Feature selection for intrusion detection based on an improved rime optimization algorithm

With the rapid development of information technology, cybersecurity issues have become increasingly prominent, posing serious threats to national security, economic growth, and personal privacy. Intrusion detection systems have been widely applied to ensure network security and prevent malicious cyber-attacks. In intrusion detection, redundant and irrelevant features not only slow down the classification process but also hinder classifiers from making accurate decisions, resulting in decreased system performance. Addressing the problem of low accuracy in intrusion detection systems due to high-dimensional datasets, we propose a network intrusion detection method based on an enhanced Rime Optimization Algorithm for feature selection. Firstly, building upon the traditional Rime Optimization Algorithm, we introduce Cauchy mutation and differential mutation operations to improve both global and local search capabilities. Cauchy mutation introduces a heavy-tailed distribution to increase the probability of escaping local optima, while differential mutation, through the differential operator, further enhances solution diversity and algorithm convergence speed. Combining the two mutation operations, the optimization algorithm achieves a good balance between global search and local search, effectively avoids premature convergence and falling into local optimum, and effectively improves the feature selection results. Secondly, the improved Rime optimization algorithm (IRIME) was applied to the feature selection process of intrusion detection system, and it was combined with the decision tree classifier to construct a wrapper feature selection algorithm, which could directly optimize the classification task and avoid the mismatch between feature selection and classifier. The optimized algorithm can quickly select the most representative feature subset from the high-dimensional feature space, significantly reducing the computational cost. At the same time, the selected feature subset can more accurately reflect the inherent law of the data set, thereby improving the prediction accuracy of the classifier. Finally, NSL-KDD and UNSW-NB15 datasets were used for performance evaluation. Experimental results show that compared with several feature selection algorithms, the proposed method achieves the best binary classification performance after feature selection. Specifically, it is superior to other algorithms in terms of precision, accuracy, F1 score and recall of all evaluation metrics.