ML, DL and hybrid IDS approaches

Several IDS approaches have been developed using ML and DL algorithms. In [1], the authors proposed a Software Defined Network (SDN)-orchestrated split-learning anomaly-detection framework for CE networks in smart environments, where a 1D-CNN is deployed in the control plane. However, it achieves strong accuracy, precision, recall, and F1-score on CICIDS-2018; privacy leakage is a noted limitation. In [4], a blended CNN-LSTM framework is introduced for the consumable edge-centric Internet of Medical Things (IoMT) industry to detect new intrusions, reporting 98.53% accuracy. However, the evaluation is limited to a single dataset and does not analyze detection time. In [12], an IDS model based on a Multi-scale Deep Bidirectional Gated Recurrent Neural Network (MDBGRNN) is proposed for IoT security, with reported limitations in scalability and sensitivity to data quality. On the other hand, work in [13] presents a Feature-Importance-Refined Graph Neural Network (FIR-GNN) for Cyber-Physical Systems (CPS) smart homes, using a directed graph with edge-feature self-attention and semi-supervised learning. At the same time, SHapley Additive exPlanations (SHAP)-based feature subset selection reduces computational cost and improves accuracy, precision, recall, and F1-score.

The work in [14] proposes an intrusion detection approach based on an improved Deep Belief Network (DBN). First, the probabilistic mass function (PMF) and Min–Max methods are introduced to simplify data preprocessing. Then, a combined sparsity penalty term is incorporated into the likelihood function during the unsupervised learning phase. By imposing sparse constraints, the model encourages sparse activation of hidden-layer neurons, thereby reducing feature homogeneity and mitigating network overfitting. Experimental results show that the proposed approach achieves satisfactory performance on large-scale network datasets. However, most DBN structural parameters must be determined through extensive experimentation, and uncertainty in parameter selection may affect detection accuracy. To provide a high level of security for both satellite and terrestrial networks [15], proposes four hybrid IDS models based on ML and DL techniques. A sequential forward selection (SFS) method with Random Forest (RF)-based feature selection is used to improve classification performance and reduce execution time. The selected features are then combined with different learning models, including RF, LSTM, Artificial Neural Network (ANN), and Gated Recurrent Unit (GRU). The reported results indicate that the proposed hybrid models are more efficient than prior work.

Several intrusion detection systems have been proposed for IoT environments using advanced deep learning and data augmentation techniques. In [16], a multimodal NIDS combines transfer learning, attention-based ResNet, and CNN-LSTM architectures to learn both semantic and visual representations of network traffic, achieving high detection performance. However, the framework introduces considerable computational overhead due to complex feature extraction and multimodal processing. TIDE-Net [17] employs a two-stage deep learning architecture for IoT intrusion detection, where traffic is first classified as benign or malicious and then categorized into specific attack types using BiLSTM-based models. Although the framework achieves approximately 97% end-to-end accuracy, error propagation between stages may affect overall reliability. To address class imbalance, the PA-ACGAN-XGBoost framework [18] generates protocol-aware synthetic traffic samples and trains an XGBoost classifier for improved attack detection. While effective for minority-class recognition, the computational complexity of generative models remains a challenge for resource-constrained IoT deployments. These studies demonstrate the effectiveness of deep learning for IoT intrusion detection while highlighting the need for lightweight and computationally efficient solutions.

Explainable AI-based IDS approaches

Nowadays, explainable AI (XAI) has been in the spotlight for its ability to enhance transparency and trust in AI-driven security systems. In [5], the authors devised a security framework for innovative consumer applications by integrating blockchain-driven Authorization and Key Agreement (AKA) mechanisms with an XAI-enabled IDS. Initially, entity registration and authentication are performed within the network, and a Proof-of-Authority (PoA) blockchain consensus mechanism is used to validate and verify authenticated data. For attack detection, the framework proposes an XAI-based IDS that leverages deep reinforcement learning (DRL), incorporating an attention mechanism with a softmax activation function to focus on relevant traffic features and accurately identify malicious activities. To address the black-box nature of AI-based IDS solutions, the study uses the Python-based SHAP framework to explain and interpret the most influential features driving IDS decisions.

Federated learning-based IDS approaches

Recent studies increasingly adopt Federated Learning (FL) for intrusion detection to address privacy, scalability, and heterogeneity in IoT and consumer networks. For example, QFL-IDS [19] combines FL with quantum computing to collaboratively train a global IDS across distributed consumer devices while preserving local data privacy and improving training efficiency. Conventional FL has key limitations, including the need to enforce a shared model architecture across Non-IID heterogeneous data and the high communication overhead of weight-based aggregation. Security protections such as homomorphic encryption and differential privacy further increase computational cost and may still expose data-distribution patterns if compromised. To address these issues, PerFedHypID [20] uses a personalized federated hypernetwork that aggregates lightweight embedding vectors rather than full model weights, improving client-specific adaptation at lower communication cost. However, extreme and rapid concept drift remains challenging. Moving beyond single-view learning [21], introduces a multi-view fusion FL framework using an AE-NSVM model. In which autoencoders learn compact representations from multiple feature views and an SVM performs multi-class attack classification, improving robustness across diverse clients and motivating hierarchical client–edge–cloud deployments. The work [22] targets 6G-enabled consumer electronics networks, where intrusion detection is difficult due to highly dynamic traffic and severe class imbalance. It proposes a federated meta-learning IDS integrated with digital twins in a Meta-Verse environment to support distributed and adaptive learning. This design enables scalable, controlled experimentation and improves intrusion-detection performance under highly imbalanced, evolving attack conditions. Moreover, the work done in [23] introduces a server-side framework that defends federated learning in open-world environments by using a multi-stage process of contrastive representation learning and pseudo-labeling to filter malicious updates without requiring trusted data. The system stabilizes detection through an adaptive thresholding mechanism, relying on reputation scores and consecutive-confirmation rules to ensure reliability. However, the framework’s effectiveness is limited if attackers perform highly subtle, stealthy poisoning that blends into natural data variability.

Feature selection-based IDS approaches

Feature selection (FS) is very important for both ML and DL algorithms [24]. Although DL models can learn features automatically, applying additional feature selection can still improve accuracy because it removes irrelevant and noisy attributes, reduces redundancy among correlated features, and helps the model focus on the most discriminative patterns. Genetic and swarm-based metaheuristics (e.g., ACO, PSO, GA) are effective for feature selection because they can efficiently search very large feature spaces and identify near-optimal subsets without exhaustive evaluation [25,26]. They also capture complex, non-linear feature interactions while balancing high accuracy with fewer selected features. ACO-based intrusion detection has received less attention than other popular metaheuristics, such as swarm intelligence approaches [27,28]. One issue is that ACO can be computationally expensive to test and may not scale effectively to very high-dimensional traffic data unless the algorithm is carefully designed. Furthermore, current trends in IDS research have shifted toward XAI and FL, with less emphasis on metaheuristic feature selection. Nonetheless, ACO remains a promising solution, especially for lightweight IDS solutions that require a compact, high-impact feature set [29].

The review of the literature shows that the current research focuses on deep learning architecture, explainable AI, federated learning or feature selection separately. While CNN-LSTM and similar deep learning models have shown high performance in intrusion detection, most existing work either considers the full feature space or applies traditional feature reduction methods. Similarly, attention mechanisms, explainable AI and federated learning have been explored individually to enhance interpretability, privacy and scalability. However, the integration of ACO based feature optimization with attention enhanced spatiotemporal deep learning models has received less attention. Thus, there is a research gap in developing a unified IDS framework that simultaneously reduces feature redundancy, captures spatial and temporal traffic characteristics, and improves attack detection. To bridge this gap, this work proposes an ACO enhanced DCNN-BiLSTM framework with a temporal attention mechanism for intrusion detection.

Data preprocessing

The raw dataset contains missing values, duplicates, and noise, therefore, preprocessing the data before model training is essential. In this work, we perform data cleaning and apply label encoding and Min–Max normalization to make the data suitable for model training. Missing values are addressed by deleting records with missing labels. Duplicate records are eliminated to prevent bias in learning. In addition, noise and inconsistent values are removed to improve data quality. Following that, label encoding converts categorical attributes to numerical values by assigning a unique integer to each category, enabling the model to handle non-numeric fields. After encoding, the data is scaled using Min-Max normalization to ensure that all numeric features are within a consistent range. This avoids features with higher values from dominating the learning process, allowing the model to converge more consistently during training.

ACO feature selection

Dimensionality reduction is significant in deep learning models because it reduces the number of redundant attributes, lowering time complexity and increasing model accuracy by selecting the most important features. An overfitting problem arises during training when a large number of features are discovered. In this study, the Ant Colony Optimization Algorithm (ACO) is employed to select uncorrelated attributes. The ACO method is highly robust and performs well on complex optimization problems, and it is cutting-edge for dimension-reduction optimization problems [30]. This optimal feature subset search is an ant path through graph where the minimum number of the visited nodes is suitable with the traversal stopping criterion.

Let the preprocessed intrusion detection dataset be denoted as:

(1)

where N is the number of network traffic instances, is the original feature vector with F features, and y⁽ⁱ⁾ is the corresponding class label. Specifically,

(2)

The objective of ACO is to select a compact feature subset d<<F while preserving high intrusion detection performance. ACO formulates feature selection as a path-construction problem, each ant incrementally builds a candidate subset by traversing a graph whose nodes represent features. In this setting, searching for the optimal subset is equivalent to finding an ant path that yields the best fitness (macro-F1) with as few visited nodes as possible. The traversal can be terminated once the subset size reaches d or when no further improvement is observed, ensuring a compact yet discriminative feature set.

Each candidate feature subset is encoded by a binary selection vector

(3)

where indicates that the j-th feature is selected and indicates it is excluded. The number of selected features is

(4)

The ACO algorithm is based on the pheromone-based communication system used by ants. Ants use pheromone trails to signal and select features based on their intensity. Routes with high pheromone concentration become more efficient over time, guiding the ant colony toward optimal solutions.

For each feature j, ACO maintains a pheromone value at iteration t and a heuristic desirability . The probability of selecting feature j is defined as:

(5)

where and control the relative influence of pheromone and heuristic information, respectively. Each ant constructs a solution vector by sampling features according to such that the subset size satisfies .

Each feature subset generated by an ant is evaluated by training a lightweight classifier and computing a balanced performance metric. The fitness function is defined as:

(6)

where is the macro-averaged F1-score and penalizes overly large feature subsets.

Pheromone values are updated using evaporation and reinforcement:

(7)

where is the evaporation rate and

(8)

with A being the number of ants and the indicator function.

After T iterations, the optimal feature subset is selected as

(9)

DCNN-BiLSTM and Temporal Attention based IDS

After ACO, the selected feature subset is fed into the DCNN-BiLSTM module to extract discriminative local feature patterns. A Deep Convolutional Neural Network (DCNN) is first employed. The DCNN consists of two one-dimensional convolutional layers with a kernel size of 3 and ReLU activation. The first convolutional layer applies 64 filters to the input sequence, followed by a max pooling operation with a pool size of 2 to reduce dimensionality. The second convolutional layer applies 128 filters, followed by max pooling. The DCNN extracts hierarchical feature representations through successive convolution and pooling operations, producing intermediate feature maps defined as follows:

(10)

(11)

(12)

(13)

where, X is the ACO feature matrix reshaped as a one-dimensional sequence, U₁, and U₂ are the output of the first and second convolutional layer, obtained by applying a one-dimensional convolution with learnable weights and bias followed by a ReLU activation function. P₁ and P₂ are the pooled feature representation after the first and second max pooling operation.

The extracted feature sequence is then processed by a Bidirectional Long Short-Term Memory (BiLSTM) network to model contextual dependencies in both forward and backward directions. The BiLSTM captures long-range correlations among traffic features that are not explicitly modeled by convolutional layers. The BiLSTM output is given by:

(14)

where

(15)

Each hidden state is obtained by concatenating the forward and backward LSTM outputs, with 128 hidden units in each direction.

To enhance the discriminative capability of the model, a temporal attention mechanism is applied to the BiLSTM outputs. The attention score for each hidden state is computed as:

(16)

where and are trainable weight parameters and is a bias vector.

The output of the attention layer is then passed to a fully connected classifier. A dense layer with 128 neurons and ReLU activation is applied:

(17)

followed by a softmax output layer that produces the predicted class probabilities:

(18)

where denotes the probability distribution over C traffic classes. The network parameters are optimized during the training phase by minimizing the categorical cross-entropy loss using the Adam optimizer:

(19)

where is the ground-truth label of class c for the i-th instance.

Performance evaluation

This section details the experimental setting, the dataset, and the evaluation metrics used. After that, we provide a complete analysis of the obtained results, followed by a comparison with existing research to demonstrate the effectiveness of the proposed method.

System requirements

We implemented the proposed method in Python using TensorFlow, Keras, and Scikit-learn to develop and evaluate the model. All experiments were performed on a machine equipped with a 12th-generation Intel(R) Core(TM) i5-12600K processor (3.69 GHz) and 48 GB of RAM.

Dataset description

We evaluated the proposed intrusion detection framework using the UNSW-NB15 dataset [31], which is one of the most widely adopted benchmark datasets for IDS evaluation. It was developed by the University of New South Wales (UNSW), Australia, the dataset contains approximately 2.5 million network traffic records collected in a realistic simulated environment comprising both normal and malicious activities. The dataset was selected because it provides a realistic representation of contemporary network traffic and cyberattack scenarios that are highly relevant to smart consumer electronics environments. It includes diverse attack categories such as denial-of-service (DoS), worms, and probing, which closely resemble threats that target smart consumer devices, including smart home appliances, wearable devices, surveillance systems, smart televisions, and IoT gateways. Furthermore, the dataset incorporates a comprehensive set of flow-based and packet-level features that capture communication patterns commonly observed in interconnected CE networks. Since modern consumer electronics increasingly rely on edge and cloud connectivity, the heterogeneous traffic characteristics and attack diversity of UNSW-NB15 make it an appropriate benchmark for evaluating intrusion detection systems in CE-IoT ecosystems. Notably, the dataset is highly imbalanced, and no class-balancing approaches were used in this study. For evaluation, the data were split into 70% for training, 15% for validation, and 15% for testing. Table 2 shows the Percentage-wise distribution of network traffic classes including normal and attack categories in the UNSW-NB15 dataset.

Download:

• PNG
  larger image
• TIFF
  original image

Table 2. Percentage-wise Distribution of Network Traffic Classes.

https://doi.org/10.1371/journal.pone.0342949.t002

Training details

For performance evaluation, the dataset was divided into 70% training, 15% validation, and 15% testing subsets. The training set was used to train the proposed model, while the validation set was utilized for hyperparameter tuning, model selection, and ACO-based feature subset evaluation. The test set was used to evaluate the final model’s performance. For feature selection, the ACO algorithm was configured with A = 10 ants and a maximum of T = 15 iterations. The pheromone evaporation rate was set to , while the relative influence of pheromone trails and heuristic information was controlled using and , respectively. The heuristic value was defined as the variance of each feature computed from the training data (). Candidate feature subsets were evaluated using a lightweight multinomial logistic regression classifier with a maximum of 200 iterations. The fitness function was defined as the macro-F1 score penalized by feature subset size using a penalty coefficient of (). The stopping criterion was a fixed maximum of 15 iterations. Furthermore, feature selection was performed using the training data and validated on the validation set, while the test set was excluded from the feature-selection process to prevent test-data leakage. To reduce overfitting, dropout was applied with a rate of 0.3. Model parameters were optimized using the Adam optimizer with a learning rate of 10^–3, , , and . The model was trained by minimizing the categorical cross-entropy loss function for a maximum of 35 epochs, using a batch size of 64.

Evaluation metrics

To assess the effectiveness of the proposed framework, we used standard machine-learning evaluation metrics, namely accuracy, precision, recall, and F1-score. For each class, correctly predicted samples are counted as True Positives (TP), while samples correctly identified as not belonging to that class are counted as True Negatives (TN). Misclassifications are captured by False Positives (FP), which represent samples incorrectly assigned to the class, and False Negatives (FN), which denote samples from the class that the model failed to detect. Table 3 summarizes the different evaluation metrics and their equations.

Download:

• PNG
  larger image
• TIFF
  original image

Table 3. Evaluation metrics.

https://doi.org/10.1371/journal.pone.0342949.t003