The Internet of Things (IoT) has developed significantly and is performing an important role in the day-to-day lives of human beings [1]. IoT nodes make use of internet protocol addresses and connect to the internet. Such self-configured smart nodes are directed over most cutting-edge application areas, namely, smart education, home automation, decision analytics, smart grids, smart cars, process automation, industrial development, health care system, and many more [2,3]. As per experts, the future is here in which the community exists with as many connected gadgets alike the individuals surviving on this globe. If the volume of applications for IoT increases, the risks also increase in terms of misusing the IoT gadgets for malignant activities such as spying on others, disruption of power networks, remote control of building control systems and even potentially operating traffic signals [4,5].

Conventional firewalls were used for packet filtering earlier, which had many disadvantages, such as rigid pre-defined rules for effective external network assaults. These assaults are very familiar to security specialists. So, there exists a demand for the incorporation of an extra Intrusion Detection System (IDS) with a firewall which alarms the system administrator in case of doubtful signs of anomalies [6]. This method allows the security of adaptable networks by which the anomaly-related IDS can provide a few valuable reviews to network administrators in terms of new and original attack forms as they appear. In general, a firewall necessitates an up-gradation together with an example of the attack types encountered earlier so that it can identify it in future encounters [7,8].

Based on the detection technologies utilized by the system, IDS may be split into Misused-related IDS (MIDS) and Anomaly-related IDS (AIDS). AIDS has the merit of identifying new forms of intrusions [9,10]. It accomplishes a profile of usual operations via Machine Learning (ML) technique. Whenever the activities of a recent subject diverge from its ordinary profile, it is classified as an ‘intrusion’ conduct created by distinct algorithms [11]. Based on well-known system defects and intrusion designs, MIDS has the potential to identify a few distinctive attacks in a precise manner. However, it heavily depends on pre-defined security plans to identify strange attacks on the system, which results in a lack of identification altogether [12]. With the arrival of big data in recent times, conventional IDSs that depend upon signature-oriented recognition methodologies can be enhanced using ML and Artificial Intelligence (AI) techniques to achieve high-precision design based on previous attack data [13]. Such ML methods might depend on a single classifier using one classification method or multi-classifiers that employ different classification models simultaneously.

In the literature [14], the researchers developed an IDS and implemented and evaluated the precision of the technique. This novel IDS applies a hybrid placement approach related to a multi-agent scheme. This novel scheme contains data management modules, data collection modules, response modules, and analysis modules. To validate the proposed model, this study employed Deep Neural Network (DNN) architecture to detect intrusions. The researchers in the study conducted earlier [15] demonstrated an IDS-based ML method for implementation into an IoT platform as a Service. In this study, Random Forest was employed as a classifier to detect the intrusions while Neural Network (NN) classification was deployed for identifying the intrusion.

In the study conducted earlier [16], the researchers presented feature clusters in terms of Flow, Transmission Control Protocol (TCP), and Message Queuing Telemetry Transport (MQTT) through the UNSW-NB15 data feature. Then, the researchers overcome the challenges such as the curse of dimensionality, imbalanced dataset, and overfitting. Next, the study employed supervised ML techniques such as Artificial Neural Networks (ANNs), Random Forest (RF), and Support Vector Machine (SVM) on the cluster. Hawawreh et al. [17–21] presented advanced anomaly detection methodologies that could validate and learn through data gathered from TCP/IP packets. It embraces a successive training procedure, implemented by Deep-FeedForward Neural Network (DNN-FFNN) and Autoencoder (AE) structure, estimated by two popular network datasets.

The current study develops an Enhanced Metaheuristics with Machine Learning enabled Cyberattack Detection and Classification (EMML-CADC) model in an IoT environment. The proposed EMML-CADC model primarily employs data pre-processing to normalize the data into a uniform format. In addition, the Enhanced Cat Swarm Optimization-based Feature Selection (ECSO-FS) approach is applied to choose the optimal feature subsets. Besides, Mayfly Optimization with Twin Support Vector Machine (MFO-TSVM) model is also utilized for the detection and classification of cyberattacks. The MFO model has been exploited to fine-tune the TSVM variables to achieve enhanced results. The proposed EMML-CADC model was experimentally validated for its performance using a benchmark dataset, and the results were inspected under several measures.

In this study, a novel EMML-CADC model is developed to enhance the efficiency of cyberattack detection in an IoT environment. To attain this, the proposed EMML-CADC model primarily employs data pre-processing to normalize the data into a uniform format. In addition, the ECSO-FS approach is applied to choose the optimal feature subsets. Besides, the MFO-TSVM model is also utilized for the detection and classification of cyberattacks. The details related to each module are elaborated on in the succeeding sections.

In this section, the proposed model was experimentally validated using the UNSW-NB15 dataset (https://research.unsw.edu.au/projects/unsw-nb15-dataset). The dataset contains a total of 2,540,044 records or network connections, and there are 10 different classes of attacks that can be detected, along with a class representing normal network traffic. Here are the details of the number of records for each class of attacks: Backdoor: 1746 DoS: 12264 Exploits: 44525 Fuzzers: 24246 Generic: 215481 Reconnaissance: 55604 Shellcode: 1511 Worms: 130 Analysis: 200 Normal: 93000. For experimental validation, ten-fold cross-validation is used.

The results were investigated under several measures. The proposed model is simulated using Python 3.6.5 tool on PC i5-8600k, GeForce 1050Ti 4GB, 16GB RAM, 250GB SSD, and 1TB HDD. The parameter settings are given as follows: learning rate: 0.01, dropout: 0.5, batch size: 5, epoch count: 50, and activation: ReLU. Table 1 reports the overall classification results achieved by the EMML-CADC model on distinct class labels. Fig. 3 illustrates a brief overview of precn, recal, and detection rate (DR) outcomes accomplished by the proposed EMML-CADC model under different classes. The figure indicates that the EMML-CADC model accomplished enhanced outcomes in every class. For instance, with normal class, the EMML-CADC model achieved precn, recal, and DR values such as 82.36%, 86.60%, and 86.35%, respectively. At the same time, with the exploits class, the EMML-CADC system attained precn, recal, and DR values such as 82.68%, 82.15%, and 80.75%, correspondingly. Moreover, with the Generic class, the proposed EMML-CADC method yielded precn, recal, and DR values such as 80.89%, 84.98%, and 97.23%, respectively. Also, with the worms class, EMML-CADC methodology accomplished precn, recal, and DR values such as 86.29%, 83.39%, and 83.78%.

Fig. 4 demonstrates a brief overview of accuy, Fscore, and Mathew Correlation Coefficient (MCC) values accomplished by EMML-CADC methodology under different classes. MCC provides a balanced measure of classification performance. The MCC value ranges from −100 to 100, where a score of 100 represents a perfect prediction, 0 represents a random prediction, and −100 represents a total disagreement between the prediction and the true labels. The figure infers that the proposed EMML-CADC system accomplished enhanced outcomes under every class. For example, with typical class, the EMML-CADC model achieved an accuy of 92.16%, Fscore of 90.85% and MCC of 81.35% correspondingly. Meanwhile, with the exploits class, the presented EMML-CADC method accomplished precn, recal, and DR values such as 88.10%, 88.21%, and 79.67%, respectively. Additionally, with the Generic class, the proposed EMML-CADC algorithm attained precn, recal, and DR values such as 90.34%, 88.75%, and 82.72% correspondingly. Likewise, with worms class, the proposed EMML-CADC model yielded precn, recal, and DR values such as 90.54%, 91.27%, and 85.29%, respectively.

Table 2 and Fig. 5 demonstrate a brief overview of Elapsed Time (ET) analysis results achieved by the proposed EMML-CADC model on training (TR) and testing (TS) data. The experimental results demonstrate that the EMML-CADC model required the least ET values under both TR and TS data. For instance, under normal class, the proposed EMML-CADC model obtained an ET of 4.0500 and 2.0280 s on TR and TS data, respectively. Meanwhile, with the DoS class, the EMML-CADC method attained an ET of 0.0110 and 0.0260 s on TR and TS data correspondingly. Eventually, with a generic class, the presented EMML-CADC methodology obtained an ET of 1.9220 and 0.0510 s on TR and TS data, respectively. Along with that, with the worms class, the EMML-CADC system reached an ET of 0.0030 and 0.0320 s on TR and TS data correspondingly.

Table 3 and Fig. 6 provide a brief illustration of Computational Time (CT) analysis results achieved by the EMML-CADC model on TR and TS datasets. The experimental results demonstrate that the EMML-CADC system required the least CT values under both TR and TS datasets. For example, with normal class, the EMML-CADC model achieved a CT of 0.9200 and 0.0381 s on TR and TS datasets, respectively. In the meantime, with the DoS class, the EMML-CADC model obtained a CT of 0.0110 and 0.0034 s on TR and TS datasets correspondingly. Finally, with generic class, the proposed EMML-CADC model obtained a CT of 0.0940 and 0.0140 s on TR and TS datasets, respectively. In addition to these, with worms class, the proposed EMML-CADC model obtained a CT of 0.0010 and 0.030 s on TR and TS datasets correspondingly.

Table 4 and Fig. 7 portray the results of comparative DR analysis between the EMML-CADC model and other existing models. The results indicate that the proposed EMML-CADC model achieved better performance than other models. For instance, with standard class, the EMML-CADC model achieved a higher DR of 86.35%, whereas Particle Swarm Optimization (PSO)-light Gradient Boosting Machine (GBM), CMLW, Opt. Convolution Neural Network (CNN), Naïve Bayes (NB), and K-Nearest Neighbor (KNN) models achieved the least DR values such as 80.85%, 57.68%, 78.08%, 52.70%, and 83.60%, respectively. In addition, with the Denial of Service (DoS) class, the EMML-CADC system attained a high DR of 95.94%, while PSO-Light GBM, CMLW, Opt. CNN, NB, and KNN techniques achieved the least DR values, such as 15.40%, 15.60%, 36.22%, 33.50%, and 97.70%. In line with these, with generic class, EMML-CADC methodology presented a high DR of 97.23%, whereas PSO-Light GBM, CMLW, Opt. CNN, NB, and KNN approaches exhibited the least DR values, such as 84.34%, 96.20%, 96.19%, 42.80%, and 44.80%, correspondingly. At last, with worms class, the EMML-CADC method offered a high DR of 83.78%, whereas PSO-Light GBM, CMLW, Opt. CNN, NB, and KNN techniques accomplished the least DR values, such as 77.78%, 33.67%, 54.55%, 40%, and 51.15%, correspondingly.

A comparison study was conducted between the EMML-CADC model and other techniques in terms of accuracy, and the results are shown in Table 5 [29]. Fig. 8 depicts the comparative accuy examination results achieved by the EMML-CADC model against recent techniques. The improved Extreme Learning Machine (I-ELM) model achieved a slightly low accuy of 67.01%, whereas the Expectation-maximization model reported a moderately improved accuy of 78.47%. Followed by Logistic Regression (LR) and NB models demonstrated slightly enhanced accuy values such as 83.15% and 82.07%, respectively. In line with this, PSO-Light GBM, TSDL_DT, and Decision Tree (DT) models demonstrated considerably higher accuy values, such as 86.68%, 85.56%, and 85.56%, respectively. However, the presented EMML-CADC model outperformed all other methods and achieved the highest accuy of 90.88%.

Fig. 9 shows the comparative False Acceptance Rate (FAR) analysis results accomplished by the EMML-CADC method and existing methods. The I-ELM model presented the highest FAR of 31.96%, whereas the Expectation-maximization model achieved a moderately lesser FAR of 23.79%. Next, LR and NB models accomplished slightly lesser FAR values, such as 18.48% and 18.56%, correspondingly. In line with this, PSO-Light GBM, TSDL_DT, and DT methodology illustrated significantly lesser FAR values, such as 10.62%, 15.78%, and 15.78%, correspondingly. However, the proposed EMML-CADC model achieved the least FAR of 9.12% and outperformed all other methods.

By looking into the above-mentioned tables and figures, it is apparent that the EMML-CADC model accomplished superior results over other methods.

In this study, a novel EMML-CADC model has been developed to enhance the efficiency of cyberattack detection in an IoT environment. To attain this, the proposed EMML-CADC model primarily employs data pre-processing to normalize the data into a uniform format. In addition, the ECSO-FS approach is applied to choose the optimal feature subsets. Besides, the MFO-TSVM model is utilized for the detection and classification of cyberattacks. Here, the MFO model has been exploited to fine-tune the TSVM variables for enhanced results. The performance of the proposed EMML-CADC technique was validated using a benchmark dataset, and the results were inspected under several measures. The comparative study results conclude that the EMML-CADC method is superior to other existing approaches under distinct measures. In future, advanced deep learning classifiers can be involved in the proposed method to improve intrusion detection efficacy in IoT platforms.