A zero-day attack becomes an innovative cyberattack that will remain unidentified to the cybersecurity community and public, known as “zero-day”. This employs the vulnerabilities that cannot be revealed openly or utilizes new attacking approaches for preventing those identified by present detection tools [1]. Attackers will be attacked by the objectives of their selection when residual unknown. A network intrusion detection system (NIDS) is a crucial security tool that recognizes attacks as they enter the network setting of organizations. Conventional signature-based NIDSs examine received network traffic for some Indicator of Compromise (IOC), called attack signatures such as hash values, domain names, and source IPs that specify the malicious traffic [2]. A significant challenge in protecting computer networks with signature-based NIDSs is the identification of zero-day attacks. Organizations safeguarded by signature-based NIDS are susceptible to zero-day attacks with no detection of IOCs related to the attacks [3]. Therefore, the attention is directed to the development of ML-based NIDSs, an improved current version of conventional NIDSs, to address the challenges in identifying zero-day or unnoticed attacks. ML-based NIDSs are developed and are also used for scanning and analyzing the received network traffic for some anomalies or malicious intentions [4]. ML functions are proficient in recognizing complex, up-to-date attacks that need advanced state-of-the-art identification abilities. The integration of intelligence into the organization’s security scheme includes sophisticated layers of defence that will limit the amount of external and internal attacks, whether developed effectively [5].

ML and DL are highly popular and limited approaches to simplifying tasks. It comprises intrusion detection that will be a strong possibility of identifying both zero-day and prominent signature attacks [6]. Accordingly, the requirement for robust IDSs that are efficient at recognizing zero-day assaults is improving. In recent years, the abilities of ML have been employed to increase the effectiveness and performance of numerous technological applications. ML has a subdomain of artificial intelligence (AI), comprising a collection of statistical methods that can be learned from data without being algorithmically trained [7]. ML techniques are identified for their higher capacity for extracting and learning complex data patterns, which experts in the field cannot possibly notice. The learned patterns can be exploited for prediction, classification, and regression of the prospective activities and situations [7]. ML is a breakthrough novelty in various industries, wherein functioning automation and effectiveness are essential. Hence, ML methods are extensively utilized in several fields, demonstrating significant achievements over conventional computing techniques [8]. A similar inspiration provides the application of ML approaches in the cybersecurity field to enhance security in organizations. Providentially, DL techniques are recognized for their capabilities to deal with unlabelled or labelled data or resolve complex issues through the higher-powered GPU [9]. The increasing complexity of cyber threats, particularly those exploiting unknown vulnerabilities, poses a serious threat to conventional security measures. There is a critical need for advanced detection techniques that can identify emerging and previously unseen attacks to protect network environments.

This study presents the Zero-day attack detection employing an equilibrium optimizer with a deep learning (ZDAD-EODL) method to ensure cybersecurity. Initially, the min-max scalar is utilized for normalizing the input data. For feature selection (FS), the ZDAD-EODL method utilizes the EO model to choose feature sub-sets. In addition, the ZDAD-EODL technique employs the bi-directional gated recurrent unit (BiGRU) technique for the classification and identification of zero-day attacks. Finally, the detection performance of the BiGRU technique is further enhanced through the implementation of the subtraction average-based optimizer (SABO)-based tuning process. The performance of the ZDAD-EODL approach is investigated on the benchmark dataset. The key contribution of the ZDAD-EODL approach is listed below.

The ZDAD-EODL model applies min-max scalar normalization for scaling input features between a fixed range, enhancing convergence speed and training stability. This ensures uniform feature contribution and improves the performance of the model. It supports better feature learning for downstream tasks. This step contributes to overall detection efficiency.

Wu et al. [10] developed an innovative active learning architecture dependent upon Deep Q-Networks (DQNs) for zero-day attack recognition. This technique was comprised of an NIDS module, an instance selection approach, and an annotator. DQN method assists as an intelligent controller module for choosing the zero-day instances in labeling with the likelihood distributions. In addition, the bi-directional long short-term memory (Bi-LSTM) model is combined with the DQN technique to make the selection policy for analyzing the temporal relationship with the static classification setting. Shen et al. [11] projected a heuristic learning intrusion detection system with Deep Q-Networks (DQN-HIDS) model for edge-based social Internet of Things (SIoT) systems in the setting of inadequate training instances. The SIoT networking traffic process element produces SIoT traffic instances, chooses instances received models and cybersecurity analysis, and outcomes similarity. The authors combined DQN with a heuristic learning model to steadily increase its capability in the identification of malicious traffic. Drozdenko and Powell [12] introduced a DL method for examining the traffic flow. Although deep neural networks (DNNs) can take extensive time to progress raw network packet capture (PCAP) profiles, training a DNN under data flow is the primary time-consuming step in identifying current cyberattacks. Akshaya and Padmavathi [13] intended to implement game theory in a real-time adverse environment, highlighting attack and security strategies employing an Adapted Bi-LSTM and Game theory with ANN-AE. Tests dependent upon gaming theory and a modified gaming system were used for performances. The Nash equilibrium method is implemented, and the conventional defence mechanism becomes an adversarial training method. Peppes et al. [14] developed a complete technique beginning with the creation of a zero-day variety, but realistic, tabular formats of data, and finally, the assessment of an NN detector of zero-day attacks to be trained with and without synthetic information. The method includes the development and deployment of generative adversarial networks (GANs) for producing a novel and massive dataset of zero-day attacks synthetically. Popoola et al. [15] implemented a federated deep learning (FDL) technique in zero-day botnet attack detection to prevent data privacy leakage. An improved DNN model was utilized for classifying the network traffic. A limitation of the technique is that the server remotely directs the self-sufficient DNN methods training at numerous IoT-edge devices. In contrast, the FedAvg technique was employed for combining the updates of the local model. A global DNN technique was generated later, involving a large amount of communication sequences among the IoT-edge gadgets and structural parameter servers. Priya and Annie Uthra [16] introduced an innovative DL-based VAE method for zero-day attack recognition. Such an investigation intends to develop a novel IDS with a higher detection rate and decreased false negative ration (FNR). The DL-assisted VAE model contains pre-processing to change the raw data into well-matched formats. Then, the pre-processed data was offered to the VAE model for identifying the incidence of zero-day assaults on the network data. Roshan and Zafar [17] presented an IDS that identified Zero-day and unknown cyberattacks. The authors employed the AE to make an intelligent IDS. The innovation of the developed study is to indicate how the threshold plays a vital role in the identification of zero-day cyberattacks with better recall. In addition, preferring a single threshold for a category of attacks cannot function efficiently in the alternative, unnoticed cyberattacks. Zahid et al. [18] proposed an optimized lightweight active security framework for detecting Slow-Rate Attacks in Industrial Cyber–Physical Systems using the Online Sequential Extreme Learning Machine (OSELM) technique. The framework reduces memory usage and detection time while improving accuracy through a simple stratified k-fold cross-training method.

Danquah et al. [19] presented a low-complexity federated learning (FL) model for detecting IoT botnet attacks using extreme gradient boosting (XGBoost) for FS, principal component analysis (PCA) for dimensionality reduction, and a differentially private multi-layer perceptron (MLP) trained locally by FL clients and aggregated via federated averaging (FedAvg). Khadidos et al. [20] proposed CyberSentry, a security framework for supervisory control and data acquisition (SCADA) systems that integrates recursive multi-correlation-based information gain (RMIG) FS, tri-fusion network (Tri-Fusion Net) for attack detection, and parrot-levy blend optimization (PLBO) for parameter tuning to improve detection accuracy and system resilience. Reddy et al. [21] explored the utilization of DL techniques such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), and generative adversarial networks (GANs) to improve zero-day attack detection through enhanced anomaly detection (AD), extraction, and behavioural analysis. Akshaya and Ganapathi [22] introduced a model using supervised learning and advanced models, comprising probabilistic graph-based backpropagation neural network (PGB-BPNN), modified bidirectional long short-term memory with game theory (Bi-LSTM-GT), artificial neural network autoencoder (ANN-AE), CNN with long short-term memory (CNN-LSTM), and residual network (ResNet50), along with a deep convolutional zero-day network and hybrid game theory with transfer learning (HGT-TL), achieving high detection accuracy. Abedallah et al. [23] proposed a comprehensive IoT security framework integrating five key methods, namely ML-based patch prioritization, scalable patch distribution (SPD), AD, dynamic risk assessment (DRA), and threat intelligence integration (TII), effectively detecting and mitigating zero-day vulnerabilities. Mohamed et al. [24] presented a probabilistic composite model for zero-day exploit detection. The model comprises adaptive wavepca-autoencoder (AWPA)-based pre-processing, meta-attention transformer autoencoder (MATA)-based feature extraction, Genetic Mongoose-Chameleon Optimisation (GMCO)-based FS, and adaptive hybrid exploit detection network (AHEDNet)-based dynamic ensemble detection. Dai et al. [25] introduced an enhanced zero-day attack detection approach using Autoencoder-based anomaly detection integrated with XGBoost (XGBoost-AE) and Random Forest (RF-AE), achieving high accuracy and robustness. Abid et al. [26] presented the Robust Zero-Day Attack Detection with Optimal Deep Learning (RZDAD-ODL) technique by utilizing Honey Badger Algorithm (HBA)-based FS, Conditional Variational Autoencoder (CVAE)-based attack detection, and Rider Optimisation Algorithm (ROA)-based parameter tuning. Saurabh et al. [27] proposed a hybrid DL model incorporating CNNs and LSTM networks for zero-day attack detection in IoT. Korba et al. [28] developed an anomaly-based detection framework incorporating semi-supervised learning with explainable artificial intelligence (XAI) to identify stealthy botnet command and control (C&C) traffic in IoT networks using only benign data for training. Korba et al. [29] developed Zero-X, a security framework integrating deep neural networks (DNN) with open-set recognition (OSR) and blockchain-based privacy-preserving FL to detect both zero-day (0-day) and known (N-day) attacks in the Internet of Vehicles (IoV).

Although various studies have exhibited DL, FL, and AE-based models for zero-day attack detection, a clear research gap exists in integrating these approaches within lightweight, real-time, and highly generalizable IDS for heterogeneous IoT and Industrial Cyber-Physical Systems (ICPS) environments. Many models, comprising DQN-HIDS, Bi-LSTM-GT, and CNN-LSTM, exhibit high accuracy but often lack scalability, adaptability, or robustness under imbalanced or evolving datasets. Models such as AE, GAN, and VAE enhance anomaly detection but suffer from threshold sensitivity or require extensive tuning. Some frameworks also discard effective cross-device or temporal generalization. In addition, restricted work utilizes unified optimization strategies for FS, tuning, and detection in a coordinated process.

In this manuscript, the ZDAD-EODL technique is presented to ensure cybersecurity. The ZDAD-EODL technique employs metaheuristic feature sub-set selection with an optimum DL-based classification method for zero-day attacks. Hence, the ZDAD-EODL method comprises different types of subprocesses, such as pre-processing, EO-based FS, BiGRU-based attack classification, and SABO-based parameter tuning. Fig. 1 shows the overall process of the ZDAD-EODL technique.

The attack detection findings of the ZDAD-EODL technique are inspected by the ToN-IoT dataset [33]. The method runs on Python 3.6.5 with an i5-8600k CPU, 4 GB GPU, 16 GB RAM, 250 GB SSD, and 1 TB HDD, using a 0.01 learning rate, ReLU, 50 epochs, 0.5 dropout, and batch size 5. It maintains 10,000 samples with 10 classes, namely Backdoor, Denial of Service (DoS), Distributed Denial of Service (DDoS), Injection, Man-in-the-Middle (MITM), Scanning, Ransomware, Password, Cross-Site Scripting (XSS), and Normal, as described in Table 2.

Fig. 3 explains the confusion matrices achieved by the ZDAD-EODL approach with 80%:20% and 70%:30% of the training set (TRAS) and testing set (TESS). These findings characterize the effective recognition with 10 samples across all classes.

The attack detection consequences of the ZDAD-EODL approach are demonstrated at 80%:20% of TRAS and TESS, as provided in Table 3 and Fig. 4. These outcomes indicate that the ZDAD-EODL approach achieves effective attack detection. With 80% of TRAS, the ZDAD-EODL model attains an average accuy of 98.38%, precn of 91.84%, recal of 91.84%, F1score of 91.83%, and AUCscore of 95.47%. In addition, depending on 20% of TESS, the ZDAD-EODL model attains an average accuy of 98.47%, precn of 92.38%, recal of 92.35%, F1score of 92.33%, and AUCscore of 95.75%.

The accuy examination for training (TRA) and validation (VAL) shown in Fig. 5 for the ZDAD-EODL technique at 80%:20% of TRAS and TESS provides a valuable understanding of its effectiveness at numerous epochs. Mainly, it is a continual updating at the TRA and TES accuy to improved epochs, specifying the skills of the approach for learning and recognizing patterns in both datasets. This increased tendency in TES accuy highlights the flexibility of the model to the TRA data and the capacity to provide accurate forecasts on unnoticed datasets, highlighting the abilities of strong generalizability.

Fig. 6 illustrates a wide-ranging finding of the TRA loss and TES loss values for the ZDAD-EODL technique at 80%:20% of TRAS and TESS at changing epochs. The loss of TRA is reliably minimized as the methodology enhances the weights to reduce errors of the classifier on either dataset. The loss examination noticeably represents the arrangements with the TRA dataset, underlining its capacity to seize patterns positively. The importance lies in the constant enhancement of parameters in the ZDAD-EODL model, aimed at lessening changes between real and predicted TRA labels.

Regarding the precision-recall (PR) curve illustrated in Fig. 7. The discoveries confirm that the ZDAD-EODL technique with 80%:20% of TRAS and TESS consistently yields higher PR values in each class. These acquired performances emphasize the effective capability of the method for distinguishing between different classes, underlining its efficiency in correctly identifying classes.

Simultaneously, Fig. 8 presents the ROC analysis performed using the ZDAD-EODL model with an 80%:20% split of TRAS and TESS, highlighting its ability to distinguish between classes. This curve provides valuable perceptions of how the tradeoff between true positive rate (TPR) and false positive rate (FPR) adjusts in multiple classification thresholds and epoch counts. The outcomes highlight the model’s accurate classifier efficiency on dissimilar classes, underlining its proficiency in overcoming several classification challenges.

The attack recognition outcomes of the ZDAD-EODL model are confirmed with 70%:30% of TRAS and TESS, as described in Table 4 and Fig. 9. These obtained findings display that the ZDAD-EODL approach obtains proficient recognition of the attacks. Based on 70% of TRAS, the ZDAD-EODL methods gained an average accuy of 98.13%, precn of 90.66%, recal of 90.63%, F1score of 90.63%, and AUCscore of 94.79%. Similarly, depending on 30% of TESS, the ZDAD-EODL process achieves an average accuy of 98.21%, precn of 91.06%, recal of 91.06%, F1score of 91.04%, and AUCscore of 95.03%.

The accuy curves for TRA and VAL illustrated in Fig. 10 for the ZDAD-EODL approach at 70%:30% of TRAS and TESS present valuable insights into its effectiveness at many epochs. Initially, it is a continual upgrading in the TRA accuy and TES accuy with improved epoch counts, indicating the abilities of the method for learning and identifiable patterns from both datasets. The advanced tendency in TES accuy highlight the flexibilities of the model to the TRA datasets and the capabilities to generate exact predictions on unobserved datasets, stressing the proficiency of strong generalizability.

Fig. 11 provides an all-inclusive outcome of the TRA loss and TES loss values for the ZDAD-EODL technique at 70%:30% of TRAS and TESS at several epochs. The loss of TRA continuously reduces as the method enhances the weights to lower classification errors in the datasets. The curves of loss noticeably denote the arrangements with the TRA dataset, heightening its capacities to detect seizure patterns. Substantial is the continual perfection of parameters in the ZDAD-EODL approach, directed at diminishing variances between actual and predicted TRA labels.

About the PR examination presented in Fig. 12, the results affirm that the ZDAD-EODL method at 70%:30% of TRASH/TESSH consistently yields higher PR values in all classes. The outcomes highlight the effective ability of the process for distinguishing between varied classes, highlighting its effectiveness in correctly recognizing classes.

Likewise, Fig. 13 illustrates ROC curves created in the ZDAD-EODL approaches at 70%:30% of TRASH/TESSH, signifying its ability to distinguish between classes. This curve provides a valuable understanding of how the tradeoff among FPR and TPR changes at varying classifier thresholds and epoch counts. The outcomes emphasize the model’s correct classifier effectiveness on various classes, accentuating its efficiency in tackling manifold classifier tasks.

The comparative results of the ZDAD-EODL technique are illustrated [4,18–20,34] in Table 5 and Fig. 14. These comparative results indicate that the Densely-ResNet model attains the poorest performance. Simultaneously, the OSELM, XGBoost, RMIG, logistic regression (LR), deep feed forward (DFF), RF, XGBoost, and Inception models obtained closer results. In addition, the ZDAD-EODL technique gains superior results with a maximum accuy of 98.47%, precn of 92.38%, recal of 92.35%, and F1score of 92.33%.

An extensive comparative computational time (CT) results of the ZDAD-EODL technique are presented in Table 6 and Fig. 15. These comparative results display that the Densely-ResNet model provides lower performance. Simultaneously, the OSELM, XGBoost, RMIG, LR, DFF, RF, XGBoost, and Inception models achieve closer results. However, the ZDAD-EODL method gains higher results with decreased CT of 3.70 s, respectively.

Table 7 and Fig. 16 specify the error analysis of the ZDAD-EODL approach with existing models. The ZDAD-EODL approach achieves the lowest error rates with an accuy at 1.53%, precn at 7.62%, recal at 7.65%, and F1score at 7.67%, indicating better overall reliability in predictions. In contrast, the Densely-Resnet model exhibits higher error values with an accuy of 7.01%, precn of 9.92%, recal of 8.35%, and F1score of 9.74%, indicating less consistent performance. Other models, such as OSELM and XGBoost, also exhibit relatively higher errors across metrics; for example, OSELM illustrates 1.76% accuy error and 8.98% F1score error. This analysis highlights that the ZDAD-EODL model provides more accurate and balanced detection capabilities with fewer errors compared to the alternative approaches evaluated.

Table 8 and Fig. 17 specify the ablation study of the ZDAD-EODL methodology with existing techniques. The EO model achieves an accuy of 96.20%, precn of 90.07%, recal of 90.08%, and F1score of 90.07%, serving as the baseline feature selection method. SABO-based tuning improves these metrics slightly, reaching an accuy of 96.80%, precn of 90.76%, recal of 90.81%, and F1score of 90.86%, indicating enhanced parameter optimization. The BiGRU classification model, in addition, improves performance with an accuy of 97.65%, precn of 91.61%, recal of 91.63%, and F1score of 91.71%, reflecting superior sequence modeling. Finally, the ZDAD-EODL model attains the highest scores with an accuy of 98.47%, precn of 92.38%, recal of 92.35%, and F1score of 92.33%, demonstrating the effectiveness of combining all components for optimal zero-day attack detection.

Therefore, the ZDAD-EODL model proved to be an effective tool for zero-day attack classification.

This study presents the ZDAD-EODL approach to ensure cybersecurity. The ZDAD-EODL technique employs metaheuristic feature sub-set selection with an optimum DL-based classification approach for zero-day attacks. The ZDAD-EODL methods comprise various kinds of sub-processes such as pre-processing, EO-based FS process, BiGRU-based classification, and SABO-based parameter optimizer. Primarily, the ZDAD-EODL method utilizes a min-max scalar for normalizing the input data. For FS, the ZDAD-EODL technique employs the EO model to choose feature subsets. In addition, the ZDAD-EODL technique employs the BiGRU model for the classification and identification of zero-day attacks. The detection performance of the BiGRU model is further enhanced through the implementation of the SABO-based tuning process. The performance of the ZDAD-EODL methodology is investigated under a benchmark dataset. The accomplished simulation results reported that the ZDAD-EODL methodology gains superior performance across other existing models. The limitations of the ZDAD-EODL methodology comprise potential challenges in handling highly dynamic and diverse IoT environments, which can affect detection robustness. The current model can also face difficulties adapting quickly to rapidly growing zero-day attack patterns. In addition, real-time implementation and resource constraints on edge devices were not fully explored. Future work should consider validating the model on larger and more diverse datasets to improve generalizability. Further research can concentrate on improving adaptability to new threats and optimizing the model for deployment in resource-limited IoT settings.