Marine Predator Optimized BiLSTM Framework for Real-Time Intrusion Detection in IoT Environments
DOI:
https://doi.org/10.31185/wjps.898Keywords:
Intrusion Detection System (IDS), Internet of Things (IoT), Marine Predator Algorithm (MPA), Bidirectional LSTM (BiLSTM), Explainable AI (XAI)Abstract
The rapid expansion and interconnectivity of Internet of Things (IoT) environments have intensified the risk of advanced cyber-attacks, necessitating the development of intelligent and resource-efficient Intrusion Detection Systems (IDS). This study introduces a novel hybrid IDS framework that integrates the Marine Predators Algorithm (MPA) with a Bidirectional Long Short-Term Memory (BiLSTM) network to enhance both detection accuracy and computational efficiency. Within the proposed model, MPA is employed for feature selection and hyperparameter optimization, thereby refining the learning dynamics of the BiLSTM architecture. Experimental evaluations conducted on two benchmark IoT datasets, CICIoT2023 and TON_IoT, demonstrate that the MPA-BiLSTM model consistently achieves detection accuracies exceeding 99.5%, while maintaining low inference latency and minimal memory consumption—characteristics that ensure suitability for real-time edge deployment. Additionally, SHAP-based explainability mechanisms are integrated to provide interpretability of feature importance, thereby fostering transparency and trust in the decision-making process. The results confirm that the synergistic integration of MPA with BiLSTM significantly improves both predictive performance and operational efficiency, establishing the proposed framework as a scalable and practical solution for IoT security.
References
[1] S. A. Bajpai and A. B. Patankar, “Marine Goal Optimizer Tuned Deep BiLSTM-Based Self-Configuring Intrusion Detection in Cloud,” Journal of Grid Computing, vol. 22, art. no. 24, Feb. 2024.
[2] M. Jouhari and M. Guizani, “Lightweight CNN–BiLSTM based Intrusion Detection Systems for Resource-Constrained IoT Devices,” arXiv preprint, arXiv:2406.04897, Jun. 2024.
[3] M. Jouhari, H. Benaddi, and K. Ibrahimi, “Efficient Intrusion Detection: Combining χ² Feature Selection with CNN–BiLSTM on the UNSW–NB15 Dataset,” arXiv preprint, arXiv:2407.14945, Jul. 2024.
[4] A. Naeem, M. A. Khan, N. Alasbali, J. Ahmad, A. A. Khattak, and M. S. Khan, “Efficient IoT Intrusion Detection with an Improved Attention-Based CNN–BiLSTM Architecture,” arXiv preprint, arXiv:2503.19339, Mar. 2025.
[5] S. W. A. Alsudani and G. K. Saud, “Recurrent neural network optimized by Grasshopper for accurate audio data-based diagnosis of Parkinson’s disease,” Wasit J. Pure Sci., vol. 4, no. 2, pp. 56–75, 2025.
[6] F. S. Alrayes et al., “Privacy-Preserving Approach for IoT Networks Using Statistical Learning with Optimization Algorithm on High-Dimensional Big Data Environment,” Scientific Reports, vol. 15, art. no. 3338, Jan. 2025.
[7] P. Sinha et al., “A High Performance Hybrid LSTM–CNN Secure Architecture for IoT Environments Using Deep Learning,” Scientific Reports, vol. 15, art. no. 9684, Jul. 2025.
[8] S. E. Sorour, M. Aljaafari, A. M. Shaker, and A. E. Amin, “LSTM–JSO Framework for Privacy-Preserving Adaptive Intrusion Detection in Federated IoT Networks,” Scientific Reports, vol. 15, art. no. 11321, Apr. 2025.
[9] S. Sadhwani, M. A. H. Khan, R. Muthalagu, and P. M. Pawar, “BiLSTM–CNN Hybrid Intrusion Detection System for IoT Application,” ResearchGate Preprint, Jan. 2024, doi:10.21203/rs.3.rs-3820775/v1.
[10] X. Huang et al., “An Optimized LSTM-Based Deep Learning Model for Anomaly Network Intrusion Detection,” Scientific Reports, Jan. 2025.
[11] I. A. Soomro, H. ur Rehman Khan, S. J. Hussain, Z. Ashraf, M. M. Alnfiai and N. N. Alotaibi, "Lightweight privacy-preserving federated deep intrusion detection for industrial cyber-physical system," in Journal of Communications and Networks, vol. 26, no. 6, pp. 632-649, Dec. 2024, doi: 10.23919/JCN.2024.000054.
[12] X. Tiwari et al., “A Secure and Robust Machine Learning Model for Intrusion Detection in Internet of Vehicles,” IEEE Access, 2025.
[13] H. Faramarzi, M. Heidarinejad, B. Stephens, and S. Mirjalili, "Marine Predators Algorithm: A Nature-inspired Metaheuristic," Expert Systems with Applications, vol. 152, p. 113377, 2020.
[14] P. Turaka and S. K. Panigrahy, "Dynamic Attack Detection in IoT Networks: An Ensemble Learning Approach With Q-Learning and Explainable AI," in IEEE Access, vol. 12, pp. 161925-161940, 2024, doi: 10.1109/ACCESS.2024.3485989.
[15] O. Aslan, M. Ozkan-Okay, and D. Gupta, “Intelligent Behavior-Based Malware Detection System on Cloud Computing Environment,” IEEE Access, vol. 9, pp. 1–20, 2021.
[16] D. Stiawan et al., “Investigating Brute-Force Attack Patterns in IoT Network,” Journal of Electrical and Computer Engineering, 2019.
[17] S. Alsudani and M. N. Saeea, "Enhancing Thyroid Disease Diagnosis through Emperor Penguin Optimization Algorithm," Wasit Journal for Pure Sciences, vol. 2, no. 4, 2023.
[18] X. Chen and Y. Liu, “A Comprehensive Review of AI-Based Intrusion Detection Systems in IoT,” IEEE Transactions on Emerging Topics in Computational Intelligence, vol. 8, pp. 22–39, 2024.
[19] A. Zohourian, S. Dadkhah, H. Molyneaux, E. C. P. Neto, and A. A. Ghorbani, “IoT-PRIDS: Leveraging packet representations for intrusion detection in IoT networks,” Computers & Security, vol. 146, p. 104034, 2024, doi: 10.1016/j.cose.2024.104034. 4.
[20] Y. Alotaibi and M. Ilyas, “Ensemble-learning framework for intrusion detection to enhance Internet of Things’ devices security,” Sensors, vol. 23, no. 12, p. 5568, 2023, doi: 10.3390/s23125568.
[21] B. Yazdinejad et al., “Deep Learning for Network Security: Attention–CNN–LSTM Model for Accurate Intrusion Detection,” Scientific Reports, Jul. 2025.
[22] M. Al-Hawawreh, E. Sitnikova and N. Aboutorab, "Asynchronous Peer-to-Peer Federated Capability-Based Targeted Ransomware Detection Model for Industrial IoT," in IEEE Access, vol. 9, pp. 148738-148755, 2021, doi: 10.1109/ACCESS.2021.3124634.
[23] A. Nazir, J. He, N. Zhu, S. S. Qureshi, S. U. Qureshi, F. Ullah, A. Wajahat, and M. S. Pathan, “A deep learning-based novel hybrid CNN-LSTM architecture for efficient detection of threats in the IoT ecosystem,” Ain Shams Engineering Journal, vol. 15, no. 7, p. 102777, 2024, doi: 10.1016/j.asej.2024.102777.
[24] S. Hossain, S. M. Senouci, B. Brik, and A. A. Boualouache, “Privacy-Preserving Self-Supervised Learning-Based Intrusion Detection for 5G–V2X Networks,” Ad Hoc Networks, vol. 166, art. no. 103674, 2025.
[25] G. Engelen, V. Rimmer and W. Joosen, "Troubleshooting an Intrusion Detection Dataset: the CICIDS2017 Case Study," 2021 IEEE Security and Privacy Workshops (SPW), San Francisco, CA, USA, 2021, pp. 7-12, doi: 10.1109/SPW53761.2021.00009.
[26] G. Sripriyanka and A. Mahendran, "Securing IoMT: A Hybrid Model for DDoS Attack Detection and COVID-19 Classification," in IEEE Access, vol. 12, pp. 17328-17348, 2024, doi: 10.1109/ACCESS.2024.3354034.
[27] M. S. Ahsan, S. Islam, and S. Shatabda, “Systematic Review of Metaheuristics-Based and Machine Learning-Driven IDS in IoT,” Swarm and Evolutionary Computation, submitted Jul. 2024.
[28] H. Hakami, M. Faheem and M. Bashir Ahmad, "Machine Learning Techniques for Enhanced Intrusion Detection in IoT Security," in IEEE Access, vol. 13, pp. 31140-31158, 2025, doi: 10.1109/ACCESS.2025.3542227.
[29] S. Alsudani, H. Nasrawi, M. Shattawi, and A. Ghazikhani, "Enhancing Spam Detection: A Crow-Optimized FFNN with LSTM for Email Security," Wasit Journal of Computer and Mathematics Science, vol. 3, pp. 1–15, 2024.
[30] S. Elouardi, A. Motii, M. Jouhari, A. Nasser Hassane Amadou and M. Hedabou, "A Survey on Hybrid-CNN and LLMs for Intrusion Detection Systems: Recent IoT Datasets," in IEEE Access, vol. 12, pp. 180009-180033, 2024, doi: 10.1109/ACCESS.2024.3506604.
[31] M. Alotaibi et al., "Integrating Two-Tier Optimization Algorithm With Convolutional Bi-LSTM Model for Robust Anomaly Detection in Autonomous Vehicles," in IEEE Access, vol. 13, pp. 6820-6833, 2025, doi: 10.1109/ACCESS.2024.3523539.
[32] S. Racherla, P. Sripathi, N. Faruqui, M. Alamgir Kabir, M. Whaiduzzaman and S. Aziz Shah, "Deep-IDS: A Real-Time Intrusion Detector for IoT Nodes Using Deep Learning," in IEEE Access, vol. 12, pp. 63584-63597, 2024, doi: 10.1109/ACCESS.2024.3396461.
[33] C. Zhang, J. Li, N. Wang, and D. Zhang, “Research on intrusion detection method based on transformer and CNN-BiLSTM in Internet of Things,” Sensors, vol. 25, no. 9, p. 2725, 2025, doi: 10.3390/s25092725.
[34] S. S. Kareem, R. R. Mostafa, F. A. Hashim, and H. M. El-Bakry, “An effective feature selection model using hybrid metaheuristic algorithms for IoT intrusion detection,” Sensors, vol. 22, no. 4, p. 1396, 2022, doi: 10.3390/s22041396.
[35] X. A. Larriva-Novo, M. Vega-Barbas, V. A. Villagrá and M. Sanz Rodrigo, "Evaluation of Cybersecurity Data Set Characteristics for Their Applicability to Neural Networks Algorithms Detecting Cybersecurity Anomalies," in IEEE Access, vol. 8, pp. 9005-9014, 2020, doi: 10.1109/ACCESS.2019.2963407.
[36] V. R. Balasaraswathi, M. Sugumaran, and Y. Hamid, “Feature selection techniques for intrusion detection using non-bio-inspired and bio-inspired optimization algorithms,” Journal of Communications and Information Networks, vol. 2, pp. 107–119, 2017, doi: 10.1007/s41650-017-0033-7.
[37] E. Gyamfi and A. Jurcut, “Intrusion detection in Internet of Things systems: A review on design approaches leveraging multi-access edge computing, machine learning, and datasets,” Sensors, vol. 22, no. 10, p. 3744, 2022, doi: 10.3390/s22103744.
[38] Z. Alwaisi, “Memory-efficient and robust detection of Mirai botnet for future 6G-enabled IoT networks,” Internet of Things, vol. 32, p. 101621, 2025, doi: 10.1016/j.iot.2025.101621.
[39] F. Bourebaa and M. Benmohammed, "Evaluating Lightweight Transformers With Local Explainability for Android Malware Detection," in IEEE Access, vol. 13, pp. 101005-101026, 2025, doi: 10.1109/ACCESS.2025.3577775.
[40] Y. Kim and B. Kang, "Towards Practical Edge Intelligence for Cybersecurity in IoT: Challenges and Deployments," ACM Transactions on Cyber-Physical Systems, vol. 7, no. 4, 2023.
[41] MM. Jouhari and M. Guizani, "Lightweight CNN-BiLSTM based Intrusion Detection Systems for Resource-Constrained IoT Devices," 2024 International Wireless Communications and Mobile Computing (IWCMC), Ayia Napa, Cyprus, 2024, pp. 1558-1563, doi: 10.1109/IWCMC61514.2024.10592352.
[42] G. Shobana, A. T. Nathan, D. S. Sivakumar, et al., “GBiL: A hybrid gated recurrent units (GRU) and bidirectional long short-term memory (BiLSTM) model with Particle Swarm Optimization for a robust VANET IDS,” Journal of Wireless Communications and Networking, vol. 2025, no. 57, 2025, doi: 10.1186/s13638-025-02467-8.
Downloads
Published
Issue
Section
License
Copyright (c) 2025 Huda Kadhum Ayoob, Haneen Hasan Hadi Rubaye, Sarah Hayder Hashim
This work is licensed under a Creative Commons Attribution 4.0 International License.
