2690-6791ISSN (Online)
2769-786XISSN (Print)
Volume 18 , Issue 1 , PP: 34-47, 2026 | Cite this article as | XML | Html | PDF | Full Length Article
Noor Flayyih Hasan 1 *
Doi: https://doi.org/10.54216/JISIoT.180103
Due to the increasing prevalence of network attacks, maintaining network security has become significantly more challenging. An Intrusion Detection System (IDS) is a critical tool for addressing security vulnerabilities. IDSs play a vital role in monitoring network traffic and identifying malicious activities. However, two major challenges hinder IDS performance: data imbalance, which weakens the detection of minority class attacks, and overfitting in traditional classifiers such as Support Vector Machines (SVM). This study proposes a novel and transparent IDS framework that integrates several advanced techniques: Variational Autoencoder (VAE) for data augmentation, Mutual Information-based feature selection, Harris Hawks Optimization (HHO) for hyperparameter tuning of the SVM, and SHAP (SHapley Additive exPlanations) for interpretability. VAE is utilized to generate synthetic instances for minority classes, effectively addressing class imbalance. Feature selection is employed to reduce dimensionality and enhance generalization performance. The HHO algorithm is used to adaptively tune the hyperparameters of the SVM, thereby optimizing classification accuracy while mitigating overfitting. Finally, SHAP values are employed to interpret the SVM’s decisions, enhancing the transparency and trustworthiness of the system. Experimental evaluations conducted on two benchmark IDS datasets, UNSW-NB15 and NSL-KDD, demonstrate that the proposed VAE-HHO-SVM framework outperforms existing models in terms of accuracy, robustness, and interpretability. The results confirm the effectiveness of combining optimization, explainable AI, and data balancing strategies in modern IDS development. Specifically, the proposed method achieves an accuracy of 98.42% on the NSL-KDD dataset and 97.45% on the UNSW-NB15 dataset—an improvement of 3.17% over other methods.
Harris Hawks Optimization , Hyper-parameter optimization , Intrusion Detection Systems , Support vector machine , Variational Autoencoder
[1] O. Ahmed, “Enhancing Intrusion Detection in Wireless Sensor Networks through Machine Learning Techniques and Context Awareness Integration,” International Journal of Mathematics, Statistics, and Computer Science, vol. 2, pp. 244–258, 2024. [Online]. Available: https://doi.org/10.59543/ijmscs.v2i.10377.
[2] L. Zolfagharipour, M. H. Kadhim, and T. H. Mandeel, “Enhance the Security of Access to IoT-based Equipment in Fog,” in Al-Sadiq International Conference on Communication and Information Technology (AICCIT) 2023, Jul. 4, 2023, pp. 142-146. IEEE.
[3] D. Ditale, M. Albanese, K. Sun, and J. Pan, “CyberMALT: Machine Learning-Assisted Traffic Analysis for Cyber Threat Detection and Classification,” in IEEE 22nd Consumer Communications & Networking Conference (CCNC) 2025, Jan. 10, 2025, pp. 1-6. IEEE.
[4] K. Noor, A. L. Imoize, C. T. Li, and C. Y. Weng, “A review of machine learning and transfer learning strategies for intrusion detection systems in 5 G and beyond,” Mathematics, vol. 13, no. 7, Art. 1088, Mar. 26, 2025.
[5] L. Zolfagharipour and M. H. Kadhim, “A Technique for Efficiently Controlling Centralized Data Congestion in Vehicular Ad Hoc Networks,” International Journal of Computer Networks and Applications (IJCNA), vol. 12, no. 2, pp. 267-277, 2025.
[6] J. Ehmer, Y. Savaria, B. Granado, J. P. David, and J. Denoulet, “Network Attack Classification with a Shallow Neural Network for Internet and Internet of Things (IoT) Traffic,” Electronics, vol. 13, no. 16, Art. 3318, Aug. 21, 2024.
[7] Y. Zhang, Q. Wu, G. Liu, J. Tian, S. Liang, and C. Zhang, “Research on Structure and Hyperparameter Optimization of Lightweight ViT Model Based on SVM Optimization in Object Detection,” in IEEE 6th International Conference on Civil Aviation Safety and Information Technology (ICCASIT) 2024, Oct. 23, 2024, pp. 1644-1648. IEEE.
[8] L. Moles, A. Andres, G. Echegaray, and F. Boto, “Exploring data augmentation and active learning benefits in imbalanced datasets,” Mathematics, vol. 12, no. 12, Art. 1898, Jun. 19, 2024.
[9] B. M. Kessels, R. H. Fey, and N. van de Wouw, “Mutual information-based feature selection for inverse mapping parameter updating of dynamical systems,” Multibody System Dynamics, vol. 2024, pp. 1-28, Aug. 19, 2024.
[10] A. A. Heidari, S. Mirjalili, H. Faris, I. Aljarah, M. Mafarja, and H. Chen, “Harris hawks optimization: Algorithm and applications,” Future Generation Computer Systems, vol. 97, pp. 849-872, Aug. 1, 2019.
[11] L. Antwarg, R. M. Miller, B. Shapira, and L. Rokach, “Explaining anomalies detected by autoencoders using Shapley Additive Explanations,” Expert Systems with Applications, vol. 186, Art. 115736, Dec. 30, 2021.
[12] N. Moustafa and J. Slay, “UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),” in Military Communications and Information Systems Conference (MilCIS) 2015, Nov. 10, 2015, pp. 1-6. IEEE.
[13] D. D. Protić, “Review of KDD Cup ‘99, NSL-KDD, and Kyoto 2006+ datasets,” Vojnotehnički glasnik/Military Technical Courier, vol. 66, no. 3, pp. 580-596, Apr. 8, 2018.
[14] M. P. Raghunath, S. Deshmukh, P. Chaudhari, S. L. Bangare, K. Kasat, M. Awasthy, B. Omarov, and R. R. Waghulde, “PCA and PSO-based optimized support vector machine for efficient intrusion detection in the Internet of Things,” Measurement: Sensors, vol. 37, Art. 101806, Feb. 1, 2025.
[15] M. Alotaibi, H. A. Mengash, H. Alqahtani, A. M. Al-Sharafi, A. E. Yahya, S. R. Alotaibi, A. O. Khadidos, and A. Yafoz, “Hybrid GWQBBA model for optimized classification of attacks in Intrusion Detection System,” Alexandria Engineering Journal, vol. 116, pp. 9-19, Mar. 1, 2025.
[16] P. Waghmode, M. Kanumuri, H. El-Ocla, and T. Boyle, “Intrusion detection system based on machine learning using least square support vector machine,” Scientific Reports, vol. 15, no. 1, Art. 12066, Apr. 8, 2025.
[17] S. V. Kumar, “An enhanced whale optimizer-based feature selection technique with an effective ensemble classifier for a network intrusion detection system,” Peer-to-Peer Networking and Applications, vol. 18, no. 2, pp. 1-28, Apr. 2025.
[18] P. R. Kanna and P. Santhi, “An enhanced hybrid intrusion detection using mapreduce-optimized black widow convolutional LSTM neural networks,” Wireless Personal Communications, vol. 138, no. 4, pp. 2407-2445, Oct. 2024.
[19] L. Qiu, Z. Xu, L. Lin, J. Zheng, and J. Su, “Design and Optimization of Hybrid CNN-DT Model-Based Network Intrusion Detection Algorithm Using Deep Reinforcement Learning,” Mathematics, vol. 13, no. 9, Art. 1459, Apr. 29, 2025.
[20] M. Alshinwan, O. A. Khashan, M. Khader, O. Tarawneh, A. Shdefat, N. Mostafa, and D. S. AbdElminaam, “Enhanced Prairie Dog Optimization with Differential Evolution for solving engineering design problems and network intrusion detection systems,” Heliyon, vol. 10, no. 17, Sep. 15, 2024.
[21] L. Abualigah, S. H. Ahmed, M. H. Almomani, R. A. Zitar, A. R. Alsoud, B. Abuhaija, E. S. Hanandeh, H. Jia, D. S. Elminaam, and M. A. Elaziz, “Modified Aquila Optimizer feature selection approach and support vector machine classifier for intrusion detection system,” Multimedia Tools and Applications, vol. 83, no. 21, pp. 59887-59913, Jun. 2024.
[22] K. S. Babu and Y. N. Rao, “Improved Monarchy Butterfly Optimization Algorithm (IMBO): Intrusion Detection Using MapReduce Framework Based Optimized ANU-Net,” Computers, Materials & Continua, vol. 75, no. 3, Jun. 1, 2023.
[23] A. Ponmalar and V. Dhanakoti, “An intrusion detection approach using ensemble support vector machine based chaos game optimization algorithm in big data platform,” Applied Soft Computing, vol. 116, Art. 108295, Feb. 1, 2022.
[24] U. Nandhini and S. K. SVN, “An improved Harris Hawks optimizer-based feature selection technique with an effective two-stage classifier for a network intrusion detection system,” Peer-to-Peer Networking and Applications, vol. 17, no. 5, pp. 2944-2978, Sep. 2024.
[25] R. Aswanandini and C. Deepa, “Network Intrusion Classification using Configuration Optimized Support Vector Machines,” in International Conference on Advancements in Electrical, Electronics, Communication, Computing and Automation (ICAECA) 2021, Oct. 8, 2021, pp. 1-6. IEEE.
[26] E. Heidari, “A novel energy-aware method for clustering and routing in IoT based on whale optimization algorithm & Harris Hawks optimization,” Computing, vol. 106, no. 3, pp. 1013-1045, Mar. 2024.
