Securing IoT Networks Against Cyber Threats Using an Improved Whale Optimization Algorithm

A.IoT NETWORK SECURITY AND ML

The growth of IoT devices and networks is accompanied by a rise in security challenges. The key challenges are summarized below [18–20]:

• •Limited Resources: Many IoT devices lack sufficient storage or processing power (Imteaj et al., 2021), and standard security measures consume too many resources for these devices (Kuzlu et al., 2021).
• •Security With Scalability: Large IoT networks may struggle to detect malicious traffic due to the high volume of data that flows through them (Khare and Totaro, 2019).
• •Securing Data Privacy and Integrity: Protecting the data transmitted from the IoT devices over the internet is challenging; this data may include sensitive personal information (Khare and Totaro, 2019).
• •Network Accessibility: IoT devices are often placed in public places where they can be accessed by anyone without permission. A compromised device could potentially put an entire network’s security (Thakral et al., 2022).
• •Life Cycle Management: IoT devices often lack the capability for automatic updates and patches, rendering them exposed to unpatched security vulnerabilities (Tawalbeh et al., 2020).

ML offers invaluable tools for security and improving the functionality of IoT networks (Al-Garadi et al., 2020). In supervised learning, an ML framework is trained on datasets that contain both normal and attack data collected from IoT networks. After training the framework using an ML algorithm, it is implemented within an IoT network, serving as a security measure by recognizing and reporting network traffic that exhibits an attack pattern. This prevents threats in real time [21–23]. ML algorithms are an essential part of modern security, especially in securing IoT networks. Various ML algorithms can be used for securing IoT, including:

• •Random Forest (RF) is an ensemble learning method that constructs multiple decision trees (DTs) during training. Each tree in the forest generates an output when a new input is introduced into the system. The outputs are then collected, and the most frequently seen output is selected as the final result. RF can handle missing values without reducing accuracy [24].
• •Light Gradient Boosting Machine (LGBM): A fast gradient boosting framework based on DT algorithms, used for ranking, classification, and other ML tasks. It is designed to be distributed and efficient, with the following advantages: higher training speed and efficiency, lower memory usage, better accuracy, support for parallel and GPU learning, and the ability to handle large-scale data [25].
• •Adaptive Boosting (AdaBoost): An ensemble learning method that combines multiple weak learners to create a strong learner for improved accuracy. It adjusts the weights of incorrectly classified instances so that subsequent classifiers place greater emphasis on difficult cases [26].
• •Histogram-Based Gradient Boosting (HGB): An efficient implementation of the gradient boosting framework, which uses histograms to bin continuous feature values and reduce the number of splitting points to consider, resulting in faster computation [27].
• •Artificial Neural Network (ANN): A powerful computational framework inspired by the human brain, capable of learning from and interpreting data through a system of interconnected nodes mimicking biological neurons [28,29].
• •Extreme Gradient Boosting (XGBoost): An optimized distributed gradient boosting library designed to be highly efficient, flexible, and portable. It implements ML algorithms within the gradient boosting framework and provides parallel tree boosting, solving many data science problems quickly and accurately [30].
• •Gradient Boosted Trees (GBTs): This method builds the framework in a stage-wise fashion like AdaBoost, but it generalizes it by allowing optimization of an arbitrary differentiable loss function [31].

Each ML algorithm has its strengths and weaknesses, and the choice of algorithm often depends on the nature and volume of the data, as summarized in Table I.

Table I. An overview of ML classifiers

B.FEATURE SELECTION IN IoT NETWORKS

Effective feature selection is crucial for optimizing ML frameworks, especially in complex domains such as IoT. By identifying and selecting only the most relevant data features for framework construction, performance is improved through increased accuracy and reduced computational costs [32–34]. This targeted approach can result in:

• •Improving performance: Focusing on key traffic patterns enhances IoT security by improving detection accuracy and generalization across devices and attacks [34,35].
• •Enhancing Computational Efficiency: Feature elimination reduces data dimensionality and computational load, enabling faster training and real-time detection in resource-constrained IoT environments [34,35].

Multiple feature selection techniques exist, and among them, wrapper methods such as the WOA metaheuristic algorithm stand out. These techniques treat feature selection as a search problem, in which various feature sets are assembled and evaluated. They employ a predictive framework to evaluate each feature set, assigning it a score based on the framework’s accuracy. In IoT, feature selection is important because of the vast amounts of data generated by devices and transmitted over the network. Moreover, the limited computational capacity of these devices makes it essential to reduce data dimensionality and processing load [34,36,37].

C.WOA METAHEURISTIC ALGORITHM

The WOA is a metaheuristic algorithm known for its efficiency in feature selection. The WOA simulates the social behavior and hunting strategy of humpback whales. The algorithm explores the solution space to identify the best solution by iteratively updating the positions of individual solutions (whales) while balancing exploration and exploitation [38,39].

It begins with the Initialization step, where potential solutions (whales) are created and essential parameters, such as the maximum number of iterations, are set. In the Iteration loop, the algorithm starts with the exploration and exploitation phase. In the exploration phase, the algorithm searches for better solutions. In the exploitation phase, it refines the current solutions. In both phases of exploration and exploitation in the loop, each whale’s position is updated, and its fitness is evaluated. The Position Update involves two unique strategies, encircling prey and spiral updating positions. The algorithms end by returning the best solution found during all the iterations [39–41]. Figure 2 shows the main operations of the WOA algorithm.

Fig. 2. Operations of the WOA algorithm.

D.N-BaIoT DATASET

The study used the N-BaIoT dataset, which contains network traffic data from both normal and compromised IoT devices. It contains 6,954,518 instances (records) and 115 features [42,43]. The dataset contains normal IoT traffic and attacks from Mirai and Bashlite, well-known botnets. Mirai is one of the most infamous botnets, known for its massive DDoS attacks. Mirai primarily targets IoT devices like IP cameras and home routers, exploiting weak security to create a large network of infected devices. Bashlite targets IoT devices intending to perform DDoS attacks. It exploits vulnerabilities in devices to gain control and coordinate large-scale network attacks [44–46].

The features in the N-BaIoT dataset are designed to capture a wide range of network data that can serve as indicators of normal or malicious behavior in IoT network traffic. N-BaIoT supports the creation of robust ML frameworks that can recognize and respond to a wide range of security issues for IoT networks. Table II lists the attack types carried out by the Mirai and Bashlite botnets in the N-BaIoT dataset [42–44,46].

Table II. Mirai and Bashlite botnet attack types

A.WOA APPLICATIONS IN IoT SECURITY

The growing dependence on the IoT has heightened challenges related to the security and privacy of these systems. To address these issues, researchers have employed various approaches to secure IoT networks, including ML techniques and the WOA optimization algorithm. For example, Zhu and Zhu [47] introduced a framework for detecting anomalies in IoT-based networks using WOA. Their focus was on identifying irregularities that traditional firewall systems cannot detect. Specifically, they used an ensemble-based strategy, combining the classifiers support vector machine (SVM), K-nearest neighbors (KNN), and DT for classification, while WOA was applied for parameter tuning. The results show that the framework achieves 90.2% accuracy and 90% precision.

The study by Vijayanand and Devaraj [48] introduced an Intrusion Detection System (IDS) for Wireless Mesh Network (WMN), using the WOA with genetic crossover and mutation operators for feature selection, to enhance the SVM performance. The study’s use of WOA with the genetic algorithm’s crossover and mutation improved the original WOA in overcoming the premature convergence issue. The SVM with a Radial Basis Function (RBF) kernel function was used for classification on the CICIDS2017 and ADFA-LD datasets. The results showed that the SVM framework achieved precision scores of 95.91 on the CICIDS2017 dataset and 94.44 on the ADFA-LD dataset.

On the other hand, the study by Nagaraju et al. [49] proposed a deep learning (DL) framework for securing IoT Networks, utilizing WOA with Grey Wolf Optimizer (GWO) for feature selection, and Deep Convolutional Neural Networks (DCNN) for classification. The framework is assessed across four datasets (Google Code Jam, Leopard Mobile, Bot-IoT, and LITNET-2020). The results showed improvements in classification accuracy, specificity, sensitivity, and f1-score, with 99% accuracy on GCJ, 98% on Leopard Mobile, 99% on Bot-IoT, and 97% on LITNET-2020.

As proposed by Mafarja et al. [50], IoT networks were secured using WOA for feature selection, incorporating both V-shaped and S-shaped transfer functions. The study used the N-BaIoT dataset, a KNN classifier, and several innovative binarization rules. The results show that WOA, combined with specific transfer functions and binarization methods, outperforms other algorithms. The authors split the dataset into data1 {COMBO, UDP}, data2 {TCP, UDP}, data3 {SCAN, SYN}, data4 {UDP, ACK}, and data5 {TCP, UDPPLAIN}, reporting the highest accuracy as 99.99%, 99.78%, 99.41%, 99.52%, and 98.90%, respectively.

B.STUDIES UTILIZING THE N-BaIoT DATASET

A variety of studies have employed different IoT datasets. The following review focuses on research that specifically utilizes the N-BaIoT dataset. AZIMJONOV and Kim [51] implemented a stochastic gradient descent classifier (SGDC) using correlation coefficient-based algorithms for feature selection. The study was conducted on the datasets KDD-CUP-1999, BotIoT-2018, and N-BaIoT-2021. The SGDC classifier achieved an average accuracy of 92.69% across the datasets.

As for KASIM et al. [52], they introduced a hybrid framework to detect UDP flooding attacks in IoT networks, utilizing a method that combines Minimum Redundancy Maximum Relevance (MRMR) for feature selection with the Fine-tuned Stacked Sparse Autoencoder (FTSSAE) for classification on the N-BaIoT and NSL-KDD datasets. The FTSSAE classifier achieved 99.99% accuracy, precision, sensitivity, and specificity, as well as a 100% f1-score on the N-BaIoT dataset. As for the NSL-KDD, the results were 97.81% accuracy, 97.53% precision, 99.89% sensitivity, 87.83% specificity, and 98.70% for the f1-score.

The study by Palla and Tayeb [53] introduces an approach to detecting Mirai malware on IoT devices using ML algorithms. The study’s novel contribution lies in the implementation and comparison of ANN and RF frameworks in MATLAB and Python, respectively. Using the “N-BaIoT” dataset, which comprises real traffic data from nine IoT devices, including the Damini Doorbell, each with 115 features, the ANN framework achieves 67.5% accuracy and f1-scores.

The research by Khoa et al. [54] introduces a cooperative learning framework in which these filters trained on deep neural network (DNNs) leverage data from their local networks to train cyberattack detection systems. These frameworks are then shared among IoT gateways, leveraging the collective intelligence to enhance the overall accuracy and speed of intrusion detection while reducing network traffic and protecting data privacy across the system. The system’s efficacy is validated through simulations using real datasets, including the N-BaIoT dataset, which contains normal and malicious traffic from nine IoT devices, with each dataset comprising benign traffic and 10 attack types from Mirai and Bashlite. The proposed approach demonstrates a substantial improvement in classification accuracy (up to 14.76%) and a 98.5% reduction in communication overhead compared to conventional ML methods. For the Danmini Doorbell, the system achieved an accuracy of 99.84%.

The study by Gatea and Hameed [55] introduced an IoT botnet detection framework based on regression and linear discrimination analysis. This innovative approach leverages multiple linear regression (MLR) for feature selection, streamlining the detection process by focusing on the most relevant characteristics of botnet traffic. Using the N-BaIoT dataset, the framework achieves exceptional accuracy, demonstrating its effectiveness compared to conventional methods. The framework results for the Danmini Doorbell device were 99.82% (no feature selection), 99.80% (75% features), 99.68% (50% features), and 86.20% (25% features).

Unlike existing WOA variants and other feature selection approaches, the proposed method introduces an adaptive fitness-guided crossover mechanism that dynamically biases offspring generation toward higher-quality solutions. This design improves exploration while maintaining low computational overhead, effectively reducing feature redundancy without relying on additional hybrid optimizers or complex binarization strategies. As a result, the proposed approach is particularly well suited for high-dimensional IoT intrusion detection data, where efficient search, compact feature subsets, and scalability are critical.

A.DATA TRANSFORMATION

Data transformation is a necessary step in preparing data for the proposed ML framework (Dogan and Birant, 2021). It is implemented as a label encoder that converts data labels to numerical values. Because ML algorithms tend to work better with numerical data, converting label values to a more suitable numerical representation is a fundamental step in optimizing the ML framework. The transformation is done using label encoding. Label encoding is a well-established data transformation technique that assigns a unique integer to each distinct category in a feature [45]. Figure 4 shows the encoded labels for the N-BaIoT dataset.

Fig. 4. Encoded class labels used in the N-BaIoT dataset.

In binary classification, benign traffic is labeled 0, and all other attack types are labeled 1. In multiclass classification, benign traffic is labeled as 0. The attacks are divided into families, with each family representing a different type of attack behavior. For example, attacks from the Bashlite family are numerically encoded from 1 to 5, corresponding to various attack methods such as combo, junk, scan, tcp, and udp. Similarly, different types of Mirai attack methods are encoded as 6-10, corresponding to ack, scan, syn, udp, and UDPplain, respectively.

B.DATA NORMALIZATION

Data normalization is an essential step in preparing data for a framework (Alam and Mohanty, 2022). Normalization adjusts variables to a common scale, and the MinMaxScaler is a common and effective method that rescales features to a range of 0 to 1 (Kappal, 2019). This process is crucial because classification algorithms and the WOA assume that all input variables are on the same scale; otherwise, they may be adversely affected. Therefore, the MinMaxScaler is implemented to ensure all features are on the same scale. The MinMaxScaler is calculated using Equation (1) [45,56]:

C.FEATURE SELECTION USING THE PROPOSED MODIFIED WOA ALGORITHM

This section outlines the proposed modification of the WOA algorithm for feature selection in IoT security, introducing an adaptive crossover function to enhance exploration and avoid local optima.

D.CLASSIFICATION

Classification is important for securing IoT networks, predicting the value of network data, and determining whether traffic is benign or an attack. Many classification algorithms were used to train the framework because each classifier has a unique method for identifying patterns and making predictions. Some classifiers might work better with IoT network data. Therefore, utilizing a variety of classifiers increases the likelihood that a framework will be discovered that performs well for securing IoT networks. The used classification algorithms are RF, ANN, LGBM, AdaBoost, HGB, XGBoost, and GBT [24–31].

The dataset employed in this study was partitioned using a stratified sampling approach with an 80:20 training-to-testing ratio to preserve class distribution across subsets. A total of 68,750 instances were utilized, comprising 34,375 samples from each class, thereby ensuring a balanced representation of both categories. This stratified and balanced sampling strategy enhances the reliability and validity of the framework’s performance evaluation by mitigating potential bias arising from class imbalance.

A.IMPLEMENTATION

The research was conducted on Windows 10, and Python was chosen for its extensive support for ML libraries. The implementation and evaluation of the ML framework requires a high-performance computing setup. Some of the libraries used in implementing the ML framework include pandas, numpy, sklearn.framework_selection, math, sklearn.preprocessing, and matplotlib.pyplot.

The proposed framework was implemented through several sequential stages. First, data labels were transformed using a label encoder. Next, data normalization was performed using MinMaxScaler. Afterward, feature selection was performed using the proposed modified WOA algorithm. Finally, binary and multiclass classification was completed.

• •In binary classification, the algorithms RF, ANN, LGBM, AdaBoost, and HGB were used to classify IoT network traffic as either benign or attack traffic. These algorithms have demonstrated effectiveness in binary classification [57,58].
• •In multiclass classification, ANN, XGBoost, and GBT were selected for their ability to handle multiple output classes and complex relationships, making them suitable for classifying IoT network traffic as benign or one of 10 attack types in the datasets. These algorithms excel in multiclass data scenarios [59,60].

B.IMPLEMENTATION OF THE PROPOSED MODIFIED WOA

The parameters for the modified WOA were set to a population size of 20 and a maximum of 200 iterations. The population size was set to 20 because the crossover function doubles the population size with each offspring, making it sufficient to explore potential solutions during each iteration and thus allowing for better exploration of the WOA. Using 200 iterations gives the algorithm plenty of opportunities to refine solutions over time, increasing the likelihood of reaching the optimal solution and thus allowing better exploitation of the WOA.

The fitness function used DT to calculate the error rate, considering both prediction accuracy and the number of selected features, which is shown in Equation (3), where a lower fitness value indicates a more optimal feature subset:

The weighting coefficients are fixed as alpha = 0.9 and beta = 0.1 to emphasize classification accuracy while still penalizing large feature subsets, reflecting the importance of detection performance in security applications. During the feature selection process, the fitness value is computed exclusively using the training data, whereas the test set is strictly reserved for the final performance evaluation. This evaluation protocol ensures a fair assessment and prevents overfitting or bias toward the test split.

The fitness function incorporates two objectives, maximizing classification accuracy while penalizing the selection of a large number of features. The inner-validation is conducted by examining various feature subsets generated by the modified WOA. Then, during testing, the optimal feature subset identified in the training phase is evaluated on a separate portion of the dataset. This portion serves as both validation and testing sets, as will be detailed in the results section.

C.EVALUATION METRICS

Various metrics were used to evaluate the framework’s performance in detecting threats in IoT networks, and these metrics and their formulas are [61–64]:

• •True Positive (TP): Correctly predicted attack traffic.
• •True Negative (TN): Correctly predicted benign traffic.
• •False Negative (FN): Malicious traffic misclassified as benign.
• •False Positive (FP): Benign traffic misclassified as malicious.
• •Accuracy: As seen in Equation (4), accuracy is the ratio of correct detections to total detections N. It measures the model’s overall correctness:
  Accuracy=(TP+TN)N(4)
• •Precision: As seen in Equation (5), it is the ratio of the correct TP to the total of predicted positives. It evaluates the model’s performance regarding true positives:
  Precision=(TP)(TP+FP)(5)
• •F1-score: As seen in Equation (6), it is the balance of precision and recall:
  F1-score2*(Precision*Recall)(Precision+Recall)(6)
• •Convergence Time: Speed of the training process.

Evaluating the framework across these diverse metrics ensures a thorough understanding of its capability to correctly predict malicious and benign IoT network traffic.

D.RESULTS AND DISCUSSION

The results are shown in the three sections that follow. The results for the modified WOA framework are displayed in Section V.A. The performances of the original and modified WOA frameworks are compared in Section V.B. Also, a comparative analysis between the modified WOA framework and other frameworks appears in Section V.C.