New business process innovations are being pushed forward by the Internet of Things (IoT), a network of interconnected computers and objects that can communicate and engage with one another. Individuals and enterprises confront a wide range of difficulties linked to their reputation, funding, and company operations as the frequency of cybersecurity attacks on IoT equipment grow fast and extensively [1]. In the cloud computing paradigm, consumers may access a wide range of services and resources on-demand, with little effort from either the service provider or the client [2]. The vast majority of IoT applications rely on the cloud to store and analyze their data. Due to the vast volumes of data that are kept in the cloud, security is a huge problem. Many factors have contributed to an increase in cyberattacks on cloud computing: the availability and accessibility of hacking tools have made it easier for hackers to carry out an attack, requiring no advanced knowledge or special skills [3]. Due to the increasing need for cybersecurity development, corporations and academic institutions throughout the world have been paying particular attention. Despite the adoption of a range of security measures, such as firewalls, antivirus software, encryption of critical data, and biometric authentication of end-users, cyberattacks continue to plague organizations and businesses. An attack on a computer can result in the disclosure of sensitive information if it is carried out by someone who knows how to exploit a system’s weaknesses. IoT systems’ confidentiality, integrity, and availability are always under threat from such attacks.

There are several ways to secure IoT devices from a wide range of threats, but one of the most successful is using intrusion detection systems (IDS). When a malicious attack is detected, an IDS can take immediate action to stop it from spreading throughout the network [4–6]. IDS may be divided into two categories based on their detection mechanisms: anomaly and misuse detection. Analyzing variations from normal profile activity helps anomaly detection pick up on potentially dangerous activities. These IDS have a high rate of false positives (FPs), but they are better at spotting new and novel attacks. In contrast, misuse detection is able to distinguish between legitimate and harmful activity based on previously recognized patterns [7]. They can identify known attacks with certainty; however, these IDS cannot tell the difference between new and previously known attacks. The accuracy of IDS might be improved with the use of machine learning (ML) approaches, although this has yet to be accomplished [8–10]. An efficient IDS must be able to distinguish between valid and malicious network traffic, as well as detect the sort of attack that is taking place on the protected system while analyzing network data. For ML, the vast diversity of attack methods and network traffic properties increases the computational and temporal complexity of the issue search space [11].

In order to enhance the description of patterns in various classes, feature selection (FS) is a strategy that removes unnecessary and redundant features and selects the optimal subset of features. Wrappers and filters in the FS selection process are classified according to the application of learning algorithms. Filter algorithms use an independent criterion to analyze the link between a collection of features (such as information measures, distance measures or consistency measures). On the other hand, wrapper algorithms employ unique algorithms to evaluate the value of a certain collection of attributes. If you’re looking at classification accuracy, wrapper strategies outperform filter approaches since the proposed subset of features is reviewed using feedback from the learning process. They are, however, computationally more expensive than filters since their effectiveness is so heavily reliant on the learning process. Finding the nearly optimum collection of features is a key consideration while creating an FS algorithm. Traditional approaches such as breadth searches, depth searches, and others are infeasible when it comes to picking the optimal subset of attributes in large datasets; neural networks (NN), for example, are wrapper-based techniques that need 2 N separate subsets of a dataset with N features, each of which must be constructed and evaluated separately [12]. As a result, FS is considered an NP-hard optimization issue. Selecting a small number of features while yet maintaining a high level of accuracy is the primary focus of the algorithm’s goal function. A multi-objective optimization problem or a single-objective optimization problem might be devised in order to obtain trade-off solutions between the two opposing purposes, as is commonly the case in feature selection literature.

Metaheuristics algorithms have recently shown good performance in a range of optimization contexts because of their dynamic search behavior and global search capabilities [13]. Particle swarm optimization (PSO) [14], grey wolf optimizer (GWO) [15], harmony search (HS) [16], seagull optimization algorithm (SOA) [17], multiverse optimization (MVO) [18], bowerbird optimization (SBO) [19], and dipper throated optimization (DTO) [20] are a few examples of how it has been frequently employed in the literature to give acceptable solutions to FS tasks. However, all metaheuristic optimization algorithms must balance the exploration and exploitation stages in order to avoid getting stuck in local optima or failing to converge. Randomness abounds in the search for solutions in metaheuristic algorithms, and this is to blame for the difficulties encountered. A combination of ideas from different scientific fields is required in order to solve this problem. Through the process of hybridization, it is possible to construct an algorithm with enhanced speed and accuracy by combining the best features of many existing approaches.

Hybrid algorithms outperformed single-algorithm approaches in the study of literature. It’s still true that no algorithm is better than any other in every feature selection situation, according to the no-free-lunch (NFL) theory [21]. As a result, new algorithms need to be developed, or existing algorithms need to be enhanced by making modifications to their operators in order to better cope with feature selection challenges. A novel method to improve the performance of GWO metaheuristic algorithm has been presented in this paper based on DTO algorithm. In the proposed approach, DTO is used to alter the search operators of GWO to improve its performance through this hybridization. When compared to other well-known metaheuristic algorithms, the original GWO authors said that it is a very competitive method. However, GWO suffers from local optima issue stagnation and early convergence, much as other meta-heuristic algorithms. Therefore the proposed approach could overcome this limitation by improving the exploration and exploitation steps through the application of the DTO algorithm. On high-dimensional optimization problems, the proposed GWDTO algorithm surpassed all other competing algorithms in terms of solution quality and resilience, according to the results achieved.

Swarm intelligence-based evolutionary optimization methods were developed by Gauthama et al. in 2017 [22]. To tackle the feature selection problem, the swarm algorithms have been used in several research because of their ease of use and rapid convergence. Local optima and demographic variables are some of the limitations of this strategy. The upshot is that a number of studies have merged swarm optimization with other algorithms to improve its efficiency and apply it to FS challenges. The swarm-based hybrid FS approach proposed by authors in [23] uses a local search strategy and is based on particle swarm optimization in which the local search approach is used to choose the subset of features that are least correlated and most important. Using correlation information, the particle swarm optimization search procedure aims to choose distinctive features with the help of the local search approach. On thirteen benchmark datasets it was evaluated against five current approaches for selecting features. For intelligent facial expression identification issues, the authors presented a micro-genetic algorithm integrated PSO feature selection strategy. Gaussian mutations in the equation for updating the particle’s velocity were added to the original PSO approach to prevent premature convergence. For a successful global and local search, the technique for updating velocity is also dependent on the average user’s experience. Using the K-nearest neighbors (kNN) classifier, the feature selection algorithms are usually tested in terms of benchmark datasets.

The Swarm intelligence algorithm is based on grasshopper foraging and flocking behavior. Genetic optimization algorithm (GOA) is a swarm intelligence algorithm in which the combination with the mutation operator results in a binary hybrid algorithm, as presented by authors in [24]. There are a number of functions that may be used for this purpose, such as the transfer function. In addition, a mutation operator with a realistic mutation rate was used to give a variety of options. GOA and evolutionary operators were integrated in the same way by authors in [25], in which an updated GOA with new evolutionary-based operators for constructing an efficient wrapper FS approach is presented. UCI provided the data sets used to test the suggested methodologies. In order to surpass other optimizers and locate the best solutions with higher convergence trends, we implemented the selection mechanism. As a solution to global optimization difficulties, the authors in [26] presented the Sine Cosine Algorithm (SCA), which makes use of the sine and cosine functions. Another population diversification technique known as a disruption operator was created by authors in [27] as a mix of SCA and Salp Swarm Algorithm (SSA). Therefore, when SSA and SCA were employed in tandem to create a combined population of prospective solution candidates, the quality of the solutions was not stagnated in any way. The results were encouraging when applied to feature selection issues for datasets with feature sizes ranging from 13 to more than 11,000. Authors in [28] have created a novel hybridization method based on SCA. After converting standard PSO to binary variations, the authors included SCA to further explore the datasets they had available. Clustering problems were solved using the k-means approach for seven datasets of 9 to more than 11,000 features, using ten typical benchmark test functions as the first testing. By including the SCA’s position update equation, the suggested technique modifies the PSO’s velocity equation. Additionally, the PSO’s weighting factor was recalculated depending on the number of runs. A selection of iterations with the highest inertia weight was selected in order to improve the searchability of long-distance locations. Researchers found that using statistical t-tests, they were able to improve clustering accuracy significantly above previous natural-inspired optimization approaches. A novel SCA/Antlion Optimization (ALO) hybrid was introduced by authors in [29]. Random elements were also included in the position update equations to expand the diversity of people in each region. In addition, the Mayfly Algorithm (MA) is a novel algorithm based on the flying and mating behavior of mayflies [30]. MA and harmony search (HS) algorithms were suggested by authors in [31] for the feature selection difficulty. This approach was further developed by the HS after being acquired by the MA from various search locations. HS and MA were therefore combined only for the aim of enhancing the search intensification technique. Eighteen classification datasets were examined using the MA-HS method, with improved results.

The proposed network intrusion identification system is based on feature selection applied through the proposed GWDTO optimization algorithm in order to identify attacks in RPL-based IoT networks. Fig. 1 depicts the proposed architecture. The design of the proposed approach includes data collection, analysis, and detection. The data collecting system is made up of sensors, traffic repositories, and sniffers. Using a sniffer, the 6LoWPAN network can monitor every packet that passes across it. Sensor events and packets that have been sniffed and forwarded can be accessed in the repository of sensor events/traffic collection. After that, the most useful features in the dataset are selected using the previously discussed feature selection strategy. To raise a warning if an attack is detected, the detection system has an alarm/attack notification module. Besides providing log reports to the user interface, it also analyzes traffic on a regular basis and gives log reports.

A Windows 11 laptop with an Intel Core i5 CPU clocked at 2.33 GHz, and 16GB of RAM is used for the tests. In order to develop and evaluate the proposed framework, MATLAB R2020a was employed. MATLAB’s Text Analytics Toolbox is utilized to do preprocessing on the dataset. This section evaluates and compares the performance of the proposed approach with other competing approaches.

There is a large quantity of data generated by IoT applications because of their special nature. Furthermore, the safety and privacy of user data is jeopardized as a result of these applications. Machine learning (ML)-based security solutions, such as intrusion detection systems (IDS), have been introduced in recent years. ML algorithms are affected by the existence of duplicate or irrelevant data. A new feature selection (FS) approach referred to as GWDTO was developed to improve the efficiency of the GWO algorithm by utilizing the DTO algorithm. Adopting DTO, which has a high capacity to locate viable regions that give the optimum solution, improved GWO’s performance. The results of the proposed algorithm were compared to other methods. The suggested GWDTO approach outperformed various current metaheuristic algorithms, including the original PSO, WOA, GWO, MVO, SBO, FA, and GA, according to the results of the testing. According to the RPL-NIDDS17 dataset, the proposed approach achieved a 1.18 average error. These results outperform those achieved by the other approaches, which confirm the superiority and effectiveness of the proposed approach.