ZeroSEC: hybrid optimized stacked deep learning framework for zero-day anomaly intrusion detection for host system

Unseen attacks are still a challenge for the day-to-day users of computers. To guard our digital assets from zero-day attacks is almost impossible due to their unknown pattern of attack. To solve this problem, a more effective approach has been developed to identify and categorize them. A novel integrated framework developed by combining an optimized feature pipeline, an enhanced autoencoder, and a deep learning stacking ensemble to detect and categorize zero-day. The Adam optimizer and Keras tuner were used to optimize the autoencoder. A novel exploration–exploitation-diversification (EED) hybrid optimization method based on spider monkey optimization (SMO) and particle swarm optimization (PSO) has been used to optimize the entire stacking ensemble model. The gated recurrent unit (GRU) as a meta classifier, long short-term memory (LSTM), and a bi-directional gated recurrent unit (Bi-GRU), which is the base classifier for this deep learning zero-day stacking ensemble classifier (ZeroSEC). The combined approach ZeroSEC evaluated on two of the latest datasets. On the UNSW ToN IoT 2020 dataset, the model produced the best results, achieving a 99.35% recall with a 0.64% false negative rate and an overall accuracy of 99.74% and 0.05% false alarm. The statistical results show the suggested model outperforms earlier research.