Hybrid Feature Selection Boosts IoT DDoS Detection Accuracy

Researchers from multiple institutions have developed a hybrid feature selection framework that significantly improves the detection of Distributed Denial-of-Service attacks in Internet of Things networks. Published in the journal Discover Internet of Things, the study introduces a method that combines Particle Swarm Optimization and the Grey Wolf Optimizer to identify the most relevant traffic features for identifying malicious HTTP flood attacks. The approach aims to address the challenge of high-dimensional flow-based traffic data while maintaining the computational efficiency required for resource-constrained IoT environments. By systematically evaluating different combinations of these optimization algorithms, the team demonstrated that a specific configuration achieved high detection accuracy with minimal false positives.

The rapid proliferation of IoT devices has expanded the attack surface for cyber threats, with DDoS attacks becoming increasingly sophisticated and frequent. IoT devices often lack robust built-in security mechanisms, making them vulnerable to exploitation for amplifying attacks. This study specifically focuses on HTTP flood attacks, a type of application-layer DDoS attack that disrupts service availability by overwhelming servers with a high volume of HTTP requests. The research utilizes the CIC IoT-DIAD 2024 dataset, a comprehensive benchmark created by the Canadian Institute of Cybersecurity, to evaluate the proposed framework under realistic smart environment conditions.

The core innovation of the study lies in its post-selection feature construction strategy. Rather than integrating the search operators of Particle Swarm Optimization and the Grey Wolf Optimizer during the optimization process, the researchers executed both algorithms independently. After each optimizer completed its search, the selected feature subsets were combined using set-theoretic operations. This design preserves the unique search behaviors of each algorithm while allowing for the creation of alternative feature representations that balance diversity and compactness.

Two distinct combination strategies were evaluated: the union and the intersection of the selected features. The union strategy, denoted as PSO ∪ GWO, retains all features selected by either optimizer, preserving broader complementary feature information. This approach is designed to support deeper analysis by Intrusion Detection Systems, which can operate with higher computational overhead. In contrast, the intersection strategy, denoted as PSO ∩ GWO, retains only the features selected by both optimizers. This produces a highly compact subset suitable for low-latency screening by Intrusion Prevention Systems, which require rapid decision-making at the network edge.

The experimental setup involved rigorous data preprocessing to ensure reliability. The original dataset contained 505,720 attack samples and 398,330 benign samples with 83 attributes. After cleaning, which included removing duplicate rows, invalid protocol entries, and zero-variance features, the dataset was reduced to 788,533 samples with 70 input features. The data was then partitioned into training, validation, and testing subsets using a stratified random split to maintain class distribution consistency and prevent data leakage. Normalization was applied using the RobustScaler, which centers features using the median and scales them according to the interquartile range, providing robustness to outliers common in network traffic data.

Feature selection was performed using a wrapper approach, where LightGBM served as a proxy classifier to evaluate the fitness of candidate feature subsets. The optimization process was conducted on a stratified random subset of 90,000 records sampled from the training partition to maintain computational tractability. The final selected subsets were then evaluated using four different classifiers: CatBoost, XGBoost, Random Forest, and Extra Trees. All classifiers were trained and evaluated under identical experimental conditions, with results averaged over five independent runs to ensure robustness and transparent variance reporting.

The results indicated that the union-based feature subset, when paired with the XGBoost classifier, achieved the highest mean performance among all evaluated configurations. This configuration reached an accuracy of 99.38%, a recall of 99.31%, and an F1-score of 99.40%. These metrics suggest that the broader feature coverage provided by the union strategy allows the classifier to capture additional traffic patterns associated with HTTP flood attacks. The high precision across all configurations, consistently exceeding 99.39%, indicates that the proposed method maintains low false alarm rates while improving detection sensitivity.

In comparison, the intersection-based subset yielded lower performance metrics, with accuracy ranging from 97.20% to 97.43% and recall from 95.16% to 95.66%. However, this configuration offered significant advantages in terms of computational efficiency. The intersection subset consisted of only four features, representing a 94.29% reduction in dimensionality compared to the original 70 features. This compactness translates to lower training times and faster inference, making it a viable option for lightweight screening in resource-constrained IoT edge devices where processing power and memory are limited.

Runtime analysis further highlighted the trade-off between detection performance and computational cost. The union subset incurred the highest training costs, particularly for ensemble methods like Random Forest, due to its larger feature dimensionality. Conversely, the intersection subset achieved the lowest training times, such as 30.00 seconds for Random Forest, compared to 110.68 seconds for the union subset. Inference times for all classifiers were very low, measured as average per-sample batch-prediction times, suggesting suitability for real-time or near-real-time monitoring. The feature selection process itself required approximately 440.88 seconds for PSO and 326.48 seconds for GWO, with the combined post-selection process taking 767.36 seconds.

The study also provided a conceptual deployment strategy mapping the feature subsets to specific security functions. The compact intersection subset is proposed for use in Intrusion Prevention Systems at the edge layer, where low-latency screening is critical. The richer union subset is recommended for Intrusion Detection Systems at the cloud or backend layer, where deeper analysis of traffic patterns can be performed. This hierarchical approach leverages the strengths of each feature representation to create a more resilient security architecture. However, the authors note that this deployment strategy remains conceptual and has not been validated on real IoT edge or gateway environments.

Limitations of the study include its focus on a specific subset of the CIC IoT-DIAD 2024 dataset, limiting the generalization of findings to other DDoS attack types or heterogeneous IoT environments. The evaluation was conducted on workstation-based hardware, and the runtime analysis reflects batch inference rather than individual sample latency. Additionally, the stochastic stability of the selected feature subsets across different random seeds or sampling sizes was not extensively evaluated. The authors suggest that future work should explore the framework’s performance on additional attack categories, independent datasets, and realistic IoT deployment scenarios to assess its robustness and practical viability.

Despite these limitations, the study contributes a systematic evaluation of post-selection feature construction strategies for IoT security. By demonstrating that combining independent metaheuristic optimizers can enhance detection performance while offering flexible deployment options, the research provides valuable insights for designing efficient intrusion detection and prevention systems. The findings support the use of hybrid feature selection methods to balance the competing demands of accuracy and efficiency in securing the expanding IoT ecosystem against evolving cyber threats.

Subject of Research: Hybrid metaheuristic feature selection for IoT DDoS attack detection

Article Title: Hybrid PSO–GWO feature selection for IoT DDoS detection with IDS/IPS-oriented deployment

Article References: Hyassat, A. S., Abualhaj, M. M., Elshourbagy, M. M., Shambour, Q. Y., Daoud, M. S., Alsharaiah, M. A., Yousif, M., & Anbar, M. (2026). Hybrid PSO–GWO feature selection for IoT DDoS detection with IDS/IPS-oriented deployment. Discover Internet of Things, 6(1), Article 256. https://doi.org/10.1007/s43926-026-00544-y

Image Credits: AI Generated

DOI: 10.1007/s43926-026-00544-y

Keywords: IoT Security, DDoS Detection, Feature Selection, Particle Swarm Optimization, Grey Wolf Optimizer, Machine Learning, Intrusion Detection, Network Traffic Analysis, HTTP Flood, CIC IoT-DIAD 2024, Hybrid, feature