<p>To address the complex requirements of network intrusion detection in IoT environments, this study proposes a hybrid intelligent framework that integrates the Whale Optimization Algorithm (WOA) and the Grey Wolf Optimization (GWO) algorithm—referred to as WOA-GWO. This framework leverages a cooperative mechanism to balance global exploration and local exploitation capabilities. WOA’s spiral bubble-net search strategy endows the model with efficient global optimization in large-scale feature spaces, while GWO’s hunting behavior, based on a social hierarchy, enhances fine-tuned optimization in key feature regions. The complementary design of the two algorithms effectively overcomes the limitations of single-algorithm approaches, such as susceptibility to local optima and slow convergence speed. Compared with traditional models like the Long Short-Term Memory Recurrent Neural Network (LSTM-RNN) and Support Vector Machine (SVM), the proposed framework significantly improves the sensitivity and generalization ability for detecting various types of attacks through dynamic feature selection and parameter optimization. Experimental results demonstrate that the hybrid algorithm exhibits superior real-time responsiveness in binary classification tasks, thanks to its lightweight design that reduces dependency on computational resources. In multi-class attack identification scenarios, the framework mitigates feature confusion between rare attacks (e.g., user-to-root attacks) and normal traffic through adaptive feature weight allocation. This study further validates the potential of swarm intelligence algorithms in the field of IoT security, offering a novel methodological foundation for efficient threat detection in resource-constrained environments.</p>