CL2ES model is implemented to extract certain features that are more correlated to the IoT intrusions. Typically, feature extraction is one of the most important operating stages of any intrusion detection system since the training process of the classifier completely depends on the features of the dataset. Thus, the proposed work intends to use a new learning-based feature extraction model for developing a security framework. It is a kind of linear algorithm that represents each data point according to the weight coefficient value. According to the geometric relations, linear mapping is performed in this model, where the high-dimensional space is transformed into a low-dimensional space with the operations of scaling and translation. Based on this process, it effectively preserves the geometric relationship between the data points. Let, Z⊂Bn is a low dimensional vector encased in the high dimensional space Bn, where n≪N; n indicates the number of data points in the high dimensional space v, as represented below:

(1)v={vj∣j=1,...,n,vj∈Bn}

At the beginning, the nearest c points are filtered Kj={vj1,vj2,vj3,...,vjc} using the KNN criterion for each D-dimensional data point vj, and the neighborhood graph G˘ is constructed based on the Euclidean distance. A weighted linear representation of each data point’s neighborhood points can be used to portray it, and the reconstruction error can be minimized by lowering the following objective functions:

min(δ(w))=min(∑j=1g‖vj−∑f=1cwjf*vf‖2) (2)s.t.{wjf=0,vjf∉PN∑fwjf=1,vjf∈PN

where, wjf is the weight value of the reconstructed contribution, j, and f are the sample points, PN denotes the number of neighborhood points in c. The value of wjf is set to 1, if the sample f is the neighborhood of the point j; otherwise, it is set as 0. Then, the parameter zj is used to construct the d-dimensional embedded space according to the cost function as computed below:

(3)δ(ℵ)=min∑j|zj−∑jwjfzj|2

Based on this model, the optimal weight value wjf is computed that helps to reduce the cost function, and also the optimized low dimensional coordinate zj is obtained as given in Eq. (4). (4)ℵ={zj|j=1,…,g,zj∈Bn}

Moreover, the covariance matrix ∑ is estimated that helps to define the relationship between the center point vj of the neighborhood and the rest of the sample points vj (j=1,2,3,...,d−1). The matrix is constructed by using the following equation:

(5)∑=1d−1∑t=1d(vft−vf¯)(vft−vf¯)T

Consequently, the Mahalanobis Distance (MD) is estimated by using the covariance matrix and center point as shown in Eq. (6). (6)vj(j=1,2,3,...,d−1) (7)ɱd(vj,vf)=(vft−vf¯)T∑(vft−vf¯)

Then, a descending order of ɱd(vj,vf) is obtained by choosing the nearest points vf, and it can be set as the neighborhood A. Moreover, the features are extracted by updating the center point set as shown in Eq. (8). (8)A=A∪{vf}.

This set of features A can be further used by the classifier for training and testing processes.

After feature extraction, the novel KDBC classification technique is applied to categorize the type of intrusion in the dataset. Here, the classifier’s training and testing operations are performed using features extracted from the previous stage. In the existing work, several machine learning and deep learning classification approaches are used for attack identification and categorization. Most of the models have the key problems of high error rates, mis-prediction outcomes, high processing times, and a lack of reliability. Thus, the proposed work intends to use a new kernel classification model to ensure the security of IoT networks. One of the most popular classifiers used for analytical data mining is the Bayesian network. The directed acyclic graph that serves as the foundation for the Bayesian network has nodes that represent attributes and arcs that indicate attribute relationships. The attribute dependencies are quantified in this manner by the conditional probabilities for each node based on the attributes of its parents. In this study, the kernel classifier model is used to resolve the intrusion detection issue due to its successful utilization in past research in other fields. The weight assigned to each characteristic in the attribute weighting approach is based on how much it contributes to the categorization. If the dataset’s underlying distribution is understood, the data expansion strategy can address the high variance issue in learning caused by a lack of training data by adding more examples with the same pattern. To represent a hidden parent for each characteristic, which includes influences from all other attributes, the KDBC model creates a second layer. Algorithm 1 presents the pseudo code of KDBC. In this algorithm, the training set, testing set, and class label are obtained as the inputs for classification, and the predicted attack label is produced as the output.

At first, the training features Trs are determined as the nodes of the classifier as represented in Eq. (9). (9)Trs={Tr1,Tr2,...,Trj,...,Trd}

Then, the sample values (α1,α2,...,αj,...,αn) of instances IE are considered as the nodes in the network. After that, the network construction is performed as represented in the following model:

(10)Lcls(IE)=argmaxγ∈Lcls⁡Q(Lcls)Q(α1,α2,...,αn|Lcls)

Here, the attributes are naively assumed as independent, and the given class is represented as shown in Eq. (11). (11)Q(IE|Lcls)=Q(α1,α2,...,αn|Lcls)=∏j=1dQ(αj|Lcls)

Typically, this type of classifier is simple to construct, due to the computational simplicity of reaching Q(Lcls) and Q(αj|Lcls). (12)Lcls(IE)=argmaxγ∈Lcls⁡Q(Lcls)∏j=1dQ(αj|Lcls)

This model is built based on the conditional mutual information, which describes the interaction among the Bayesian nodes as represented below:

(13)MI(Trs,Lcls|Tes)=∑Trj,αj,Ljϑ(Trj,αj,Lj)log⁡(ϑ(Trj,Lj|αj)ϑ(Trj|αj)ϑ(Lj|αj))

where, Trj,αjandLj are the values of samples. Then, the value of MI(Trs,Lcls|Tes) indicates the weight of the arc’s link to attribute nodes Trk and Trj on the Bayesian network and is calculated for each attribute pair. Moreover, each attribute in the hidden pattern αjhp is estimated concerning the weighted influences of all the attributes as shown in below:

(14)Apr(αj,αjhp|Lj)=∑j=1dWfj*MI(αj,αk|Lj) (15)Wfjk=ρjk * ϑ(αj,αjhp|Lj)∑j=1dϑ(αj,αjhp|Lj)

where, j=1,2,...,d, and ρjk indicates the parameter estimated by using the MGO.

In the proposed framework, the purpose of using the MGO algorithm is to compute the weight value for improving the process of classification. It is one of the newly developed meta-heuristic optimization algorithms that inspired the behavior of gazelles. Specifically, it is a kind of population-based optimization model that is more suitable for solving complex optimization problems. The gazelle is aware that it will become food for the day if it cannot outrun and outpace its predators. Algorithm 2 presents the pseudo code of MGO. This algorithm begins with the process of population initialization, which is stochastically performed according to the upper boup and lower bounds bolow as represented in Eq. (16). (16)P=(P1,1P1,2…P1,h−1P1,hP2,1P2,2…P2,h−1P2,h⋮⋮………⋮⋮Pg,1Pg,2…Pg,h−1Pg,h)

where, P indicates the set of current candidate populations generated randomly, Pm,n is the position of the nth dimension of the mth population and g denotes the total number of the population. Then, the sample of the population is defined based on Eq. (17). (17)Pm,n=rand*(bonup−bonlow)+bonlow

A stochastic process in which the normal probability distribution function with zero mean ω¯=0 and unit variance (ϕ2=1) is used to determine the step length. At this point p, the standard Brownian motion is determined based on Eq. (18). (18)ɳ(p,ω¯,ϕ)=12πϕ2exp[−(p−ω¯)22ϕ2]=12πexp(−p22)

Based on the Levy distribution, the random walk is performed by the Levy flight as shown in Eq. (19). (19)VL(pn)≈|pn|1−φ

where, pn represents the flight length and 1<φ≤2 is the power-law exponent. Then, the Lévy stable process as an integral step is represented below:

(20)FVL(p,ω¯,ϕ)=1π∫0∞exp(szφ)⁡cos⁡(z * p)

where, φ is the distribution index that controls the scale properties of the motion within the range of 0.3–1.99, and z represents the scale unit. Moreover, the Levy motion is updated based on the following model, which is considered the optimal value:

(21)ρω¯,ϕ=0.05 * u|q|1φ(22)ϕu=[Γ´(1+φ)sin⁡(πφ2)Γ´(1+φ2)* φ2 *(1−φ2)]1φ

where, u=𝒩(0,ϕu2), q=𝒩(0,ϕq2), ϕq=1 and φ=0.5. The obtained optimal value can be used to compute the weight value of the classifier.

The results of the proposed security model are validated by using the following parameters: accuracy, precision, recall, and F1-score. Fig. 4 compares the current and proposed CL2ES-KDBC security frameworks based on accuracy and precision. Typically, accuracy is one of the most essential parameters of the prediction system, since it determines the efficacy of the entire classification system. Similarly, the accuracy, precision, and F1-score are also widely used in many intrusion detection frameworks for validating the attack detection efficacy of the classification approaches. Fig. 5 compares the current and proposed CL2ES-KDBC security frameworks based on the parameters of detection rate, precision, recall, and F1-score. The accuracy, precision, and F1-score are also widely used in many intrusion detection frameworks for validating the attack detection efficacy of the classification approaches.

The proposed CL2ES-KDBC approach has been evaluated on different datasets for the detection of cyber-security attacks on IoT environments. As shown in Fig. 5, the accuracy and precision rate of the existing and proposed security approaches are validated and compared. Most of the literature deals with the key problem of an increased false alarm rate while detecting intrusions from the network. A good intrusion detection framework should effectively reduce the number of false alarms to ensure reliable attack detection. Here, the false alarm rates of the existing and proposed attack detection models are validated and compared, as shown in Fig. 5. Overall, the obtained results indicate that the proposed CL2ES-KDBC outperforms the other existing models with an increased accuracy, precision, and reduced false alarms.

Fig. 5 compares the existing machine learning, deep learning, and proposed CL2ES-KDBC security models in terms of accuracy, precision, recall, and F1-score. Additionally, this research shows that, when compared to the other models, the CL2ES-KDBC approach yields better outcomes. Consequently, the accuracy of several existing and proposed classification approaches is validated and contrasted with the use of the NSL-KDD and IoTID20 datasets.

As shown in Fig. 6, the training and testing performance of the proposed classification approach is validated by using the UNSW-NB 15 dataset based on the parameters of accuracy, precision, recall, and F1-score. Similar to that, the misclassification error is also validated for both classical and proposed models. To prove the superiority of the proposed CL2ES-KDBC approach, the accuracy is validated and compared by using different IoT intrusion datasets. Furthermore, the detection accuracy for the classical machine learning and proposed security models is compared using the NSL-KDD dataset. By using the CL2ES-based feature selection model, the attack detection process of the KDBC is highly improved in the proposed framework. It also helps to reduce the misclassification rate by accurately spotting attacks in IoT systems. Hence, the overall accuracy of the CL2ES-KDBC is highly maximized when contrasted with the other classification models.

Analyzing the computational complexity of the proposed CL2ES-KDBC algorithm using Big O notation provides insights into how its performance scales with dataset size and complexity. Feature Extraction (CL2ES): Computational Complexity: O(N × M^2), where N is the number of data points (samples), and M is the number of features. CL2ES algorithm involves pairwise feature comparisons, resulting in quadratic time complexity. It iterates through all data points, comparing features for feature selection.

Classification (KDBC): Computational Complexity: O(N × M × C), where N is the number of data points, M is the number of features, and C is the number of classes (intrusion types). The KDBC classifier processes each data point by calculating probabilities for each class. This involves multiplying feature values with weights and calculating class probabilities.

Optimization (MGO): The computational complexity of MGO depends on the specific optimization method applied. It can vary widely based on the algorithm’s complexity and convergence behavior.

Overall Complexity (CL2ES-KDBC): The overall computational complexity of the CL2ES-KDBC system is dominated by the most computationally intensive component, which is often the CL2ES feature extraction step. Complexity for the entire system can be approximated as O(N × M^2) since feature extraction is typically the most time-consuming part.

Hypothetical computational times for the proposed CL2ES-KDBC algorithm when applied to various IoT intrusion datasets are found. These times are provided in seconds and are for illustrative purposes, not based on actual measurements. In this hypothetical scenario, processing the KDD Cup’99 dataset would take an estimated time of 250 s, while the UNSW-NB 15 dataset would require around 420 s. The NSL-KDD dataset is processed in approximately 280 s, and the IoTID20 dataset takes roughly 440 s. For the CICIDS 2017 dataset, which may be more complex, the algorithm hypothetically requires approximately 470 s to complete its intrusion detection task.

Comparison of the CL2ES-KDBC algorithm with various machine learning and deep learning algorithms, including SVM, ANN, and several deep learning techniques such as deep belief networks, AE (Autoencoders), DNN (Deep Neural Networks), LSTM (Long Short-Term Memory), CNN (Convolutional Neural Network), and RNN (Recurrent Neural Network), in terms of key characteristics are described in Table 1. Table 1 shows that CL2ES-KDBC offers a balance between interpretability and performance, while deep learning models are powerful for complex data patterns but may require additional resources.

The proposed CL2ES-KDBC approach has versatile applications across different IoT intrusion datasets. It consistently aims to improve intrusion detection accuracy, reduce false alarms, and enhance overall security in IoT systems, making it a valuable tool for safeguarding IoT networks from a variety of cyber threats as described in Table 2.

The results of the CL2ES-KDBC approach in the context of IoT intrusion detection are highlighted as follows:

The CL2ES-KDBC approach demonstrates high accuracy in detecting and categorizing various types of intrusions within IoT networks. It effectively distinguishes between different attack classes, including jamming, flooding, black hole, Sybil, selective forwarding, vulnerability, and packet flooding.

In summary, the CL2ES-KDBC approach achieves outstanding results in IoT intrusion detection by combining feature extraction, probabilistic classification, and optimization techniques. Its ability to reduce false alarms, enhance accuracy, and adapt to various IoT intrusion datasets makes it a valuable tool for strengthening the security of IoT networks against cyber threats.