Adaptive intrusion detection systems using AMCMPSO optimisation

Abstract

The rapid growth of IoT-enabled networks has intensified cyber threats, yet traditional intrusion detection systems (IDS) struggle to sustain high accuracy on high-dimensional traffic without heavy computational overhead. This paper addresses that dual challenge with an Adaptive Intrusion Detection System (AdaptIDS) built on a novel adaptive cluster-centred particle swarm optimisation (AMCMPSO) algorithm. AMCMPSO augments canonical PSO with a centre-of-mass guidance term and adaptive scheduling of the inertia weight and acceleration coefficients. In simple terms, each particle is drawn towards both the best solutions found and the swarm's average position, keeping the search balanced and avoiding premature convergence. It drives feature selection across four classifiers (LightGBM, Random Forest, Logistic Regression and SVM) on four datasets: WSN-DS, WSNBFSFdataset, UNSW_NB15, and a high-dimensional API malware set. AdaptIDS improves accuracy by up to 3.1% and cuts training time by up to 85%. AMCMPSO-LightGBM reaches 97.0% accuracy while reducing features from 554 to 443, with precision, recall and F1 rising to 97.0%, 96.8% and 96.6%; the fold-wise accuracy gains are significant (Wilcoxon, p = 0.031). Gains are consistent across all datasets and classifiers. The main limitation is the one-time AMCMPSO optimisation overhead, which increases with dataset size, feature dimensionality, and classifier complexity. Future work should explore incremental optimisation for concept drift, federated learning integration, and robustness against adversarial attacks. The proposed framework can help security teams deploy more efficient IDS models by reducing redundant features, improving detection accuracy and lowering training and prediction time. This is useful for IoT, WSN, cloud and high-dimensional malware detection environments. To the authors' knowledge, AMCMPSO is the first centre-of-mass-guided adaptive PSO applied to IDS feature selection; such guidance had previously been used only for continuous problems, not binary feature-subset search. AdaptIDS provides a scalable, classifier-agnostic layer that improves accuracy and efficiency across heterogeneous networks while keeping inference fast enough for online use.