ABSTRACT Computer networking technologies play a crucial role in daily activities. However, they pose significant security challenges, and deploying cybersecurity systems to protect sensitive data is vital. A fast‐optimizing and adaptable system can quickly learn new cyberattacks and adapt to ever‐changing threats. Recent research has shown that the feature selection integrated classifier optimization algorithm (FSCOA) is promising for intrusion detection systems (IDS); however, its exhaustive search‐based classifier optimization is time‐consuming. To overcome this drawback, the present study proposes a new optimization framework, namely the Progressive Classifier Optimization Algorithm (PCOA), to enhance FSCOA in terms of time efficiency and develop fast‐optimizing support vector machines (SVM). The proposed method was evaluated on five modern intrusion detection datasets. In addition, 15 intrusion detection datasets with various difficulty levels were extracted for model evaluation. For a realistic performance analysis, bias issues, the most critical metrics, and time complexity analyses were considered. The proposed algorithm led to the classification performance above 99% with below 1% false alarm rates of SVM for most datasets. Experimental results showed that PCOA's classification performance is comparable to FSCOA, with approximately five times less time complexity. PCOA‐optimized SVM performs similarly to other methods from the literature, such as random forest and deep learning algorithms. In conclusion, this study proposes a fast‐optimizing IDS that can be frequently updated to protect various networking setups from ever‐changing cyber‐attacks using limited‐capacity computing devices. Additionally, essential insights into feature selection and classifier optimization for intrusion detection are provided in this study.

Summary In the era of technology, information security has gained significant importance, as intruders constantly conduct attacks to breach information systems. Intelligent network intrusion detection systems (NIDS) are promising for detecting malicious activities; however, it is required to apply feature selection (FS) and classifier optimisation (CO) using cost‐effective algorithms to build an accurate and efficient system. Although classifier‐dependent FS (CDFS) techniques and CO algorithms have been shown to perform well, they suffer from computational complexity, and their interdependencies negatively affect model performance. This study proposes the FS‐integrated classifier optimisation algorithm that incorporates FS during CO, enhances optimisation, and tackles the interdependency problem. Furthermore, since this algorithm does not use an iterative feature selection process, such as forward selection or backward elimination, it provides relatively less complexity than other CDFS techniques. Moreover, an application of the proposed methodology (NIDS) was implemented using the designed framework to validate the model in this problem domain. The proposed methodology achieved accuracies of 85.10%, 73.24% with one feature for the NSLKDD datasets, 83.45% with 32 features for the UNSW‐NB15 dataset, 99.41% with eight features, and 99.63% with 16 features for the CIC‐IDS2017 datasets. The results showed that the FS‐integrated optimisation algorithm had improved the accuracy of the classifier with fewer features. Furthermore, the proposed methodology outperformed other FS, ensemble learning, and deep learning‐based methods regarding detection accuracy and false alarm rate. In conclusion, the developed NIDS is an accurate, efficient, straightforward, feasible, and easy‐to‐implement system that can be created using limited computing power and time as a promising solution to protect traditional and modern computer networks.

Summary With digitization and modern network applications, information security has gained a tremendous importance. Therefore, accurate and efficient detection systems are crucial for maintaining proactive security in computer networks. Machine learning (ML) has shown great potential as a promising solution since it can teach a machine to distinguish malicious and normal network activities. However, recently proposed methods are suffering from at least one of the following: detection accuracy, false alarm rate, and computational complexity issues. The main reason behind this problem is the complexity of the model in terms of attack types. From the ML perspective, intrusion detection is a classification problem where each attack type is identified by a set of different features, and features are used for classifying network activities. Thus, training an ML algorithm to detect more than one attack type leads to a more complex model; the increasing number of used features contributes positively to the model complexity, and may result in relatively lower detection accuracy or a higher false positive rate. To tackle this problem, this study proposes an attack‐wise customized network intrusion detection system (AWC‐NIDS) based on ML, concurrency, and distributed systems to achieve accurate and efficient network‐wide intrusion detection. Since CICIDS2017 contains many modern attacks, it was used for model development and performance evaluation. The experimental results showed that the proposed methodology achieved high classification performance for all datasets with a small number of features. However, it was observed that the lowest accuracy was achieved for the comprehensive dataset (which contains all attack types); for the single attack‐type datasets, the obtained accuracy was above 99%. This finding proves the concept of attack‐wise customization for intrusion detection and shows the significance of the proposed methodology. In conclusion, this framework is promising for implementing robust and accurate cybersecurity systems for traditional and modern networking.

Abstract Ensemble feature selection (EFS) is a valuable technique for developing accurate and robust machine‐learning (ML) models. Data variation plays a crucial role in the success of EFS models; however, it also causes some outliers in the ranked lists. In this study, we proposed the minimum weight threshold method‐based EFS (MWT‐EFS) to address the outlier problem and use the true power of EFS. The proposed method employs the support vector classifier to assign weights for features, and the MWT method handles outliers in the ranked feature lists while creating the ensemble list. First, a threshold value is determined. After that, the feature weights below the threshold are replaced with this value. This approach eliminates the negative effect of outliers. After the new feature weights are assigned, the average of the feature weights is calculated (mean aggregation) for all features, and the ensemble (final) feature list is created accordingly. The experiment results showed that the proposed method significantly improves gene selection stability while maintaining classification performance and reducing computational complexity. In conclusion, the proposed method led to an accurate and robust classification that can help domain experts to make more confident decisions with less effort, resources, and time.