A systematic review of metaheuristics-based and machine learning-driven intrusion detection systems in IoT

1. Problem Statement

The rapid proliferation of the Internet of Things (IoT) has introduced significant security challenges due to the heterogeneity, flexibility, and close connectivity of IoT devices. Traditional security measures like firewalls are insufficient against complex, dynamic attacks (e.g., botnets like Mirai, unauthorized camera access). While Machine Learning (ML) and Deep Learning (DL) have improved Intrusion Detection Systems (IDS), they face critical limitations in IoT environments:

• Resource Constraints: IoT devices and edge servers often lack the computational power and energy required to train and run complex ML models.
• Data Complexity: The sheer volume of data and the need for real-time processing create latency issues.
• Optimization Needs: ML models require extensive tuning of features, parameters, and hyperparameters to achieve high accuracy, which is computationally expensive.
• Literature Gaps: Existing surveys often focus solely on ML or metaheuristics, lack IoT-specificity, fail to analyze the correlation between optimization techniques and specific datasets, and do not comprehensively categorize the applications of metaheuristics (e.g., feature selection vs. hyperparameter tuning).

2. Methodology

The authors conducted a Systematic Literature Review (SLR) following a rigorous protocol:

• Search Strategy: Queries were performed across major databases (IEEE Xplore, ACM, Springer, Elsevier, etc.) using keywords related to "Metaheuristics," "Machine Learning," "Intrusion Detection," and "IoT."
• Timeframe: Papers published between 2020 and 2024 were selected to ensure relevance to current trends.
• Selection Criteria:
  • Inclusion: IoT-specific IDS, integration of metaheuristics with ML, peer-reviewed journal/conference papers.
  • Exclusion: Non-IoT specific studies, papers focusing solely on specific attack types (e.g., only botnets), blockchain/fog computing specific studies (unless directly relevant to the core ML/optimization integration), and non-English papers.
• Final Dataset: From an initial pool of 765 articles, 111 high-quality papers (90% journals, 10% conferences) were selected for analysis.
• Analysis Framework: The review categorized studies based on:
  • Metaheuristic types (Swarm-based, Nature-inspired, Evolutionary, Physics/Math-based, Human-inspired, Hybrid).
  • ML techniques (Supervised, Unsupervised, Deep Learning, Ensemble).
  • Application of metaheuristics (Feature Selection, Parameter Tuning, Hyperparameter Tuning, Hybrid).
  • Datasets used and performance metrics.

3. Key Contributions

The paper makes several distinct contributions to the field:

1. Comprehensive Taxonomy: It proposes a large-scale, visualized taxonomy of metaheuristics and ML-integrated IoT-IDSs, categorizing them by algorithm type and application.
2. Hidden Correlation Analysis: Unlike previous works, this study uncovers hidden correlations between specific metaheuristic algorithms, ML models, and the datasets they are tested on. It identifies which combinations yield the highest performance on specific benchmarks.
3. Application-Specific Breakdown: It separately analyzes the effectiveness of metaheuristics in four distinct roles:
   • Feature Selection (FS): Selecting optimal subsets of data.
   • Parameter Tuning (PT): Optimizing model weights/biases.
   • Hyperparameter Tuning (HPT): Optimizing learning rates, layer counts, etc.
   • Hybrid Usage: Combining FS with PT or HPT.
4. Critical Gap Identification: The authors highlight critical issues in current research, such as the reliance on outdated/imbalanced datasets, the lack of explicit reporting on selected features, and the failure of most models to operate in real-time (offline training vs. online testing).
5. Future Directions: It suggests unexplored metaheuristics (e.g., Microbiology-inspired, Chemistry-based) and novel integrations like GANs (Generative Adversarial Networks) combined with metaheuristics for handling data imbalance and zero-day attacks.

4. Key Results and Findings

A. Metaheuristic Performance

• Dominant Algorithms: Nature-inspired metaheuristics (e.g., Grey Wolf Optimizer - GWO, Firefly Algorithm - FOA, Whale Optimization Algorithm - WOA) are the most widely used, appearing in over 50% of top-performing systems. Swarm-based (PSO, ACO) and Hybrid approaches are also significant.
• Application Distribution:
  • Feature Selection (FS): The most common application (~58.4%), used to reduce dimensionality and computational load.
  • Hyperparameter Tuning (HPT): ~13.3%.
  • Parameter Tuning (PT): ~12.4%.
  • Hybrid (FS + PT/HPT): ~15.9%.

B. Machine Learning & Datasets

• Top ML Models:
  • Ensemble Learning (EL) and Random Forest (RF) consistently achieve the highest accuracy (99.6%–99.9%) on datasets like NSL-KDD and UNSW-NB15.
  • Deep Learning (DL): Convolutional Neural Networks (CNN) and LSTM variants perform exceptionally well on the BoT-IoT and CICIDS-2017 datasets, often outperforming traditional ML when paired with nature-inspired optimizers.
• Dataset Usage:
  • NSL-KDD (29.9%) and UNSW-NB15 (22.4%) are the most used.
  • Critical Observation: Many datasets are highly imbalanced and outdated (created before 2020), lacking features of modern sophisticated attacks. High accuracy scores on these datasets may be misleading; F1-score is identified as a more reliable metric.

C. Performance Metrics

• Top-performing systems report accuracy between 99.0% and 100% and F1-scores between 98.0% and 99.99%.
• However, the paper notes that "Accuracy" is a poor metric for imbalanced datasets, and researchers must prioritize F1-score, MCC, and G-mean.

5. Significance and Future Directions

This review serves as a definitive guide for researchers developing IoT-IDS by:

• Validating the Synergy: Confirming that metaheuristics are essential for making ML-driven IDS feasible in resource-constrained IoT environments by optimizing model efficiency.
• Guiding Future Research:
  • New Algorithms: Encouraging the exploration of Microbiology-inspired (e.g., Bacterial Foraging) and Chemistry-based (e.g., Kinetic Gas Molecules) metaheuristics, which are currently underutilized in IoT-IDS.
  • Advanced Architectures: Proposing the integration of GANs with metaheuristics to generate synthetic data for minority classes and tune GAN parameters for better zero-day attack detection.
  • Real-time & Edge Computing: Addressing the need for incremental learning and online IDS to handle dynamic traffic without retraining from scratch.
  • Explainability: Moving towards Explainable AI (XAI) to make IDS decisions interpretable for security analysts.

In conclusion, the paper establishes that while metaheuristic-ML integration has significantly advanced IoT security, the field must move beyond static, offline testing on old datasets toward dynamic, real-time, and explainable systems capable of handling the evolving threat landscape of the IoT ecosystem.