Hybrid Ant-Baby Optimizer and BiLSTM framework for high-performance IoT intrusion detection

Introduction Intrusion detection in Internet of Things networks continuously encounters issues with high-dimensional traffic data, class imbalance, and patterns of attacks. Methods This paper proposes a hybrid intrusion detection framework which combines a novel bio-inspired Ant-Baby Optimizer for feature selection with a Bidirectional Long Short-Term Memory neural network for classification. The Ant-Baby Optimizer algorithm selects small, informative subsets of features using mutual information to replace features guaranteed to be low-relevance, thereby enhancing computational efficiency and interpretability. The selected features are re-shaped into pseudo-sequential order to allow, via the Bidirectional Long Short-Term Memory, to capture temporal dependencies in both directions. Results The results on the CICIoT2023 dataset demonstrate superior detection accuracy (97.32%) balanced per-class precision, recall, and F1-scores (macro F1 = 0.9732), with an inference latency of 0.219 ms per sample and process time of over 4,500 samples per second. Discussion Experiments and verification against state-of-the-art metaheuristic and deep learning approaches support the proposed framework as effective. The interdependence of computational complexity and dataset limitation cannot be overstated. In fact, these four qualities of performance, efficiency, interpretability, and adaptiveness, when considered as one, will pave the way for the proposed framework to perform at a high level in the real-world IoT intrusion detection systems. Moreover, future works will involve cross-domain validation, attention-based mechanisms, and online learning for zero-day attack handling.