Intrusion detection in industrial internet of things network using feature optimization and hybrid deep learning

The rapid growth of the Industrial Internet of Things (IIoT) has introduced complex security challenges requiring accurate, scalable, and privacy-preserving intrusion detection solutions. This paper presents a hybrid framework that combines Hunting Gradient Snake–Cuckoo Search (HGS–CS) feature optimization with a Transformer–LSTM detection model enhanced by a gated fusion mechanism under a federated learning setup. The proposed system comprises three main components: (1) a dual-phase HGS–CS optimizer that selects the most informative features by balancing global exploration and local refinement; (2) a gated Transformer–LSTM architecture that effectively captures both temporal dependencies and spatial correlations in IIoT traffic; and (3) an attention-weighted SwarmFed aggregation protocol that enables decentralized yet coordinated model training across multiple clients while preserving data privacy. Experimental evaluations on four benchmark IIoT datasets, CICAPT-IIoT, Edge-IIoTset, WUSTL-IIoT, and ToN-IoT, show that the proposed model achieves an average accuracy of 99.27%, precision of 99.25%, recall of 99.17%, F1-score of 99.21%, and AUC of 99.35%, surpassing recent state-of-the-art methods by 0.8–1.3% across all metrics. The model also exhibits low standard deviation ($$\le $$0.22%) across independent runs, confirming its robustness and stability. Overall, this study introduces a numerically validated, hybrid optimization and deep learning framework that delivers reliable, scalable, and privacy-aware intrusion detection for next-generation IIoT environments.