Adaptive intrusion detection systems using AMCMPSO optimisation

Purpose The rapid growth of IoT-enabled networks has intensified cyber threats, yet traditional intrusion detection systems (IDS) struggle to sustain high accuracy on high-dimensional traffic without heavy computational overhead. This paper addresses that dual challenge with an Adaptive Intrusion Detection System (AdaptIDS) built on a novel adaptive cluster-centred particle swarm optimisation (AMCMPSO) algorithm. Design/methodology/approach AMCMPSO augments canonical PSO with a centre-of-mass guidance term and adaptive scheduling of the inertia weight and acceleration coefficients. In simple terms, each particle is drawn towards both the best solutions found and the swarm's average position, keeping the search balanced and avoiding premature convergence. It drives feature selection across four classifiers (LightGBM, Random Forest, Logistic Regression and SVM) on four datasets: WSN-DS, WSNBFSFdataset, UNSW_NB15, and a high-dimensional API malware set. Findings AdaptIDS improves accuracy by up to 3.1% and cuts training time by up to 85%. AMCMPSO-LightGBM reaches 97.0% accuracy while reducing features from 554 to 443, with precision, recall and F1 rising to 97.0%, 96.8% and 96.6%; the fold-wise accuracy gains are significant (Wilcoxon, p = 0.031). Gains are consistent across all datasets and classifiers. Research limitations/implications The main limitation is the one-time AMCMPSO optimisation overhead, which increases with dataset size, feature dimensionality, and classifier complexity. Future work should explore incremental optimisation for concept drift, federated learning integration, and robustness against adversarial attacks. Practical implications The proposed framework can help security teams deploy more efficient IDS models by reducing redundant features, improving detection accuracy and lowering training and prediction time. This is useful for IoT, WSN, cloud and high-dimensional malware detection environments. Originality/value To the authors' knowledge, AMCMPSO is the first centre-of-mass-guided adaptive PSO applied to IDS feature selection; such guidance had previously been used only for continuous problems, not binary feature-subset search. AdaptIDS provides a scalable, classifier-agnostic layer that improves accuracy and efficiency across heterogeneous networks while keeping inference fast enough for online use.

Authors

Institutions

Publication Details

Journal
Applied Computing and Informatics
Published
2026-09-28
DOI
https://doi.org/10.1108/aci-06-2026-0474
Primary Topic
Network Security and Intrusion Detection
Type
article
Field-Weighted Citation Impact
0.00
Controls
|||
ALL TIME
JAN
FEB
MAR
APR
MAY
JUN
JUL
AUG
SEP
article

Adaptive intrusion detection systems using AMCMPSO optimisation

Rami Ahmad
Applied Computing and Informatics
Network Security and Intrusion Detection
article

Adaptive intrusion detection systems using AMCMPSO optimisation

Rami Ahmad
article en

Abstract

Purpose The rapid growth of IoT-enabled networks has intensified cyber threats, yet traditional intrusion detection systems (IDS) struggle to sustain high accuracy on high-dimensional traffic without heavy computational overhead. This paper addresses that dual challenge with an Adaptive Intrusion Detection System (AdaptIDS) built on a novel adaptive cluster-centred particle swarm optimisation (AMCMPSO) algorithm. Design/methodology/approach AMCMPSO augments canonical PSO with a centre-of-mass guidance term and adaptive scheduling of the inertia weight and acceleration coefficients. In simple terms, each particle is drawn towards both the best solutions found and the swarm's average position, keeping the search balanced and avoiding premature convergence. It drives feature selection across four classifiers (LightGBM, Random Forest, Logistic Regression and SVM) on four datasets: WSN-DS, WSNBFSFdataset, UNSW_NB15, and a high-dimensional API malware set. Findings AdaptIDS improves accuracy by up to 3.1% and cuts training time by up to 85%. AMCMPSO-LightGBM reaches 97.0% accuracy while reducing features from 554 to 443, with precision, recall and F1 rising to 97.0%, 96.8% and 96.6%; the fold-wise accuracy gains are significant (Wilcoxon, p = 0.031). Gains are consistent across all datasets and classifiers. Research limitations/implications The main limitation is the one-time AMCMPSO optimisation overhead, which increases with dataset size, feature dimensionality, and classifier complexity. Future work should explore incremental optimisation for concept drift, federated learning integration, and robustness against adversarial attacks. Practical implications The proposed framework can help security teams deploy more efficient IDS models by reducing redundant features, improving detection accuracy and lowering training and prediction time. This is useful for IoT, WSN, cloud and high-dimensional malware detection environments. Originality/value To the authors' knowledge, AMCMPSO is the first centre-of-mass-guided adaptive PSO applied to IDS feature selection; such guidance had previously been used only for continuous problems, not binary feature-subset search. AdaptIDS provides a scalable, classifier-agnostic layer that improves accuracy and efficiency across heterogeneous networks while keeping inference fast enough for online use.

Applied Computing and Informatics
American University in the Emirates (AE)
Life in Land
Openalex Percentile: Top 9%
Network Security and Intrusion Detection
AI Navigator

Ask Laika to Summarize, Analyze, and Connect papers live on the map.

Summarize Papers & Methodologies

Extract key findings, datasets, and comparative methods across publications.

Benchmark Rankings & Visual Analytics

Rank top research institutions, authors, funders, topics, and journals by Field-Weighted Citation Impact (FWCI) and paper volume with instant charts.

Connect Distant Disciplines

Bridge topological clusters on the map to find hidden collaborative intersections.