Efficient Two-Stage Intrusion Detection System Based on Hybrid Feature Selection Techniques and Machine Learning Classifiers

Abstract

The growing threats of cyberattacks make the integration of machine learning into Intrusion Detection Systems (IDS) increasingly important. However, existing approaches face challenges in effectively analysing diverse types of attacks within complex network architectures. This paper presents a new two-stage mechanism fusing Cuckoo Search and K-means clustering with machine learning classifiers for enhancing IDS performance. In the first stage, the dataset is partitioned into two clusters, C1 and C2, based on harmony between records such that similar and relevant subsets of data alone are considered. In the second stage, the Cuckoo Search algorithm is executed in high-harmony clusters, iteratively choosing effective features for intrusion detection. Targeted feature selection reduces search space. The efficiency and effectiveness of the proposed mechanism are validated through UNSW-NB15 and NSL-KDD datasets and mirror improvement in feature optimization and intrusion accuracy. The proposed mechanism effectively discards irrelevant features and considers only salient ones, reducing the feature count to 22 from 49 in the case of UNSW-NB15 and 19 from 41 in the case of the NSL-KDD dataset. The proposed model reaches an astounding accuracy of 99.78% in the case of UNSW-NB15 and 98.7% in the case of NSL-KDD datasets. By reducing search space, computational complexity is reduced, and accuracy and processing time are increased. These results exhibit the effectiveness of the proposed mechanism in improving the decision-making efficiency of IDSs in complex sensor networks for performance and security improvement.