Feature Selection Techniques in Intrusion Detection  Systems: A Review

Ahmad Salim; Obaid Salim; Omar Muthanna Khudhur; Shokhan M. Al-Barzinji; Farah Maath Jasem

doi:https://doi.org/10.54216/JCIM.170208

International Journal of Neutrosophic Science | 2026

Neutrosophic Average Edge Connectivity with Applications to Communication Networks

Average edge connectivity is a fundamental concept in graph theory, widely employed to evaluate the robustness of networks through the analysis of local edge cuts. Classical fuzzy extensions allow for graded membership, yet they fail to clearly distinguish between inherent uncertainty and definite absence of edges. To overcome this limitation, we introduce the notion of neutrosophic average edge connectivity, a tri-valued connectivity measure formulated within the framework of single-valued neutrosophic graphs (SVNGs). In this study, we rigorously define neutrosophic local edge cuts, establish key theoretical results including bounds and monotonicity properties, and design efficient algorithms tailored for particular families of graphs. The applicability of the proposed framework is demonstrated through a detailed communication-network case study, which highlights its capacity to capture structural resilience under indeterminate conditions. Overall, the proposed approach generalizes classical robustness indicators and provides a comprehensive tool for analyzing connectivity in networks characterized by vagueness, indeterminacy, and incomplete information.

groups

Aparna Tripathy mail -

Amaresh Chandra Panda mail -

Siva Prasad Behera mail -

Prasanta Kumar Raut mail -

Mana Donganont mail -

Said Broumi mail

link https://doi.org/10.54216/IJNS.270214

Volume & Issue

Vol. Volume 27 / Iss. Issue 2

Details open_in_new

International Journal of Neutrosophic Science | 2025

Coefficient Bounds for Generalized n-Fold Symmetric Neutrosophic Bi-univalent Functions

In this paper, we introduce and investigate new generalized subclasses of neutrosophic n-fold symmetric bi-univalent functions defined in the open unit disk U . These subclasses are characterized via four neutrosophic multi-parameters κ, ρ, γ, and β, which provide a flexible framework to capture the truth, indeterminacy, and falsity components inherent in geometric and analytic behaviors. Within this neutrosophic setting, we derive upper bounds for the initial coefficients |dn+1| and |d2n+1|, and establish generalized Fekete–Szeg˝o inequalities for the considered classes. The results obtained extend and unify several existing results in classical and neutrosophic bi-univalent function theory. Examples and corollaries are presented to demonstrate the sharpness and applicability of the results.

groups

Isra Al-Shbeil mail -

wael mahmoud mohammad salameh mail -

Jianhua Gong mail -

Ajmal Khan mail -

Shahid Khan mail

link https://doi.org/10.54216/IJNS.260419

Volume & Issue

Vol. Volume 26 / Iss. Issue 4

Details open_in_new

Journal of Cybersecurity and Information Management | 2026

A Hybrid Intelligent Facial Recognition Model Based on Hierarchical Feature Extraction and Il-lamination Normalization

Face recognition in unconstrained environments is difficult due to varying poses and lighting conditions. This can severely impair the performance of intelligent recognition models. Traditional methods often do not adapt well to these variations, which results in poor performance and limited applicability. This paper proposes a hybrid intelligent face recognition model based on hierarchical feature extraction and illumination normalization (H-FR). The proposed method employs a hierarchical feature extraction model to capture macro and micro facial details, ensuring reliable recognition across diverse poses and lighting conditions. Employing Adaptive Histogram Equalization on the A and B channels of the LAB colour space effectively normalizes illumination variations, enhancing the visibility and consistency of facial features. The proposed model has been tested and validated on the "Pins Face Recognition" dataset available on Kaggle, which encompasses various celebrity faces captured in varying poses and lighting conditions. The proposed model has been demonstrated through extensive experimentation to outperform AlexNet and VGG-19. The compared algorithms achieved accuracies of 88% for AlexNet and 93% for VGG-19, while the proposed H-FR model achieved 96%.

groups

Ali F. Rashid mail -

Ilyas Khudhair Yalwi mail -

Ali Hakem Alsaeedi mail -

Riyadh Rahef Nuiaa Alogaili mail -

Mazin Abed Mohammed mail

link https://doi.org/10.54216/JCIM.170201

Volume & Issue

Vol. Volume 17 / Iss. Issue 2

Details open_in_new

Journal of Cybersecurity and Information Management | 2026

MACSteg: Real-Time Voice Authentication and Deepfake Protection Using Device MAC Address Steganography

The invention of deepfake applications make it possible to produce highly natural and real voice recordings which creates critical concerns about the credibility of audio telecommunications. The confirmation of the speakers’ voices became essential especially for sensitive data such as financial, healthcare, and surveillance risk management services, authentication of speakers’ voices became significantly crucial. To improve solutions to this issue, this paper presents MACSteg strategy which is a real-time, lightweight voice authentication technique by discreetly encapsulate device’s MAC address within voice file using Quantization Index Modulation (QIM) stego-technique. Unlike many traditional strategies that degrade voice quality or produces noticed jitter, MACSteg technique preserve both clarity and efficiency. Implementations showed that the hidden MAC address stayed intact in spite of some typical voice processing such as compression, while interfered signals reformed by clatter or volume variations were consistently detected. The proposed system obtained a high signal-to-noise ratio (SNR) exceeding 70 dB, illustrating that the alterations were inaudible, and maintained well in real-time submissions, giving only a processing delay of 0.01 milliseconds per each audio segment. The results indicate MACSteg’s potential as a ascendable and effective approach for safeguarding voice authenticity, especially in circumstances where verification of speaker’s voice is vital.

groups

Sanaa Ahmed Kadhim mail -

Zaid Ali Alsarray mail -

Saad Abdual Azize Abdual Rahman mail -

Massila Kamalrudin mail -

Mustafa Musa mail

link https://doi.org/10.54216/JCIM.170202

Volume & Issue

Vol. Volume 17 / Iss. Issue 2

Details open_in_new

Journal of Cybersecurity and Information Management | 2026

Integration of Crayfish Optimization with Watermarking Scheme for Automated Tampering Text Detection

Digital text document serves as the essence of existing communication but still pose major safety concerns on their vulnerability to tampering. Digital text watermarking acts as a powerful tool to secure the reliability of textual data. Presenting a hidden layer of safety and accountability enables organizations and individuals to make sure of the truth behind each file and trust the written word. Watermarking detects tampering by checking the embedded signature for changes or distortions. The Watermark model is capable of mechanically repairing and classifying themselves once tampered with, enhancing document resilience. Watermarking is an effective mechanism to identify tampering attacks in digital documents. The specialized process of embedding imperceptible and strong watermarks in document creation or distribution detects alterations. This study proposes the Crayfish Optimization with a Watermarking Scheme for Automated Tampering Text Detection (CFOWS-ATTD) technique. The major purpose of the CFOWS-ATTD technique is to accomplish the security of English text using content authentication and tampering detection. In the CFOWS-ATTD technique, two-stage processes are involved. Moreover, the CFOWS-ATTD technique generates a watermark from the text document and performs extraction to verify text authenticity. Furthermore, the CFO approach optimally places the watermark to ensure it remains robust and imperceptible to tampering. The experimentation of the CFOWS-ATTD approach is performed under the ELST, ESST, EHMST, and EMST datasets. The results implied that the CFOWS-ATTD approach obtains optimum performance over other techniques.

groups

Hanan T. Halawani mail

link https://doi.org/10.54216/JCIM.170203

Volume & Issue

Vol. Volume 17 / Iss. Issue 2

Details open_in_new

Journal of Cybersecurity and Information Management | 2026

Enhancing Cybersecurity through Ransomware Detection using Hybridization of Heuristic Feature Selection with Deep Representation Learning Model

Network security has become vulnerable to hacker threats owing to its advancement and easily accessible to computer and internet technology. Ransomware is the most commonly used malware in cyberattacks to mislead the victim user to expose private and sensitive data to hackers. Ransomware is malicious software that encodes the entire system or consumer’s files, creating it impossible, and later demands a payment fee from the victim’s computer in exchange for the decryption key. Ransomware attacks become highly popular and overwhelming for both individuals and organizations. Recently, deep learning (DL) and machine learning (ML) models are established to identify ransomware attacks in real-time and categorize them into various types. The system will be considered to examine the behaviors of malicious software and detect the particular kind of ransomware being utilized. This data will enhance the system’s accuracy and deliver appropriate data to cybersecurity professionals and victims. Therefore, this study proposes an accurate Ransomware Detection and classification using the Hybrid Metaheuristic Feature Selection with Deep Learning (RDC-HMFSDL) technique. The aim is in effectually detecting and classifying the ransomware attacks. Initially, the RDC-HMFSDL technique utilizes min-max model to transform the input data into a standard setting. Furthermore, the hybrid red deer sparrow search optimization (HRDSO) approach is used for the feature selection (FS). For ransomware attack detection, the long short-term memory autoencoder (LSTM-AE) approach is employed. Finally, the sine cosine algorithm (SCA) is used to optimally choose the parameter values of the LSTM-AE approach. The RDC-HMFSDL approach was tested on a benchmark dataset, achieving a superior accuracy of 99.88% compared to existing methods.

groups

Maha Farouk Sabir mail

link https://doi.org/10.54216/JCIM.170204

Volume & Issue

Vol. Volume 17 / Iss. Issue 2

Details open_in_new

Journal of Cybersecurity and Information Management | 2026

Feature Subset Search for Cybersecurity in Industrial Internet of Things Environment Using Coot Optimization Algorithm

The Industrial Internet of Things (IIoT) is the incorporation of industrial processes with smart technology and interconnected devices to improve productivity and efficiency. The need for robust cybersecurity measures is crucial as the IIoT environment becomes vital to critical infrastructure in industries. Cybersecurity in IIoT is paramount to secure against possible threats, which ensures the integrity and resilience of industrial operations. Intrusion detection systems (IDSs) are instrumental in detecting anomalies, unauthorized access, or malicious activities. The incorporation of deep learning (DL) further reinforces the cybersecurity posture of the IIoT network. DL approach excels in analyzing complex and large datasets, which enables the detection of complex cyber threats by learning anomalies and patterns. Industrial processes can operate with heightened security, securing sensitive information, and critical infrastructure, and maintaining the reliability of a connected system in the industrial landscape by combining IIoT cybersecurity with innovative intrusion detection and DL technologies. Therefore, this article proposes an Integration of Coot Optimization Algorithm-based Feature Subset Search with Deep Learning for Cybersecurity (COAFSS-DLCS) technique on IIoT network. The objective is in the effectual recognition and classification of cyberattacks in the IIoT environment. Initially, the COAFSS-DLCS method uses min-max scalar to transform the input dataset into a suitable format. Furthermore, the COAFSS-DLCS employs the COAFSS approach for choosing an optimal feature subset. Additionally, the stacked long short-term memory autoencoder (SLSTM-AE) model is employed for classification. Moreover, the parameters of the SLSTM-AE classifier are fine-tuned using the Arithmetic Optimization Algorithm (AOA) for improved performance. A comprehensive empirical validation of the COAFSS-DLCS approach is performed under the UNSW_NB15 and UCI_SECOM datasets. The simulation outputs inferred the power of the COAFSS-DLCS over other methods.

groups

Adil. O. Y. Mohamed mail -

Yousef Asiri mail -

Manahill I. A. Anja mail -

Bandar M. Alghamdi mail -

Abdelgalal O. I. Abaker mail -

Mnahil M. Bashier mail

link https://doi.org/10.54216/JCIM.170205

Volume & Issue

Vol. Volume 17 / Iss. Issue 2

Details open_in_new

Journal of Cybersecurity and Information Management | 2026

Nature-Inspired Learning Framework for Cyberattack Classification in IoT Networks

Due to the massive data and communication progress, the usage of Internet of Things (IoT) devices has developed significantly. The extensive use of IoT systems heightens the complex interactions among devices and increases the data traffic, generating numerous possibilities for cyber challengers. Therefore, identifying and alleviating cyber-attacks focusing on IoT systems has appeared as an essential obligation in the context of cybersecurity. Academics and enterprises are contemplating means of machine learning (ML) and deep learning (DL) for cyberattack prevention because ML and DL exhibit great potential in numerous domains. Various DL teachings are executed to extract several patterns from multiple annotated datasets. DL is a beneficial tool for identifying cyberattacks. Timely network data detection and segregation become more fundamental than alleviating cyberattacks. Therefore, this paper proposes a novel Brown Bear Optimization method with an Ensemble of Machine Learning-based Cyber Attack Detections (BBOA-EMLCADs) method for secure IoT environment. The main aim of the BBOA-EMLCAD method relies on the automatic classification of the cyber threats in the IoT environment. Initially, the brown bear optimization (BBO) method is utilized for feature selection (FS). Moreover, an ensemble of two ML approaches namely XGBoost and least square support vector machine (LSSVM) are employed for the automatic identification of the cyber-attacks. Lastly, the salp swarm algorithms (SSAs) is implemented for the optimal hyperparameter tuning of the two ML techniques. The simulation validation of the BBOA-EMLCAD approach is performed under the WSN-DS dataset. The comparison assessment of the BBOA-EMLCAD approach portrayed a superior accuracy value of 99.62% over existing models.

groups

Ishwarya K. mail -

Saraswathı S. mail

link https://doi.org/10.54216/JCIM.170206

Volume & Issue

Vol. Volume 17 / Iss. Issue 2

Details open_in_new

Journal of Cybersecurity and Information Management | 2026

Optimizing VANET Clustering Algorithms for 3D Urban Environments: Impact of Traffic Congestion and Driver Behavior on Network Performance

Vehicular Ad-hoc Networks (VANETs) play a crucial role in intelligent transportation systems, facilitating communication between vehicles and infrastructure in urban environments. Clustering algorithms are essential for managing network topology and enhancing communication efficiency in VANETs. The complex nature of three-dimensional (3D) urban environments, coupled with varying traffic conditions and driver behaviors, presents significant challenges for VANET clustering algorithms. Understanding these interactions is vital for developing robust and efficient VANETs. This study investigates how vehicle generation patterns, driving dynamics, and 3D road geometries influence the performance of VANET clustering algorithms in urban settings, focusing on network connectivity and stability. A comprehensive simulation framework was developed, incorporating a Traffic Generator model, a Mobility Model, and a Model of Road Curvature. The methodology evaluated clustering algorithm performance across three traffic congestion levels (low, medium, high) and three driver aggression levels for each congestion scenario. Data analysis, correlation studies, and sensitivity analysis were conducted to assess the impact of these factors on clustering efficiency. The study revealed significant correlations between traffic congestion levels, driver aggression, and clustering performance. Higher congestion levels led to more frequent cluster reconfigurations, while increased driver aggression affected the predictability of vehicle movements, affecting cluster stability. The 3D nature of urban environments introduced additional challenges, particularly in areas with elevation changes. The findings underscore the need for adaptive clustering algorithms capable of responding to dynamic urban traffic conditions. The research provides valuable insights for optimizing VANET clustering strategies in 3D urban environments, contributing to the development of more efficient and reliable vehicular communication networks for future smart cities.

groups

Ahmed Salih Al-Obaidi mail -

Ghaith J. Mohammed mail -

Waleed Khalid Alzubaidi mail

link https://doi.org/10.54216/JCIM.170207

Volume & Issue

Vol. Volume 17 / Iss. Issue 2

Details open_in_new

Journal of Cybersecurity and Information Management | 2026

Feature Selection Techniques in Intrusion Detection Systems: A Review

Intrusion detection has garnered significant attention as researchers strive to develop sophisticated models characterized by their high accuracy levels. However, the persistent challenge lies in creating reliable and effective intrusion detection systems capable of managing vast datasets under dynamic, real-time conditions. The effectiveness of such systems largely depends on the chosen detection methodologies, specifically the feature selection processes and the application of machine learning techniques. This paper offers a comprehensive review of feature selection methods employed in the realm of intrusion detection research. It examines various dimensionality reduction strategies, followed by a systematic classification of feature selection techniques to assess their impact on the training phase and subsequent detection efficacy. The focus was on the wrapper, filter feature selection methods, where the methods used were analysed, and their strengths and weaknesses were revealed. The identification and selection of the most pertinent features have been shown to significantly enhance the detection performance, not only in terms of accuracy but also in reducing computational demands, underscoring its critical importance in the architecture of intrusion detection systems.

groups

Ahmad Salim mail -

Obaid Salim mail -

Omar Muthanna Khudhur mail -

Shokhan M. Al-Barzinji mail -

Farah Maath Jasem mail

link https://doi.org/10.54216/JCIM.170208

Volume & Issue

Vol. Volume 17 / Iss. Issue 2

Details open_in_new