Shark-Inspired Remora Algorithm Enhances Support Vector Machine Network Intrusion Detection Accuracy

To address persistent cybersecurity vulnerabilities and reduce elevated false positive rates in traffic monitoring, researchers Xiangmei Xiao, Zhixing Lin, Jian Yu, and Heming Jia developed an advanced detection architecture integrating an Improved Remora Optimization Algorithm with a Support Vector Machine classifier. Network anomaly traffic detection constitutes a critical defense layer for enterprise computing infrastructure, yet existing analytical systems frequently suffer from excessive false alarms that deplete administrative resources and undermine network defensive responsiveness. Although supervised learning algorithms like Support Vector Machines demonstrate powerful classification capabilities in high-dimensional feature spaces, their detection effectiveness remains highly sensitive to hyperparameter configurations. Traditional swarm intelligence optimization techniques often experience an imbalance between global exploration and local exploitation, resulting in entrapment within local optima during hyperparameter tuning. To overcome these limitations, the research team constructed a bio-inspired framework augmenting the Remora Optimization Algorithm with White Shark Optimizer mechanisms, an adaptive weight operator, and a quadratic interpolation strategy to optimize Support Vector Machine parameters effectively.

The underlying classifier utilizes the statistical learning theory formulated by Cortes and Vapnik, projecting input vectors into higher-dimensional feature spaces to construct an optimal separating hyperplane. In this formulation, empirical errors are mitigated using slack variables governed by a penalty parameter C, balancing margin width and training error minimization. To manage the nonlinear characteristics inherent in network packet distributions without prohibitive computational burdens, the model adopts a Radial Basis Function kernel. System performance depends fundamentally on tuning the penalty parameter C and kernel parameter g. A larger penalty parameter diminishes error tolerance while increasing structural complexity, whereas a smaller parameter allows greater training tolerance. Metaheuristic swarm intelligence was chosen over deterministic solvers and Bayesian optimization because deterministic approaches scale poorly in high-dimensional non-convex domains, while Bayesian surrogate models suffer substantial degradation when handling expanded parameter dimensionalities.

The foundational optimization engine takes inspiration from the parasitic life cycle of remoras, mathematical models of which simulate attachments to sailfish and whales. Developed from the SailFish Optimizer and the Whale Optimization Algorithm, the standard Remora Optimization Algorithm incorporates dual behavioral phases of exploration and exploitation. Positions are initialized randomly across bounded continuous domains. During exploration, remoras mimic attachment to sailfish, updating coordinates through elite candidate positioning to survey broad search regions. To determine host suitability, remoras perform localized exploratory shifts termed experience attacks, perturbing coordinates using normally distributed random offsets based on prior generational positions. During exploitation, remoras coordinate movements with whales using bubble-net attack formulations, subsequently transitioning into localized host foraging where movement step sizes are governed by host volume parameters. Despite delivering rapid convergence, standard remora optimization remains prone to local optima entrapment, as its rigid host-switching logic and uniform experience attack steps fail to maintain adequate population diversity across complex problem spaces.

To resolve these behavioral limitations, the authors integrated three bio-inspired enhancements that strengthen exploratory breadth and localized precision. First, the exploration phase incorporates the White Shark Optimizer into the host-switching mechanism. Remoras select between sailfish and great white sharks with equal probability (P = 0.5), adopting wave-sound-driven prey tracking behaviors parameterized by wave frequency boundaries of 0.07 to 0.75 and an acceleration coefficient of 4.125. Second, an adaptive weight operator k replaces the static perturbation step during experience attacks. Formulated as a random vector uniformly distributed over [-b, b] with b = 1 – t/T, this operator dynamically contracts the local search radius as generational iterations proceed toward the maximum ceiling T, refining convergence accuracy. Third, a quadratic interpolation strategy operates outside the main loop, fitting a parabolic curve across three candidate points—two randomly selected population members and the global best position—to identify an approximate optimum, accepted only if it improves candidate fitness under greedy selection.

Algorithmic complexity analysis reveals that while the baseline Remora Optimization Algorithm requires O(N * (T * dim + 1)) operations for population size N, dimension dim, and iterations T, the improved framework achieves O(N * (2 * T * dim + 1)). The white shark mechanism and adaptive weight operator execute within the primary loop without imposing additional computational overhead, whereas the external quadratic interpolation operator introduces an additive complexity of O(N * T * dim). Experimental runtimes recorded in MATLAB 2021a on an Intel Core i5-12500H workstation with 16 GB of memory confirmed acceptable execution scaling. Compared to the baseline algorithm, the improved version exhibited average execution time increases of 67.8 percent on 10-dimensional CEC2020 functions, 42.5 percent on 50-dimensional CEC2017 functions, and 33.2 percent on 100-dimensional CEC2017 suites. The diminishing relative time overhead observed at higher dimensionalities highlights favorable scalability for complex domains, while empirical memory consumption remained stable between 224 and 284 megabytes, establishing that the structural modifications introduce negligible memory burdens.

Rigorous performance evaluations on benchmark suites validated the optimization capabilities of the improved algorithm against seven competing metaheuristics: Beluga Whale Optimization, Sine Cosine Algorithm, Golden Sine Algorithm, Harris Hawks Optimization, Whale Optimization Algorithm, Seagull Optimization Algorithm, and standard Remora Optimization. Testing on CEC2020 at 10 dimensions evaluated unimodal, multimodal, non-peak, hybrid, and composite functions across 30 independent runs with population size 30 and 500 iterations. On non-peak function F4, it achieved the theoretical global optimum. Scalability tests across 50-dimensional and 100-dimensional CEC2017 benchmarks confirmed persistent superiority in optimal and average values. Friedman rank tests across both benchmark suites yielded p-values well below 0.05, establishing that the improved algorithm consistently secured the best mean rank.

Pairwise statistical significance was verified using Wilcoxon rank-sum tests with a 0.05 threshold across 30 independent runs on CEC2020 and CEC2017 benchmark suites. On the 10-dimensional CEC2020 functions, pairwise comparisons between the improved remora algorithm and all seven competing algorithms yielded p-values below 0.05 in almost all instances, confirming statistically significant performance gains with the single exception of function F7 against the baseline remora optimizer. On the 50-dimensional and 100-dimensional CEC2017 functions, significant performance advantages were maintained across most functions, with non-significant differences confined to rare comparisons against the Seagull Optimization Algorithm and Harris Hawks Optimization. Furthermore, an ablation study on CEC2020 at 10 dimensions evaluated single-modification variants incorporating only the White Shark Optimizer, adaptive weighting, or quadratic interpolation. Although the adaptive weighting variant provided the largest individual performance gain, the complete hybrid integration delivered the best overall solution accuracy, convergence stability, and lowest standard deviations.

Following validation on mathematical benchmarks, the improved remora algorithm was applied to tune Support Vector Machine hyperparameters. The operational procedure comprises five sequential stages: data preprocessing, parameter initialization, parameter optimization, model classification, and model evaluation. To prevent overfitting and underfitting during hyperparameter estimation, the classification error from 5-fold cross-validation serves as the objective fitness function. In each round of 5-fold cross-validation, four data subsets are utilized for model training while the remaining subset evaluates validation error, with the average validation error across all five folds defining the fitness metric to be minimized. The parameter search space bounds the penalty parameter C between 10 and 1000 and the Radial Basis Function kernel parameter g between 2^-5 and 2^5. Operating with a population size of 10 and a maximum iteration threshold of 30, the improved remora optimizer navigates this solution space to discover the optimal parameter combination for intrusion traffic classification.

Empirical validation of the detection framework was conducted on the NSL-KDD dataset, specifically utilizing the standardized KDDTest-21 subset containing 11,850 records. Refined by Tavallaee and colleagues in 2009 to resolve duplication issues in KDD Cup 99, the dataset covers four attack categories: Denial of Service, Probe, Remote to Local, and User to Root. Preprocessing normalized numerical attributes to the [0, 1] range through min-max scaling and converted categorical variables using one-hot encoding, partitioning samples into a 60:40 training-to-testing ratio. Across ten independent runs, the improved remora Support Vector Machine model achieved the highest performance in Accuracy, Precision, F1-score, Area Under the Receiver Operating Characteristic Curve, and Matthews Correlation Coefficient among eight optimization-based models. A Friedman rank test confirmed statistical significance with a p-value of 0.0008 and a top rank of 6.8 out of 8, corroborated by pairwise Wilcoxon tests (p < 0.05). Compared against conventional classifiers—K-Nearest Neighbors, Decision Trees, and default Support Vector Machines—the proposed model exhibited decisive superiority in accuracy and precision.

The authors explicitly documented several operational limitations alongside prospective research directions to guide future implementations. A notable constraint involves the exclusive reliance on the NSL-KDD benchmark, which reflects older network architectures and fails to capture high-throughput traffic dynamics or modern multi-vector cyber threats, limiting direct extrapolation to modern network deployments. Furthermore, the algorithmic modifications within the improved remora optimizer increase structural computational complexity and training time, restricting its immediate viability for real-time packet inspection. To address these operational constraints, future work will extend experimental evaluations to contemporary datasets such as CIC-IDS2017, CIC-IDS2019, and UNSW-NB15, while developing cross-dataset transfer learning frameworks to adapt to evolving attack patterns. Methodological work will explore incorporating the Natural Survivor Method and Fitness-Distance Balance strategies, alongside benchmarking against state-of-the-art metaheuristics like EPM-AGDE and NSM-LSHADE-CnEpSin. Finally, the team plans to investigate lightweight deployment mechanisms, including incremental online learning, automated feature selection, and model compression techniques to enable practical real-time execution in modern high-speed enterprise networks.

Subject of Research: Optimization of support vector machine network anomaly detection using an improved remora optimization algorithm

Article Title: An improved remora optimization algorithm for optimizing a support vector machine based network anomaly traffic detection model

Article References: Xiao, X., Lin, Z., Yu, J., & Jia, H. (2026). An improved remora optimization algorithm for optimizing a support vector machine based network anomaly traffic detection model. Discover Computing, 29(1), Article 796. https://doi.org/10.1007/s10791-026-10749-y

Image Credits: AI Generated

DOI: 10.1007/s10791-026-10749-y

Keywords: Remora Optimization Algorithm, Support Vector Machine, Network Anomaly Traffic Detection, White Shark Optimizer, Quadratic Interpolation, Adaptive Weight Operator, Hyperparameter Tuning, NSL-KDD Dataset, CEC2020 Benchmark, CEC2017 Benchmark, Friedman Rank Test, Wilcoxon Rank-Sum Test, Radial Basis Function Kernel, Intrusion Detection Systems, Swarm Intelligence, Cross-Validation, KDDTest-21, Classification Accuracy