Modified artificial rabbits optimization combined with bottlenose dolphin optimizer in feature selection of network intrusion detection

Abstract

<abstract> <p>For the feature selection of network intrusion detection, the issue of numerous redundant features arises, posing challenges in enhancing detection accuracy and adversely affecting overall performance to some extent. Artificial rabbits optimization (ARO) is capable of reducing redundant features and can be applied for the feature selection of network intrusion detection. The ARO exhibits a slow iteration speed in the exploration phase of the population and is prone to an iterative stagnation condition in the exploitation phase, which hinders its ability to deliver outstanding performance in the aforementioned problems. First, to enhance the global exploration capabilities further, the thinking of ARO incorporates the mud ring feeding strategy from the bottlenose dolphin optimizer (BDO). Simultaneously, for adjusting the exploration and exploitation phases, the ARO employs an adaptive switching mechanism. Second, to avoid the original algorithm getting trapped in the local optimum during the local exploitation phase, the levy flight strategy is adopted. Lastly, the dynamic lens-imaging strategy is introduced to enhance population variety and facilitate escape from the local optimum. Then, this paper proposes a modified ARO, namely LBARO, a hybrid algorithm that combines BDO and ARO, for feature selection in the network intrusion detection model. The LBARO is first empirically evaluated to comprehensively demonstrate the superiority of the proposed algorithm, using 8 benchmark test functions and 4 UCI datasets. Subsequently, the LBARO is integrated into the feature selection process of the network intrusion detection model for classification experimental validation. This integration is validated utilizing the NSL-KDD, UNSW NB-15, and InSDN datasets, respectively. Experimental results indicate that the proposed model based on LBARO successfully reduces redundant characteristics while enhancing the classification capabilities of network intrusion detection.</p> </abstract>