The study presents GAN-CL-STO, a novel intrusion detection framework that integrates Generative Adversarial Networks (GANs), a 1D Convolutional-Long Short-Term Memory (CL) network, and hyperparameter tuning via the Siberian Tiger Optimization (STO). The model was implemented in Keras and trained over 50 epochs with a batch size of 16, and evaluated on three benchmark datasets (UNSW-NB15, CIC-IDS2017, and NSL-KDD). GAN-CL-STO achieved consistently higher accuracy compared to existing methods such as Transformer, Graph Neural Networks (GNNs), Fuzzy System, Reinforcement Learning, CNN-LSTM, PSO-1D CNN and 1D CNN + BiLSTM, reaching an overall accuracy of 99.91%. Compared to previous approach, the framework improved classification accuracy by 4.06%, mainly due to better feature selection and dynamic hyperparameter adjustment, while keeping computational costs low. During testing, the model showed a fast interface response time of 1.42 ms and an average latency of 33.7 ms, making it suitable for real-time SDN intrusion detection. One-way ANOVA analysis confirmed the reliability of these results, with all p-values below 0.05. The outcomes suggest that GAN-CL-STO could be a practical and reliable solution for strengthening modern network security. Additionally, the framework incorporates a steganography-based blacklist sharing mechanism, ensuring both feasibility and security for real-time SDN deployment.

Abstract The Internet of Things (IoT) has seen significant growth in recent years, impacting various sectors such as smart cities, healthcare, and transportation. However, IoT networks face significant security challenges, particularly from botnets that perform DDoS attacks. Traditional centralized intrusion detection systems struggle with the large traffic volumes in IoT environments. This study proposes a decentralized approach using a fog computing layer with a reptile group intelligence algorithm to reduce network traffic size, followed by analysis in the cloud layer using Apache Spark architecture. Key network traffic features are selected using a chameleon optimization algorithm and a principal component reduction method. Multi-layer artificial neural networks are employed for traffic analysis in the fog layer. Experiments on the NSL-KDD dataset indicate that the proposed method achieves up to 99.65% accuracy in intrusion detection. Additionally, the model outperforms other deep and combined learning methods, such as Bi-LSTM, CNN-BiLSTM, SVM-RBF, and SAE-SVM-RBF, in attack detection. Implementation of decision tree, random forest, and support vector machine algorithms in the cloud layer also demonstrates high accuracy rates of 96.27%, 98.34%, and 96.12%, respectively.

Abstract The increasing integration of cyber-physical systems (CPSs) and information and communication technologies (ICT) within the Smart Grid (SG) framework has led to significant advancements in energy systems. However, this integration introduces vulnerabilities, particularly cyberattacks like distributed denial of service (DDoS) attacks. This research presents a new approach to detecting cyberattacks in SG by combining deep learning (DL) techniques with the whale optimization (WOA) and fisher mantis optimization (FMO) algorithm, which forms the WOA-FMO hybrid algorithm. The system utilizes convolutional neural networks (CNN) for feature extraction and long-short-term memory (LSTM) networks to classify network traffic into normal and abnormal categories. The WOA-FMO algorithm optimizes the feature selection process, reducing dimensionality and improving model accuracy, thereby enhancing detection efficiency. Experimental evaluations on the PhishTank, UCI, and Tan datasets demonstrate that the proposed approach outperforms traditional approaches in terms of sensitivity, specificity, accuracy, and precision. A comparison of five optimization algorithms—GOA, ABC, BWO, GWO, and WOA-FMO—reveals that the WOA-FMO hybrid achieves the highest sensitivity (98.86%), accuracy (98.57%), and precision (98.30%), as well as strong specificity (98.28%). These results underscore the effectiveness of WOA-FMO in optimizing feature selection and improving classification performance, offering a robust solution for enhancing the resilience of IoT-based SGs against advanced cyberattacks.

Abstract The bitterling fish is a prime example of intelligent behavior in nature for survival. The bitterling fish uses the oyster spawning strategy as their babysitter. The female bitterling fish looks for a male fish stronger than other fish to find the right pair. In order to solve optimization issues, the Bitterling Fish Optimization (BFO) algorithm is modeled in this manuscript based on the mating behavior of these fish. The bitterling fish optimization algorithm is more accurate than the gray wolf optimization algorithm, whale optimization algorithm, butterfly optimization algorithm, Harris Hawks optimization algorithm, and black widow optimization algorithm, according to experiments and implementations on various benchmark functions. Data mining and machine learning are two areas where meta-heuristic techniques are frequently used. In trials, the MLP artificial neural network and a binary version of the BFO algorithm are used to lower the detection error for intrusion traffic. The proposed method's accuracy, precision, and sensitivity index for detecting network intrusion are 99.14%, 98.87%, and 98.85%, respectively, according to experiments on the NSL KDD data set. Compared to machine learning approaches like NNIA, DT, RF, XGBoot, and CNN, the proposed method is more accurate at detecting intrusion. The BFO algorithm is used for feature selection in the UNSW-NB15 dataset, and the tests showed that the accuracy of the proposed method is 96.72% in this dataset. The proposed method of the BFO algorithm is also used to improve Kmeans clustering, and the tests performed on the dataset of covid 19, diabetes, and kidney disease show that the proposed method performs better than iECA*, ECA*, GENCLUST + + (G + +) methods. Deep has KNN, LVQ, SVM, ANN, and KNN.