A Multi-Strategy Adaptive Hybrid PSO–HHO–DE Framework with Dynamic Threshold Learning for Cross-Dataset Intrusion Detection

Abstract

Machine-learning-based intrusion detection systems can be affected by redundant and irrelevant network traffic features, which increase the dimensionality of the input space and can affect detection performance and computational efficiency. Feature selection therefore plays an important role in identifying compact and informative feature subsets for intrusion detection. In this study, Particle Swarm Optimization (PSO), Harris Hawks Optimization (HHO), and Differential Evolution (DE) are integrated into a Multi-Strategy Adaptive Hybrid PSO–HHO–DE framework to combine their complementary search behaviors. The proposed framework uses population diversity and fitness stagnation to adaptively select the optimization strategy during the search process, while Dynamic Threshold Learning (DTL) is incorporated to adapt the classification decision threshold and reduce false alarm rates. The framework is evaluated using NSL-KDD, UNSW-NB15, and CICIDS2017 datasets with XGBoost and Random Forest classifiers. The reported experimental results show that the proposed framework achieves accuracies of 98.12%, 92.67%, and 99.03% on NSL-KDD, UNSW-NB15, and CICIDS2017, respectively, with corresponding false alarm rates of 2.11%, 4.83%, and 1.54%. The selected feature subsets reduce the original feature dimensions by 56.1%, 53.0%, and 61.5% for the three datasets, respectively. Statistical comparison using the Wilcoxon signed-rank test over repeated runs indicates significant performance differences between the proposed framework and the individual PSO, HHO, and DE baselines at the 0.05 significance level. The results indicate that adaptive integration of the three optimization strategies can improve detection performance while reducing the dimensionality of the feature space.