TARU PUBLICATIONS
Journal of Information and Optimization Sciences cover

Journal of Information and Optimization Sciences

(Since 1980)
Open Access ·Peer-reviewed·ISSN (Online): 2169-0103·ISSN (Print): 0252-2667

WoS  JIF 2026 : 0.4 (Q4)

Powered by:Powered by

Monthly Journal: Publishes theoretical and applied research on topics in information and optimization sciences.

Issues up to 2022 co-published with and available at:Taylor & Francis
submissions@tarupublications.com
Taru Online First Current IssueSpecial IssuesBrowse all Issues
Journal of Information and Optimization Sciences
Open Access Research Article

A novel DDoS detection framework leveraging hybrid binary grey wolf optimization and explainable AI

* ,

* Corresponding author · click or hover a name for details

pp. 563–578Vol. 46Issue 2March 2025DOI: 10.47974/JIOS-1960XML
Received:
06 Nov 2024
Published Online:
17 Mar 2025
Article type:
Research Article
Language:
EN
Article no.:
JIOS-1960
Pages:
563–578

Abstract

As the number of devices connected are more in the Internet of Things (IoT), these devices create different data sharing, which leads to security and privacy issues. Current IoT cybersecurity solutions often lack accuracy, learning difficulties, and inaccurate costs. A novel DDoS attack detection framework is proposed based on hybrid binary grey wolf optimization (BGWO) metaheuristic algorithm and SHAP to solve these problems. A hybrid model of SHAP-BGWO is proposed to optimize feature selection. Machine learning tree classifiers are used to evaluate the performance on BoT-IoT dataset. The results of the above data, including accuracy, demonstrate the effectiveness of our SHAP-BGWO based framework in predicting DDoS attacks on IoT systems, providing solutions to improve IoT security. SHAP is combined with BGWO to achieve 99+% accuracy using AdaBoost, Random Forest and decision tree respectively.

Keywords

SHAPBGWOSMOTEDDoSRandom forestDecision treeMathews correlation coefficient

Subject Classifications

68T0592B20

References

[1] S. Fraihat, S. Makhadmeh, M. Awad, M. A. Al-Betar, and A. Al-Redhaei, “Intrusion detection system for large-scale IoT NetFlow networks using machine learning with modified Arithmetic Optimization Algorithm,” Internet Things, vol. 22, p. 100819 (2023).
[2] A. Almomani, M. Alweshah, S. Al Khalayleh, M. Al-Refai, and R. Qashi, “Metaheuristic algorithms-based feature selection approach for intrusion detection,” ResearchGate (2019). [Online]. Available: https://www.researchgate.net/publication/331182093. [Accessed: Mar. 11, 2025].
[3] S. Nandy, M. Adhikari, M. A. Khan, V. G. Menon, and S. Verma, “An intrusion detection mechanism for secured IoMT framework based on swarm-neural network,” IEEE J. Biomed. Health Informatics, vol. 26, no. 5, pp. 1969–1976, May (2022). doi: 10.1109/JBHI.2021.3101686.
[4] H. Liu and B. Lang, “Machine learning and deep learning methods for intrusion detection systems: A survey,” Appl. Sci., vol. 9, no. 20, p. 4396 (2019). doi: 10.3390/app9204396.
[5] S. Kumar, S. V. N. Selvi, and A. Kannan, “A comprehensive survey on machine learning-based intrusion detection systems for secure communication in the internet of things,” Comput. Intell. Neurosci., vol. 2023, p. 8981988 (2023).
[6] M. Usman, M. A. Jan, X. He, and J. Chen, “P2DCA: A privacy-preserving-based data collection and analysis framework for IoMT applications,” IEEE J. Sel. Areas Commun., vol. 37, no. 6, pp. 1222–1230, Jun. (2019). doi: 10.1109/JSAC.2019.290434.
[7] J. J. Kponyo, J. O. Agyemang, G. S. Klogo, and J. O. Boateng, “Lightweight and host-based denial of service (DoS) detection and defense mechanism for resource-constrained IoT devices,” Internet Things, vol. 12, p. 100319 (2020).
[8] A. Awajan, “A novel deep learning-based intrusion detection system for IoT networks,” Computers, vol. 12, p. 34 (2023).
[9] E. Emary, H. M. Zawbaa, and A. E. Hassanien, “Binary gray wolf optimization approaches for feature selection,” Neurocomputing (2015). doi: 10.1016/j.neucom.2015.06.083.
[10] A. K. Dey, G. P. Gupta, and S. P. Sahu, “A metaheuristic-based ensemble feature selection framework for cyber threat detection in IoT-enabled networks,” Decision Analytics Journal, vol. 7, p. 100206 (2023). doi: 10.1016/j.dajour.2023.100206.
[11] S. Ahmadi, “AI in the detection and prevention of distributed denial of service (DDoS) attacks,” Int. J. Adv. Comput. Sci. Appl., vol. 15, no. 10 (2024). doi: 10.14569/IJACSA.2024.0151004.
[12] A. K. Dey, G. P. Gupta, and S. P. Sahu, “Hybrid meta-heuristic based feature selection mechanism for cyber-attack detection in IoT-enabled networks,” Procedia Comput. Sci., vol. 218, pp. 318–327 (2023). doi: 10.1016/j.procs.2023.01.014.
[13] Y. T. Ta and G. Murtugudde, “An efficient algorithm for anomaly intrusion detection in a network,” Global Transitions Proceedings, vol. 2, pp. 255–260 (2021). doi: 10.1016/j.gltp.2021.08.066.
[14] Q. M. Alzubi, M. Anbar, Y. Sanjalawe, M. A. Al-Betar, and R. Abdullah, “Intrusion detection system based on hybridizing a modified binary grey wolf optimization and particle swarm optimization,” Expert Syst. Appl., vol. 204, p. 117597 (2022). doi: 10.1016/j.eswa.2022.117597.
[15] A. Alzaqebah, I. Aljarah, O. Al-Kadi, and R. Damaševičius, “A modified grey wolf optimization algorithm for an intrusion detection system,” Mathematics (2023). doi: 10.3390/math10060999.
[16] D. Srivastava, S. Hooda, R. Gill, and C. Singla, “Detection of cyber-attacks by using grey wolf optimizer,” in Proc. 2023 Int. Conf. Intelligent Systems for Communication, IoT and Security (ICISCoIS), Coimbatore, India, pp. 596–600 (2003). doi: 10.1109/ICISCoIS56541.2023.10100556.
[17] H. Yang and Z. Zhou, “A novel intrusion detection scheme using cloud grey wolf optimizer,” in Proc. 37th Chinese Control Conf. (CCC), Wuhan, China, pp. 8297–8302 (2018). doi: 10.23919/ChiCC.2018.8483324.
[18] J. K. Seth and S. Chandra, “Intrusion detection based on key feature selection using binary GWO,” in Proc. 3rd Int. Conf. Computing for Sustainable Global Development (INDIACom), New Delhi, India, pp. 3735–3740 (2016).
[19] H. Almazini and K. Ku-Mahamud, “Heuristic initialization using grey wolf optimizer algorithm for feature selection in intrusion detection,” Int. J. Intell. Eng. Syst., vol. 16 (2023). doi: 10.22266/ijies2023.0228.36.
[20] J. W. Too, A. R. Abdullah, N. M. Saad, N. M. Ali, and W. Tee, “A new competitive binary grey wolf optimizer to solve the feature selection problem in EMG signals classification,” Computers, vol. 7, no. 4, p. 58 (2018). doi: 10.3390/computers7040058.
[21] H. Almazini and K. Ku-Mahamud, “Grey wolf optimization parameter control for feature selection in anomaly detection,” Int. J. Intell. Eng. Syst., vol. 14 (2021). doi: 10.22266/ijies2021.0430.43.
[22] R. Hireche, H. Mansouri, and A.-S. K. Pathan, “Security and privacy management in Internet of Medical Things (IoMT): A synthesis,” J. Cybersecur. Priv., vol. 2, pp. 640–661 (2022). doi: 10.3390/jcp2030033.
[23] I. Nur and E. Ülker, “A novel hybrid IoT-based IDS using binary grey wolf optimizer (BGWO) and naive Bayes (NB),” (2020). [Online]. Available: https://doi.org/10.31590/ejosat.804113.
[24] A. Chohra, P. Shirani, E. B. Karbab, and M. Debbabi, “Chameleon: Optimized feature selection using particle swarm optimization and ensemble methods for network anomaly detection,” Comput. Secur., vol. 117, p. 102684, Jun. (2022). doi: 10.1016/j.cose.2022.102684.
[25] J. Liu, D. Yang, M. Lian, and M. Li, “Research on intrusion detection based on particle swarm optimization in IoT,” IEEE Access, vol. 9, pp. 38254–38268 (2021). doi: 10.1109/ACCESS.2021.306367.
[26] X. Liu and Y. Du, “Towards effective feature selection for IoT botnet attack detection using a genetic algorithm,” Electronics, vol. 12, no. 5, p. 1260 (2023). doi: 10.3390/electronics12051260.
[27] S. M. Lundberg and S. I. Lee, “A unified approach to interpreting model predictions,” Advances in Neural Information Processing Systems, vol. 30 (2017).
[28] L. S. Shapley, “17. A value for n-person games,” in Contributions to the Theory of Games (AM-28), Volume II, Princeton University Press, pp. 307–318 (2016).
[29] S. Mirjalili, S. M. Mirjalili, and A. Lewis, “Grey wolf optimizer,” Advances in Engineering Software, vol. 69, pp. 46–61 (2014). doi: 10.1016/j.advengsoft.2013.12.007.
[30] K. M. Faraoun and A. Boukelif, “Neural networks learning improvement using the K-means clustering algorithm to detect network intrusions,” INFOCOMP J. Comput. Sci., vol. 5, no. 3, pp. 28–36 (2006). doi: 10.5281/zenodo.1059752.
[31] N. Shi, X. Liu, and Y. Guan, “Research on k-means clustering algorithm: An improved k-means clustering algorithm,” in 3rd Int. Symp. Intell. Inf. Technol. Secur. Informatics (IITSI), pp. 63–67 (2010). doi: 10.1109/IITSI.2010.74.
[32] A. Moubayed, M. Injadat, A. Shami, and H. Lutfiyya, “Student engagement level in e-learning environment: Clustering using K-means,” Am. J. Distance Educ., vol. 34, no. 02, pp. 1–20 (2020). doi: 10.31235/osf.io/ecg4x.
[33] A. Moubayed, M. Injadat, A. Shami, and H. Lutfiyya, “DNS TypoSquatting domain detection: A data analytics & machine learning-based approach,” in 2018 IEEE Glob. Commun. Conf. (GLOBECOM) (2018). doi: 10.1080/08923647.2020.1696140.
[34] N. Koroniotis, N. Moustafa, E. Sitnikova, and B. Turnbull, “Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset,” Future Gener. Comput. Syst., vol. 100, pp. 779–796 (2019).

Views: 299Downloads: 129Citations: 1