An ensemble system for machine learning IoT intrusion detection based on enhanced artificial hummingbird algorithm

The Internet of Things (IoT) technology has led to the development of intelligent hardware devices that can interact with each other through the internet, enabling the interconnection of everything. However, this interconnectivity also increases vulnerability to illegal operations by attackers. Therefore, ensuring the security of the IoT system is critical. In this paper, we present an efficient intrusion detection ensemble system for IoT security using metaheuristic (MH) optimization algorithm and machine learning. The system comprises data preprocessing, feature selection, and ensemble classification. Firstly, we propose an enhanced variant of the artificial hummingbird algorithm (EAHA) with three key improvements over the original AHA. The hunger weight is introduced into AHA’s guided foraging behavior to better balance exploration and exploitation. Second, alternating and cooperative foraging strategy is applied in territorial foraging behavior to improve exploitation ability and prevent the algorithm from getting trapped in local optima. Finally, we incorporate greedy Cauchy mutation, using the hummingbirds’ position information as the mutation operator to further strengthen the global search capability of the algorithm. The algorithm is tested on 10 classical benchmark functions and statistically analyzed to demonstrate the feasibility of the improvement. Furthermore, we implement a binary variant of the EAHA (BEAHA) for feature selection. The BEAHA is combined with machine learning classifiers to determine the most optimal feature set. To improve the performance of the proposed network intrusion detection system (NIDS), we construct an ensemble model based on multiple classifiers. We evaluate the feature selection ability of BEAHA and the performance of the developed system using three intrusion detection datasets NSL-KDD, CIC-IDS2017, and CSE-CIC-IDS2018. The experimental results demonstrate that BEAHA selects an average of 7.29, 9.03, and 4.22 features for fitness function evaluation using three classifiers on three datasets, achieving average accuracies of 99.74%, 99.59%, and 98.51%, respectively. By optimizing the ensemble system for intrusion detection with BEAHA, we reduce the number of features by at least 69% on all datasets while maintaining or surpassing the classification accuracy achieved with the full feature set. These results highlight the competitiveness and efficiency of the proposed method.