Hybrid PSO–GWO feature selection for IoT DDoS detection with IDS/IPS-oriented deployment

Abstract The rapid growth of IoT networks has increased their exposure to Distributed Denial-of-Service (DDoS) attacks, particularly HTTP flood attacks that can disrupt service availability in resource-constrained environments. To address the challenges of high-dimensional flow-based traffic data and the need for accurate and efficient detection, this study proposes a hybrid PSO–GWO feature selection framework for HTTP flood-based IoT DDoS attack detection. Particle Swarm Optimization (PSO) and Grey Wolf Optimizer (GWO) are applied independently, and their selected subsets are combined after optimization using post-selection union and intersection strategies. Their outputs are then combined using two feature construction strategies: union (PSO∪GWO) and intersection (PSO∩GWO). The union strategy preserves broader complementary feature information, while the intersection strategy produces a compact subset for lightweight screening. Experiments are conducted specifically on the IoT-DDoS-HTTP_Flood subset of the CIC IoT-DIAD 2024 dataset; therefore, the reported findings are limited to this attack scenario. Among the evaluated classifiers, XGBoost achieved the highest mean performance. Results show that PSO∪GWO with XGBoost reaches 99.38% Accuracy, 99.31% Recall, and 99.40% F1-score while maintaining high Precision. In contrast, PSO∩GWO provides a more compact feature representation with lower computational cost. These findings highlight the trade-off between feature diversity and compactness and support a conceptual IDS/IPS-oriented deployment strategy, where richer subsets support IDS-oriented deeper analysis and compact subsets support IPS-oriented low-latency screening.