Hybrid metaheuristic-optimized deep learning framework for intelligent cyber intrusion detection

Abstract

Cyber intrusions and malicious network activities have emerged as a serious concern due to the rapid growth of digital communication and networking technologies. Detecting cyber intrusions remains a challenging task because of the complex and high-dimensional characteristics of modern network traffic. Conventional intrusion detection methods often exhibit limited capability in identifying sophisticated cyber threats. Deep learning (DL) techniques have demonstrated significant potential for learning complex network traffic patterns; however, their performance largely depends on the appropriate selection of model hyperparameters. To address this challenge, this study proposes a hybrid intrusion detection framework that integrates a feedforward Multi-Layer Perceptron (MLP) classifier with the Harris Hawks Optimization (HHO) algorithm. The proposed hybrid framework combines nonlinear feature learning with metaheuristic-driven hyperparameter optimization, where HHO automatically determines the optimal configuration of five MLP hyperparameters: learning rate, number of hidden layers, number of neurons per layer, batch size, and dropout rate. The optimization uses a fitness function that simultaneously maximizes classification accuracy and minimizes the False Positive Rate (FPR). This integrated optimization strategy improves the convergence, generalization capability, and overall detection performance of the proposed MLP classifier. The effectiveness of the proposed framework is validated using multiple benchmark intrusion detection datasets. Experimental evaluation on the CICIDS2017, UNSW-NB15, NSL-KDD, and Bot-IoT benchmark datasets demonstrates that the proposed framework achieves classification accuracies of 98.63%, 96.41%, 97.02%, and 98.01%, respectively. Compared with the strongest baseline deep learning model (LSTM), the proposed framework improves classification accuracy by up to 1.09% while consistently reducing the False Positive Rate, demonstrating its effectiveness for reliable cyber intrusion detection.