CSO-LIDS: Cat Swarm Optimisation-Based Adaptive Feature Selection for Lightweight IoT Intrusion Detection
Saif S. Kareem, Ammar D. Jasim, Adel M. SharafIntroduction:
The rapid growth of Internet of Things (IoT) networks has significantly increased the attack surface, making the need for intrusion detection methods a priority, especially in resource-limited systems with limited computational power.
Objective:
We introduce CSO-LIDS, an intrusion detection framework that uses Cat Swarm Optimisation (CSO) to select informative network-traffic features for binary attack detection.
Methods:
CSO identifies feature subsets by combining both the seeking mode for local refinement and the tracing mode for global exploration. The selected features were tested on a knearest neighbors classifier using the CICIDS2017 dataset (80%- 20% split) for training and testing.
Results:
The optimal configuration achieved a classification accuracy of 99.88% on the test split, with 0 false negatives and 679 false positives, and an execution time of 21.74 s. The numbers used here are configuration-specific and pertain to the particular data split this work examines; we make no assumption that they remain unchanged under alternative data partitions or across independent repeated runs. Classification performance was relatively similar across the CSO configs tested overall, but execution time varied greatly between configurations.
Discussion:
The parameter study analyses whether better classification performance can generally be achieved by increasing the CSO population size or by performing more search iterations, following the experimental protocol established in this work. In this study, we present results of a binary classification on the CICIDS2017 dataset using a workstation-based implementation. Therefore, these results should not be used as an indication of the performance that would be achieved on real IoT or edge devices.
Conclusion:
CSO could be a useful feature-selection method for intrusion detection. Its generalizability and deployment efficiency require further validation using repeated independent runs, new IoT-specific datasets, external validation, and resource-constrained hardware.