrusion detection. In order to enhance the intrusion detection performance of the ABiLSTM algorithm, the gorilla troops optimizer (GTO) is deployed so as to perform hyperparameter tuning. Since trial-and-error manual hyperparameter tuning is a tedious process, the GTO-based hyperparameter tuning process is performed, which demonstrates the novelty of the work. In order to validate the enhanced solution of the NIDS-LOFSDL system in terms of intrusion detection, a comprehensive range of experiments was performed. The simulation values confirm the promising results of the NIDS-LOFSDL system compared to existing DL methodologies, with a maximum accuracy of 96.88% and 96.92% on UNSW-NB15 and AWID datasets, respectively.

1. Introduction

Network security is the most interesting aspect that is responsible for the emergence of internet applications. However, the number of cyberattacks has also increased on the internet in the past decade. Therefore, it is essential to develop new approaches that can effectively detect and prevent such attacks. This can be achieved by developing novel techniques for intrusion detection [1]. In order to avoid these cyberattacks, key management, access control, and intrusion detection systems (IDS) are necessary [2]. Amongst these, IDS is the most commonly used system for ensuring network security. Presently, cyberattacks pose a major issue for system and network security in the form of Denial of Service (DoS) attacks, computer viruses, and data breaches [3]. To mitigate this problem, the IDSs are frequently employed in different organizations. According to the identification techniques, these detection methods are categorized as signature-based or misuse-based NIDS and anomaly-based NIDS. The objective of the current research is to determine the anomalies by recognizing a clear abnormality between the existing actions and predetermined normal actions, utilized for representing a normal activity or normal connection [4,5]. Automatically, the anomaly-based detection techniques exhibit the ability to identify new (or 0-day) attacks, whereas the misuse-based detection systems identify only the known attacks [6].

The researchers established IDSs for various platforms depending on the security issues of diverse networks. The operations of the IDS involve data collection to analyze every potential security attack from various fields within a network or computer [7]. In recent years, intrusion detection and other security technologies, namely, firewalls, cryptography, and authentication, have significantly improved. Machine Learning (ML) is the main assistant of Artificial Intelligence (AI) technology [8]. It enables the creation of computers that can perform without precise programming. In these computers, the ML techniques can perform the execution of tasks depending on generalized data or samples. This characteristic helps these computers in improving themselves by learning from the available information [9]. The ML technique is capable of identifying unknown attacks in network traffic, thus sharing its ability to identify other types of attacks trained on rare and general types of traffic. However, the effectiveness of the ML approaches does not remain consistent when using various types of datasets, because of the presence of higher-dimensional data [10]. For instance, redundant or inefficient features can increase the computational period and reduce the identification outcome. In this context, Feature Selection (FS) is a better approach to mitigate this problem.

For intrusion detection, FS and Deep Learning (DL) techniques are applied. FS is highly needed nowadays, owing to the presence of numerous attributes of the network data, which are repetitive and unrelated. With the application of the FS technique, the detection model can focus primarily on highly useful features, reduce the dimensionality, enhance the model’s interpretability, and increase the detection accuracy. On the other hand, the DL technique can proficiently learn complex patterns and temporal dependencies from the network traffic data. The DL models can learn intricate intrusion patterns that may be challenging for traditional rule-based or statistical approaches to discern. By combining the FS’s data pre-processing capabilities with DL’s pattern recognition prowess, the network intrusion detection process can be significantly fortified. This outcome enables the timely and accurate identification of both known and novel cyber threats in the ever-evolving landscape of network security.

The current study proposes a Network Intrusion Detection System using a Lion Optimization Feature Selection with Deep Learning (NIDS-LOFSDL) model. The NIDS-LOFSDL technique uses the LOFS technique, which aids in improving the classification performance. Furthermore, the study also used the attention-based bi-directional long short-term memory (ABiLSTM) system for intrusion detection. In order to enhance the intrusion detection performances of the ABiLSTM methodology, the gorilla troops optimizer (GTO) is deployed for hyperparameter tuning. For validating the enhanced solution of the NIDS-LOFSDL technique for intrusion detection, a comprehensive range of experiments was conducted. The key contributions of the study are summarized herewith:

• A new NIDS-LOFSDL technique has been developed in this study, comprising LOFS, ABiLSTM classifier, and GTO-based parameter tuning approaches for network intrusion detection. The rationale behind combining the FS and hyperparameter-tuned DL model is to enhance the accuracy and efficiency of the intrusion detection systems;
• LOFS has been incorporated as an FS method that selects the most relevant and informative features from a dataset. This characteristic helps in improving the accuracy and interpretability of the intrusion detection models;
• The ABiLSTM network has been deployed for intrusion detection, and the model is known for its ability to capture temporal dependencies in sequential data, thus making it an appropriate choice for the detection of complex intrusion patterns in network traffic;
• To further enhance the performance of the ABiLSTM algorithm, the study used GTO for hyperparameter tuning. It intends to determine the optimal hyperparameter configuration for the ABiLSTM model to accomplish an enhanced detection performance.

2. Related Works

In the literature [11], a new anomaly-based IDS technique has been deployed for IoT networks, utilizing the DL method. In particular, a filter-based FS-DNN technique was introduced in the study, in which extremely correlated features were dropped. Additionally, this technique was tuned with several parameters and hyperparameters. Mohy-eddine et al. [12] developed an NIDS for IoT platforms by employing FS and KNN methods. The authors created the NIDS with the help of the K-NN method to enhance the IDS Detection Rate (DR) and accuracy (ACC). Also, the GA, univariate statistical test, and PCA were utilized for the FS technique individually to increase the quality of the data and select ten better effective features. In the study conducted earlier [13], a hybrid DL technique and shallow learning method were presented for identifying the intrusions in the IoT devices. In the developed method, the spider monkey optimization FS method was primarily employed to select a greater number of relevant features. Secondarily, a Siamese NN-based approach was presented for making the data highly classifiable. Syed et al. [14] suggested a new fog-cloud-based IoT-IDS that integrates a distributed process by separating the database based on the type of attacks and an FS stage on time-series IoT data. Then, a DL-Recurrent-NN (Simple RNN and BiLSTM) was used to identify the attacks.

In the literature [15], a network intrusion detection classification (NIDS-CNNLSTM) technique was presented based on DL. This technique was designed for the wireless sensing environment of the Industrial IoT (IIoT) for the efficient differentiation and detection of network traffic data, and to ensure the safety of the equipment and the functioning of the IIoT. The NIDS-CNNLSTM technique integrated the robust learning capability of LSTM-NNs in time series data, and classified and learnt the FS utilizing CNN. Further, the efficiency was also confirmed based on multi-classification and binary classification methods. Ravi et al. [16] recommended an endwise system for network attack classification and identification by DL-based recurrent approaches. This method extracts the features of v-layers present in the recurrent algorithms and uses a kernel-based PCA (KPCA)-FS technique for the detection of the optimum features. Lastly, the optimum features of the recurrent methods were incorporated, and classification was executed using an ensemble meta-classifier.

Atefinia and Ahmadi [17] introduced a multi-architectural integrated DNN technique to reduce the false positive rate of anomaly-based IDSs. This approach contains a feed-forward method, a stack of limited Boltzmann machine methods and two recurrent methods. The output weights of these methods were input into an aggregator method to generate the solution for these models. In the literature [18], the authors introduced an efficient network IDS based on Random Forest (RF) and Sparse-AE (SAE) to alleviate the issue. The extraction feature ability of the SAE and identification and classification potential of the RF were integrated to enhance the identification accuracy and performance. The SAE-RF identification technique was developed.

With an increase in network-based threats and sophisticated intrusion techniques, the requirement for highly robust and adaptive intrusion detection systems has grown exponentially. A major research gap in the field of network intrusion detection lies in the requirement for efficient models to perform FS and hyperparameter selection. Though considerable developments have been made in ML and DL models to detect intrusions, the intricate and high-dimensional nature of the network data continue to pose challenges. The existing approaches find it challenging to deal with feature redundancy, irrelevant attributes, and suboptimal hyperparameter configurations, thus resulting in low detection performance. So, it is now necessary to design new models for the effective selection of relevant features and the fine-tuning of the model hyperparameters to adapt to the dynamic and evolving nature of network threats.

3. The Proposed Model

In the current study, a novel NIDS-LOFSDL approach has been established for intrusion recognition so as to accomplish network security. The NIDS-LOFSDL technique follows the concept of FS with a hyperparameter-tuned DL algorithm for the recognition of the intrusions. The proposed model encompasses LOFS, ABiLSTM-based detection, and GTO-based hyperparameter tuning. Figure 1 exhibits the entire procedure of the NIDS-LOFSDL methodology.

3.1. Feature Selection Using the LOFS Approach

For the feature selection process, the LOFS approach is used. The LO algorithm is a population-based algorithm in which the lemurs set is mathematically modeled as follows [19].

$$X=\left[\begin{array}{llll}{l}_1^1& l_1^2& ·& l_1^d\\ l_2^1& l_2^2& ·& l_2^d\\ ⋮& ⋮& ⋮& ⋮\\ l_n^1& l_n^2& ·& l_n^d\end{array}\right],$$

(1)

where $n$ stands for the solution candidate and $d$ indicates the decision variable. $X$ shows the matrix in $n\times d$ size. Figure 2 illustrates the flowchart of the LO algorithm. The steps contained in the LOFS approach are given below.

Step 1: Define the parameter $N$ Population when ${\mathrm{M}\mathrm{a}\mathrm{x}}_{iter}$ represents the maximum iteration count. $d$ corresponds to the dimensionality of the searching region over the dataset size. In addition, $UB$ and $LB$ indicate the upper and lower boundaries of the problem, respectively.

Step 2: Produce $X$ decision parameters in the ith solution, according to Equation (2)

$$X_i^j=\left(LB+\left(U{B}_j-L{B}_j\right)\right)\times r,$$

(2)

where $r$ implies the uniformly distributed random integer $\in [0,1].$

Step 3: Inside the loop for all the iterations, evaluate the Free Risk Rate $\left(FRR\right)$, a co-efficient of LO,

$$FRR=HRR-t\times \frac{\left(HRR-LRR\right)}{{\mathrm{M}\mathrm{a}\mathrm{x}}_{iter}},$$

(3)

In Equation (3), $t$ indicates the existing iteration counter. ${\mathrm{M}\mathrm{a}\mathrm{x}}_{iter}$ shows the size of the iteration. Low-Risk Rate (LRR) and High-Risk Rate (HRR) are two constant and predefined values.

Step 4: Compute the fitness values for $x_i^j$, as given below.

$$Fit \left(x_i^j\right)=\alpha \times \left(1-Acc\right)+\beta \times \left(\frac{s}{S}\right),$$

(4)

In Equation (4),$Acc$ represents the accuracy of the subset that can be extracted by the ABiLSTM classification function in order to assess the selected subset in all the iterations. Fit $\left(x_i^j\right)$ denotes the fitness values, $s$ implies the number of features selected $\mathrm{a}\mathrm{n}\mathrm{d} S$ suggests the maximal number of features selected.

Step 5: Lemurs are categorized into two dissimilar processes to increase their fitness values. Initially, the best near lemurs $\left(bnl\right)$ are recognized, which implies the selection of the solution with a low fitness values. According to the FS objective, $bnl$ provides a better feature for the existing iteration. Then, the global best lemur $\left(gbl\right)$ is selected in the whole population, which represents the total optimum solution.

Step 6: Set the value of $r_1$, a randomly generated value, to $\in [0,1]$, and compare it with $FRR$. Later, the location is updated for the lemur, far from the risk-based position, according to Equation (5).

$$X_i^j=\left\{\begin{array}{ll}x\left(i, j\right)+|\left(x\left(i, j\right)-x\left(bnl, j\right)\right|\times \left(r_3-0.5\right)\times 2;& r_1<FRR\\ x\left(i, j\right)+|\left(x\left(i, j\right)-x\left(gbl, j\right)\right|\times \left(r_3-0.5\right)\times 2;& r_1>FRR\end{array}\right. ,$$

(5)

where $r_1$ refers to the random integer $\in [0,1]$. The present $i$th lemur of the $N$th population is $(i,j)$, i.e., the solution candidate at the $j$th dimension.

The LO process begins by arbitrarily generating a swarm of lemurs. Next, it tries to move towards the lemurs with low fitness value by dance hup. The optimization process randomly generates a group of lemurs. The $FRR$ value begins towards the LRR, thus representing that the lemur starts with the move and moves near to the $bnl$ through “dance hup”. The purpose of LO, implementing these dance hup actions, is to decrease the value of $FRR$ near to the $HRR$. Next, it exploits the leap-up action to move the lemur towards the global optimal performance. This process is repeated until the ending condition is met.

3.2. Intrusion Detection Using ABiLSTM Model

To detect the presence of the intrusions, the ABiLSTM model is applied. LSTM is a revised edition of the classical RNN that exploits the specially adapted memory units to effectively express the long-term dependency of the MTS dataset [20]. The LSTM model’s design provides an effective solution to the gradient disappearing problem on the contrary to the traditional RNN methods. According to the present input and the previous state of the hidden units, the LSTM cell learns about the existing state of the hidden unit. Nevertheless, it replaces the structure of the hidden unit with a memory cell that corresponds to the long-term dependency of the MTS signal. The LSTM model includes four controlled gates, such as one self-loop memory cell, one input, one output, and one forget, for manipulating the interaction of the data stream among different memory neurons. In the hidden layer of the LSTM model, the forget gate is used to determine the data that need to be ignored or preserved from the prior moment. Simultaneously, the entrance of the input neuron decides whether the input signal needs to be injected with the information of the memory unit. The output neuron gate decides whether the state of the memory unit should be changed or not. Consider the input $x_t$ of MTS and the dynamic output state $h_t$; the neuron state, output of HL, and gate states are calculated using the subsequent formula.

$$i_t=\sigma \left(U_i{x}_t+W_i{h}_{t-1}+b_i\right),$$

(6)

$$f_t=\sigma \left(U_f{x}_t+W_f{h}_{t-1}+b_f\right),$$

(7)

$$o_t=\sigma \left(U_o{x}_t+W_o{h}_{t-1}+b_o\right),$$

(8)

$${\tilde{\mathrm{C}}}_t=tanh\left(U_c{x}_t+W_c{h}_{t-1}+b_c\right),$$

(9)

$$c_t=f_t\odot c_{t-1}+i_t\odot {\tilde{\mathrm{C}}}_t,$$

(10)

$$h_t=o_t\odot tanh\left(c_t\right).$$

(11)

The recurrent weight matrices are represented as $W_i,$ $W_f,$ $W_o$, and $W_c$, while the weighted matrix for the input, forget, output and memory cell gates are denoted by $U_i,$ $U_f,$ $U_o$, and $U_c$, correspondingly. The gates bias is formulated by $b_i,$ $b_f,$ $b_o$, and $b_c$. The cell state of the candidate ${\tilde{\mathrm{C}}}_t$ is used to update the original memory cell state, $c_t$. At any time step, $h_t$ represents the state of HL and $o_t$ denotes the output. The symbol $\odot$ denotes the element-wise multiplication operation. $tanh$ denotes the hyperbolic tangent function and $\sigma$ shows the logistic sigmoid activation function.

The classical LSTM model may inadvertently discard the sequential information at the time of training as it processes only the input signals in one direction. Therefore, the time series data cannot be completely reviewed. In order to over this limitation, the BLSTM was developed with a bidirectional structure to capture the representation of MTS information via forward and backward directions. The BLSTM comprises two LSTM layers that are carried out in parallel but opposite directions. In the case of the reverse propagation direction, $h_{b\left(t\right)}$ represents the hidden layer, which comprises data from the future MTS values. In forward propagation, $h_{f\left(t\right)}$ denotes the data of the hidden LSTM neuron, and it retains the data from the prior sequence value. Both $h_{f\left(t\right)}$ and $h_{b\left(t\right)}$ are connected to each other for creating the final output of the BiLSTM model. The tth hidden layer of BLSTM for forward and backward states is computed using Equations (12) and (13):

$$h_{f\left(t\right)}=\psi \left(W_{fh}{x}_t+W_{bhh}{h}_{f\left(t-1\right)}+b_{fb}\right),$$

(12)

$$h_{b(t{)}^{=}}\psi \left(W_{bh}{x}_t+W_{bhh}{h}_{b\left(t+1\right)}+b_b\right).$$

(13)

In addition to these, $b_{fb}$ and $b_b$ correspond to biased data in two directions. The weight matrices $W_{fh}$ and $W_{bh}$ represent the forward and backward synapsis weight from the input to the internal unit weight. Likewise, $W_{fhh}$ and $W_{bhh}$ represent the forward and backward feedback recurrent weights.

$tanh$ indicates the activation function of the HLs $\psi$. Using this component, the output of BiLSTM $y_t$ is defined herewith.

$$y_t=\sigma \left(W_{fhy}{h}_{f\left(t\right)}+W_{bhy}{h}_{b\left(t\right)}+b_y\right),$$

(14)

In Equation (16), the forward and backward weights of the resultant layers are denoted by $W_{jhy}$ and $W_{bhy}$, correspondingly. The activation function of the resultant layer $\sigma$ is either given as a linear function or sigmoidal function. Further, $b_y$ represents the output bias.

In ABiLSTM, when the attention mechanism is utilized, it supports the model in learning by assigning various weights. For an HL $h_i$, its attention $a_i$ is expressed as in Equation (15).

$$\begin{gathered} u_i=\mathrm{t}\mathrm{a}\mathrm{n}\mathrm{h}\left(W·h_i+b\right), \\ {a}_i=\frac{e^{u_i^T·u_w}}{{\Sigma }_i{e}^{u_i^T·u_w}}, \end{gathered}$$

(15)

whereas $W$ signifies the weighted matrix, $b$ implies the bias, and $u_w$ represents the global context vector, and all three are learned in the training method.

3.3. Hyperparameter Tuning Using GTO Algorithm

Eventually, the hyperparameter values of the ABiLSTM methodology are chosen using the GTO algorithm. The GTO approach is one of the main metaheuristic optimization approaches, inspired by the intelligent behaviors of gorillas [21]. These behaviors are explained using five major operators, as follows. Two of the operators represent the exploitation stage, whereas the other three operators define the exploration stage. The three operators are sometimes described as strategies or the exploration stage, and they can be inferred from the movement to another gorilla, migration towards an unknown place, and migration towards a known place. As mentioned before, the exploitation stage uses two operators reflected by the competition for adult females, and follows the behavior of the silverback. The competition is initiated between the adult females in such a way that they follow the silverback.

Using the following equations, the three prior approaches of the exploration stage are defined.

$$GX\left(t+1\right)=\left\{\begin{array}{l}\left(UB-LB\right)\times r_1+LB\\ \left(r_2-C\right)\times X_r\left(t\right)+L\times H\\ X\left(i\right)-L\times (L\times \left(X\left(t\right)-G{X}_r\left(t\right)\right)0,\\ +r_3\times \left(X\left(t\right)-G{X}_r\left(t\right)\right))\end{array}\right.$$

(16)

$$C=F\times \left(1-\frac{it}{\mathrm{M}\mathrm{a}\mathrm{x}\mathrm{s}It}\right),$$

(17)

$$F=\mathrm{c}\mathrm{o}\mathrm{s}\left(2\times r_4\right)+1,$$

(18)

$$L=C\times l ,$$

(19)

$$H=Z\times X\left(t\right),$$

(20)

$$Z=\left[-C, C\right] ,$$

(21)

In this equation, the upper as well as lower boundaries are denoted using $UB$ and $LB$, respectively. Using $X(it+1)$, the position selected is defined in the iteration ($it$), whereas the existing location is represented as $X$ ($it$). ${\mathrm{M}\mathrm{a}\mathrm{x}}_{-}it$ is known by the maximum number of iterations. The parameter $p$ defines the probability of the migration that lies in the range of 0 to 1. Lastly, the exploration stage ends by enabling the outcome $GX\left(it\right)$ to exchange $X\left(it\right)$, and these solutions are known if the silverback arises, when $X\left(it\right)$ is greater than $GX$($it$).

Using Equations (18)–(24), the following competition strategies are defined.

$$X\left(t+1\right)=L\times M\times \left(X\left(t\right)-X_{silverback}\right)+X\left(t\right),$$

(22)

$$M={\left({\left|\frac{1}{N}\sum _{i=1}^{N}G{X}_i\left(t\right)\right|}^g\right)}^{\frac{1}{g}},$$

(23)

$$g=2^L,$$

(24)

$$GX\left(i\right)=X_{silverback}-\left(X_{silverback}\times Q-X\left(t\right)\times Q\right)\times A,$$

(25)

$$Q=2\times r_5-1,$$

(26)

$$A=\beta \times E ,$$

(27)

$$E=\left\{\begin{array}{c}{N}_1 rand\ge 0.5\\ N_2 rand<0.5\end{array}\right.,$$

(28)

The GTO approach develops the following FF to make the best classification solutions. It defines a positive integer to denote the good solution of the candidate’s performance. In this case, the reduction in the classification errors is supposed to be the FF.

$$\begin{gathered} fitness\left(x_i\right)=ClassifierErrorRate\left(x_i\right) \\ =\frac{No. of misclassified instances }{Total no. of instances}\ast 100, \end{gathered}$$

(29)

4. Results and Discussion

The proposed model was simulated in the Python 3.8.5 tool configured on a PC with specifications of i5-8600k, GeForce 1050Ti 4 GB, 16 GB RAM, 250 GB SSD, and 1 TB HDD.

The ID detection outcomes of the NIDS-LOFSDL methodology were validated using two benchmark datasets, the UNSW-NB15 [22] and AWID [23].

Table 1. Details of two datasets.

UNSW-NB15 Dataset
Class	No. of Instances
Normal	15,000
Attack	15,000
Total Instances	30,000
AWID Dataset
Class	No. of Instances
Normal	15,000
Attack	15,000
Total Instances	30,000

shows the details of both datasets.

Figure 3 establishes the classification performances of the NIDS-LOFSDL system on the UNSW-NB15 database. Figure 3a,b demonstrate the confusion matrices produced by the NIDS-LOFSDL methodology on the 60:40 TR set/TS set. The outcome values show that the NIDS-LOFSDL system detected and classified both the classes accurately. Afterwards, Figure 3c reveals the PR outcomes of the NIDS-LOFSDL method. The simulation value infers that the NIDS-LOFSDL methodology attained the maximum PR values on both the classes. However, Figure 3d demonstrates the ROC outcomes of the NIDS-LOFSDL methodology. The outcomes show that the NIDS-LOFSDL approach led to a proficient solution with better ROC values on both the classes.

Table 2. Recognition outcomes of the NIDS-LOFSDL technique applied to the UNSW-NB15 database.

Class	$\mathit{A}\mathit{c}\mathit{c}{\mathit{u}}_{\mathit{y}}$	$\mathit{P}\mathit{r}\mathit{e}{\mathit{c}}_{\mathit{n}}$	$\mathit{R}\mathit{e}\mathit{c}{\mathit{a}}_{\mathit{l}}$	$\mathit{F}{1}_{\mathit{S}\mathit{c}\mathit{o}\mathit{r}\mathit{e}}$
TR set (60%)
Normal	96.18	97.55	96.18	96.86
Attack	97.58	96.23	97.58	96.90
Average	96.88	96.89	96.88	96.88
TS set (40%)
Normal	96.08	97.54	96.08	96.81
Attack	97.59	96.15	97.59	96.86
Average	96.83	96.84	96.83	96.83

and Figure 4 highlight the recognition outcomes of the NIDS-LOFSDL system upon the UNSW-NB15 database. The outcomes indicate the proficient recognition of normal and attack instances. With the 60% TR set, the NIDS-LOFSDL technique achieved an average $acc{u}_y$ of 96.88%, a $pre{c}_n$ of 96.89%, a $rec{a}_l$ of 96.88%, and an $F_{score}$ of 96.88%. Additionally, with the 40% TS set, the NIDS-LOFSDL algorithm attained an average $acc{u}_y$ of 96.83%, a $pre{c}_n$ of 96.84%, a $rec{a}_l$ of 96.83% and an $F_{score}$ of 96.83%.

Figure 5 illustrates the training accuracy values, i.e., $TR\_acc{u}_y$ and $VL\_acc{u}_y$, attained by the NIDS-LOFSDL technique on the UNSW-NB15 dataset. $TL\_acc{u}_y$ is determined by evaluating the NIDS-LOFSDL method on the TR dataset, whereas the $VL\_acc{u}_y$ value is computed by evaluating the outcomes on a separate testing dataset. The results imply that both the $TR\_acc{u}_y$ and $VL\_acc{u}_y$ values increased with an upsurge in the number of epochs. Accordingly, the performance of the NIDS-LOFSDL system is confirmed to achieve the maximum performance on both TR and TS datasets, with an increase in the number of epochs.

In Figure 6, the $TR\_loss$ and $VR\_loss$ results of the NIDS-LOFSDL algorithm on the UNSW-NB15 dataset are revealed. The $TR\_loss$ corresponds to the error between the predictive performance and original values on the TR data. The $VR\_loss$ represents the performance evaluation of the NIDS-LOFSDL technique on individual validation data. The outcomes imply that both $TR\_loss$ and $VR\_loss$ values were reduced with an increase in the number of epochs. This scenario portrays the enhanced performance of the NIDS-LOFSDL approach and its ability to produce an accurate classification. The minimal $TR\_loss$ and $VR\_loss$ values demonstrate the enhanced performance of the NIDS-LOFSDL method in capturing the patterns and relationships.

Figure 7 illustrates the classification outcomes of the NIDS-LOFSDL algorithm on the AWID database. Figure 7a,b exhibit the confusion matrices generated by the NIDS-LOFSDL methodology upon 60:40 of the TR set/TS set. The outcomes show that the NIDS-LOFSDL system outperformed all other techniques and detected and classified both the classes accurately. Then, Figure 7c depicts the PR outcomes of the NIDS-LOFSDL approach. The simulation value shows that the NIDS-LOFSDL system reached increased PR values on both the classes. Moreover, Figure 7d shows the ROC curve of the NIDS-LOFSDL methodology. The outcome values demonstrate the superior capability of the NIDS-LOFSDL algorithm with higher ROC values on both the classes.

Table 3. Recognition outcomes of the NIDS-LOFSDL technique on the AWID dataset.

Class	$\mathit{A}\mathit{c}\mathit{c}{\mathit{u}}_{\mathit{y}}$	$\mathit{P}\mathit{r}\mathit{e}{\mathit{c}}_{\mathit{n}}$	$\mathit{R}\mathit{e}\mathit{c}{\mathit{a}}_{\mathit{l}}$	$\mathit{F}{1}_{\mathit{S}\mathit{c}\mathit{o}\mathit{r}\mathit{e}}$
TR set (60%)
Normal	97.29	96.56	97.29	96.93
Attack	96.55	97.29	96.55	96.92
Average	96.92	96.92	96.92	96.92
TS set (40%)
Normal	97.34	96.48	97.34	96.91
Attack	96.42	97.30	96.42	96.86
Average	96.88	96.89	96.88	96.88

and Figure 8 demonstrate the recognition outcomes of the NIDS-LOFSDL methodology on the AWID database. The simulation value refers to the proficient recognition of both normal and attack samples. With the 60% TR set, the NIDS-LOFSDL system attained an average $acc{u}_y$ of 96.92%, $pre{c}_n$ of 96.92%, $rec{a}_l$ of 96.92%, and an $F_{score}$ of 96.92%. Then, with the 40% TS set, the NIDS-LOFSDL methodology accomplished an average $acc{u}_y$ of 96.88%, $pre{c}_n$ of 96.89%, $rec{a}_l$ of 96.88%, and an $F_{score}$ of 96.88%.

Figure 9 illustrates the training accuracy $TR\_acc{u}_y$ and $VL\_acc{u}_y$ values accomplished by the NIDS-LOFSDL algorithm on the AWID dataset. $TL\_acc{u}_y$ is determined by evaluating the NIDS-LOFSDL methodology on the TR dataset, whereas the $VL\_acc{u}_y$ value is computed by calculating the outcome on a separate testing dataset. The outcomes show that both the $TR\_acc{u}_y$ and $VL\_acc{u}_y$ values increased with an upsurge in the number of epochs. Therefore, the performance of the NIDS-LOFSDL methodology enhances the TR and TS datasets, with an increase in the number of epochs.

In Figure 10, the $TR\_loss$ and $VR\_loss$ curves of the NIDS-LOFSDL approach on the AWID dataset are shown. $TR\_loss$ corresponds to the error between the predictive solution and the original values of the TR data. $VR\_loss$ signifies the performance outcomes of the NIDS-LOFSDL technique on individual validation data. The outcomes imply that both $TR\_loss$ and $VR\_loss$ values tend to decrease with increasing numbers of epochs. The outcomes represent the enhanced performance of the NIDS-LOFSDL technique and its capability to produce accurate classification. The decreased $TR\_loss$ and $VR\_loss$ values demonstrate the better solution of the NIDS-LOFSDL technique in terms of capturing the patterns and relationships.

To ensure better results of the NIDS-LOFSDL technique, an extensive comparative analysis was conducted and the results are shown in

Table 4. Comparative analysis outcomes of the NIDS-LOFSDL algorithm and other methods [24,25].

Methods	$\mathit{A}\mathit{c}\mathit{c}{\mathit{u}}_{\mathit{y}}$	$\mathit{P}\mathit{r}\mathit{e}{\mathit{c}}_{\mathit{n}}$	$\mathit{R}\mathit{e}\mathit{c}{\mathit{a}}_{\mathit{l}}$	$\mathit{F}{1}_{\mathit{S}\mathit{c}\mathit{o}\mathit{r}\mathit{e}}$
NIDS-LOFSDL	96.92	96.92	96.92	96.92
BBAFS-DRL	95.04	95.22	95.06	95.04
SVM	75.91	78.72	76.24	77.76
NB-Bagging	70.01	69.53	72.81	70.93
NB-Adaboost	71.34	74.44	73.13	74.07
GCNSE	80.17	80.01	81.28	80.82
CNN-Adaboost	74.16	69.28	71.53	68.16

and Figure 11 [24,25]. The simulation values state that the SVM, NB-Bagging, NB-Adaboost, GCHSE, and CNN-Adaboost approaches achieved the worst performance. However, the BBAFS-DRL approach demonstrated a considerable performance with an $acc{u}_y$ of 95.04%, $pre{c}_n$ of 95.22%, $rec{a}_l$ of 95.06%, and an $F_{score}$ of 95.04%. Nevertheless, the NIDS-LOFSDL technique outperformed all other models with a maximum $acc{u}_y$ of 96.92%, $pre{c}_n$ of 96.92%, $rec{a}_l$ of 96.92%, and an $F_{score}$ of 96.92%. These outcomes confirm the effective performance of the NIDS-LOFSDL methodology on IDS.

5. Conclusions

In the current study, a novel NIDS-LOFSDL technique has been developed for the detection of intrusions so as to accomplish network security. The NIDS-LOFSDL technique follows the concept of FS with a hyperparameter-tuned DL model for intrusion recognition. For the purpose of FS, the NIDS-LOFSDL technique uses the LOFS technique, which helps in improving the classification outcomes. Besides this, the ABiLSTM model is also executed for intrusion detection. In order to enhance the intrusion detection results of the ABiLSTM methodology, GTO is deployed for hyperparameter tuning. For validating the enhanced solution of the NIDS-LOFSDL system upon intrusion detection, a comprehensive range of experiments was conducted. The simulation values establish the promising results of the NIDS-LOFSDL system compared to the recent state-of-the-art DL approaches, with an improved accuracy of 96.88% and 96.92% on UNSW-NB15 and AWID datasets, respectively. Future research works can extend the proposed model to accommodate the dynamic and evolving nature of network threats. Besides this, continuous adaptation and learning mechanisms within the model, such as online or semi-supervised learning, can also be incorporated to enhance the capability of intrusion detection patterns proficiently. Finally, the scalability issue of the NIDS-LOFSDL technique should be resolved in order to enable it to be deployed in large-scale environments with high-speed data streams.