Optimizing multi-class intrusion detection in IIoT: advanced feature selection using grey wolf optimizer and machine learning classifiers.
- 1Universitat de Girona - Control Engineering and Intelligent Systems, Campus Montilivi, EPS IV, Girona, Catalonia, Spain.
Abstract
Introduction
The rapid expansion of the Industrial Internet of Things (IIoT) has increased the cyberattack surface of industrial infrastructures, creating demand for intrusion detection systems (IDS) that combine predictive performance with deployment efficiency.Methods
This study proposes a Grey Wolf Optimizer (GWO)-guided fixed top-k feature-ranking framework for multi-class IIoT intrusion detection using candidate-dependent redundancy regularization, class-weighted learning, stratified cross-validation, repeated runs, and independent holdout evaluation. The framework was evaluated on the CIC IIoT Dataset 2025 and independently assessed on Edge-IIoTset as a secondary benchmark across six machine learning classifiers and several feature-selection baselines.Results
On CIC IIoT Dataset 2025, Random Forest and Decision Tree achieved holdout Macro-F1 scores of 0.9389 and 0.9330, respectively, using only 10 selected features, representing an 85.92% reduction from the 71-feature model-input space. Repeated training-only comparisons showed significant overall differences among GWO, BA, LightGBM, and Boruta (Friedman χ² = 16.920, p = 0.000734; Kendall's W = 0.564); GWO outperformed BA and LightGBM after Holm correction but did not differ significantly from Boruta. Ablation analysis further showed lower feature redundancy under adaptive regularization, although its predictive advantage was not statistically significant. Results on Edge-IIoTset showed that feature-selection effectiveness is dataset dependent.Discussion
Overall, the proposed framework provides a practical balance between predictive performance, feature compactness, and computational efficiency for resource-constrained IIoT intrusion detection.
Related
- Parrot dandelion optimizer-based routing and spiking neural network enabled intrusion detection in underwater IoT
- DEA-IDS: Drift-Aware Feature Selection and Few-Shot Adaptation for Cross-Domain IoT–IoMT Intrusion Detection
- Optimizing the Optimizer: Language Models Discover Faster Molecular Relaxation Algorithms
- Pareto-Guided Leader Selection in the Mountain Gazelle Optimizer: A Controlled Multi-Objective Study
- CyberRoBERTa: A Lightweight Transformer-Based Language Model for IoT Intrusion Detection
BibTeX
@article{alshibly2026optimizing,
title = {{Optimizing multi-class intrusion detection in IIoT: advanced feature selection using grey wolf optimizer and machine learning classifiers.}},
author = {Ibrahim Al-Shibly and Llorenç Burgas and Joaquim Massana},
journal = {Frontiers in artificial intelligence},
year = {2026},
month = oct,
doi = {10.3389/frai.2026.1932015},
url = {https://europepmc.org/article/MED/42898504},
note = {CC BY},
}
RIS
TY - JOUR
TI - Optimizing multi-class intrusion detection in IIoT: advanced feature selection using grey wolf optimizer and machine learning classifiers.
AU - Ibrahim Al-Shibly
AU - Llorenç Burgas
AU - Joaquim Massana
PY - 2026
DA - 2026/10/05
JO - Frontiers in artificial intelligence
DO - 10.3389/frai.2026.1932015
UR - https://europepmc.org/article/MED/42898504
AB - Introduction The rapid expansion of the Industrial Internet of Things (IIoT) has increased the cyberattack surface of industrial infrastructures, creating demand for intrusion detection systems (IDS) that combine predictive performance with deployment efficiency.Methods This study proposes a Grey Wolf Optimizer (GWO)-guided fixed top-k feature-ranking framework for multi-class IIoT intrusion detection using candidate-dependent redundancy regularization, class-weighted learning, stratified cross-validation, repeated runs, and independent holdout evaluation. The framework was evaluated on the CIC IIoT Dataset 2025 and independently assessed on Edge-IIoTset as a secondary benchmark across six machine learning classifiers and several feature-selection baselines.Results On CIC IIoT Dataset 2025, Random Forest and Decision Tree achieved holdout Macro-F1 scores of 0.9389 and 0.9330, respectively, using only 10 selected features, representing an 85.92% reduction from the 71-feature model-input space. Repeated training-only comparisons showed significant overall differences among GWO, BA, LightGBM, and Boruta (Friedman χ² = 16.920, p = 0.000734; Kendall's W = 0.564); GWO outperformed BA and LightGBM after Holm correction but did not differ significantly from Boruta. Ablation analysis further showed lower feature redundancy under adaptive regularization, although its predictive advantage was not statistically significant. Results on Edge-IIoTset showed that feature-selection effectiveness is dataset dependent.Discussion Overall, the proposed framework provides a practical balance between predictive performance, feature compactness, and computational efficiency for resource-constrained IIoT intrusion detection.
SN - 2624-8212
ER -