Improving Intrusion Detection Systems Using the Human Evolutionary Optimization Algorithm

Mohammad   Koochaki; Amir Sahafi

Authors

Mohammad Koochaki MA, Department of Secure Telecommunications and Cryptography, ST.C., Islamic Azad University, Tehran, Iran Author https://orcid.org/0009-0004-2840-0230
Amir Sahafi Assistant Professor, Department of Computer Engineering, ST.C., Islamic Azad University, Tehran, Iran Corresponding author https://orcid.org/0000-0002-6555-670X

Keywords:

Human Evolutionary Optimization Algorithm, intrusion detection system, feature selection, hyperparameter optimization, XGBoost, NSL-KDD, CIC-IDS 2017.

Abstract

An intrusion detection system is a critical tool in network security that identifies potential threats by analyzing behavioral patterns and network traffic. Despite recent advances, challenges such as imbalanced data, high feature dimensionality, and a high false-positive alarm rate remain persistent. This study aimed to improve the performance of intrusion detection systems by using the Human Evolutionary Optimization Algorithm (HEOA) for selecting effective features and by tuning the hyperparameters of the XGBoost model through a genetic algorithm. Inspired by human behaviors, HEOA has a strong capacity for rapid convergence and avoidance of local optima. The present study was conducted on two standard datasets, NSL-KDD and CIC-IDS 2017, and the preprocessing steps included normalization, encoding, and five-fold cross-validation. The evaluation results showed that the proposed HEOA-XGBoost model achieved higher accuracy and F1-score and produced a lower false-positive rate compared with conventional methods. These findings indicate the positive effect of using HEOA in improving the efficiency of machine learning models for intrusion detection. The main innovation of this study lies in applying HEOA to optimize feature selection and using a genetic algorithm for hyperparameter tuning, which enhances the accuracy and stability of intrusion detection systems.

References

[1] M. Hosseingholipour, "Information Security Management Strategies to Counter Cyberattacks in Computer Networks," in Twenty-Fourth National Conference on Applied Research in Electrical, Computer, and Biomedical Engineering Sciences, 2025.

[2] Y. Tang, "The Application of Machine Learning in the Field of Network Security," Tcsisr, vol. 7, pp. 363-369, 2024, doi: 10.62051/cw085k64.

[3] A. L. Buczak and E. Guven, "A survey of data mining and machine learning methods for cyber security intrusion detection," IEEE Communications Surveys & Tutorials, vol. 18, no. 2, pp. 1153-1176, 2016, doi: 10.1109/COMST.2015.2494502.

[4] N. Chaabouni, M. Mosbah, A. Zemmari, C. Sauvignac, and P. Faruki, "Network intrusion detection for IoT security based on learning techniques," IEEE Communications Surveys & Tutorials, vol. 21, no. 3, pp. 2671-2701, 2019, doi: 10.1109/COMST.2019.2896380.

[5] Tafreshi, "Credit risk assessment using machine learning algorithms: Logistic regression, artificial neural network, and support vector machine," Biannual Journal of Financial Knowledge of Securities Analysis, vol. 18, no. 65, pp. 45-62, 2025.

[6] S. Kotsiantis, D. Kanellopoulos, and P. Pintelas, "Data preprocessing for supervised learning," International Journal of Computer Science, vol. 1, no. 2, pp. 111-117, 2007.

[7] M. A. Ambusaidi, X. He, P. Nanda, and Z. Tan, "Building an intrusion detection system using a filter-based feature selection algorithm," IEEE Transactions on Computers, vol. 65, no. 10, pp. 2986-2998, 2016, doi: 10.1109/TC.2016.2519914.

[8] Y. Zhou, G. Cheng, S. Jiang, and M. Dai, "Building an efficient intrusion detection system based on feature selection and ensemble classifier," Computer Networks, vol. 174, p. 107247, 2020, doi: 10.1016/j.comnet.2020.107247.

[9] C. Blum and G. R. Raidl, "Metaheuristics in combinatorial optimization: Overview and conceptual comparison," European Journal of Operational Research, vol. 285, no. 3, pp. 801-814, 2020, doi: 10.1016/j.ejor.2020.02.013.

[10] R. Marti, Handbook of Heuristics. Springer, 2021.

[11] T. Dokeroglu, E. Sevinc, T. Kucukyilmaz, and A. Cosar, "A survey on new generation metaheuristic algorithms," Computers & Industrial Engineering, vol. 137, pp. 105-127, 2022, doi: 10.1016/j.cie.2019.106040.

[12] H. Bostani and M. Sheikhan, "Hybrid of binary PSO and GA for feature selection in intrusion detection systems," Neural Computing and Applications, vol. 29, no. 11, pp. 1043-1057, 2018, doi: 10.1007/s00521-016-2558-2.

[13] A. S. Mahboob and M. R. O. Moghaddam, "An anomaly-based intrusion detection system using butterfly optimization algorithm," in 2020 6th Iranian Conference on Signal Processing and Intelligent Systems (ICSPIS), 2020, pp. 1-6, doi: 10.1109/ICSPIS51611.2020.9349537.

[14] K. Dinesh and D. Kalaivani, "Enhancing performance of intrusion detection system in the NSL-KDD dataset using meta-heuristic and machine learning algorithms-design thinking approach," in 2023 International Conference on Sustainable Computing and Smart Systems (ICSCSS), 2023, pp. 1471-1479, doi: 10.1109/ICSCSS57650.2023.10169845.

[15] E. Gyamfi and A. Jurcut, "Novel online network intrusion detection system for industrial IoT based on OI-SVDD and AS-ELM," IEEE Internet of Things Journal, vol. 9, no. 23, pp. 23934-23947, 2022, doi: 10.1109/JIOT.2022.3172393.

[16] P. K. Kurella and S. Mikkili, "A Comprehensive Review of DERMS for Smart and Secure Energy Networks: Standards, Protocols, and Security Considerations," (in English), International Journal of Ambient Energy, vol. 46, no. 1, 2025, doi: 10.1080/01430750.2025.2506703.

[17] E. Alhajjar, P. Maxwell, and N. Bastian, "Adversarial machine learning in network intrusion detection systems," Expert Systems with Applications, vol. 186, p. 115782, 2021, doi: 10.1016/j.eswa.2021.115782.

[18] O. Ibitoye, R. Abou-Khamis, M. e. Shehaby, A. Matrawy, and M. O. Shafiq, "The Threat of Adversarial Attacks Against Machine Learning in Network Security: A Survey," J. Electron. Electric. Eng., 2025, doi: 10.37256/jeee.4120255738.

[19] C. Chaccour and W. Saad, "Securing next-generation wireless networks against native GenAI attacks: An evidence-theoretic approach," in IEEE International Conference on Communications, Abu Dhabi, UAE, 2025.

[20] M. Shirvani Naghani, K. Koolivand, E. Ejabi, and M. Heidari, "Drawing Scenarios for the National Information Network of the Islamic Republic of Iran on the Horizon of 2028 with an Emphasis on Security Consequences," Majlis and Rahbord, vol. 31, no. 120, 2024. [Online]. Available: https://www.magiran.com/paper/2834591/outlining-scenarios-for-the-national-information-network-of-the-islamic-republic-of-iran-by-2028-with-emphasis-on-security-implications?lang=en.

[21] M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, "A detailed analysis of the KDD CUP 99 data set," in Proceedings of the IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA), Ottawa, ON, Canada, 2009, pp. 1-6, doi: 10.1109/CISDA.2009.5356528.