{"id":"https://openalex.org/W4414816278","doi":"https://doi.org/10.32604/cmc.2025.068958","title":"Advances in Machine Learning for Explainable Intrusion Detection Using Imbalance Datasets in Cybersecurity with Harris Hawks Optimization","display_name":"Advances in Machine Learning for Explainable Intrusion Detection Using Imbalance Datasets in Cybersecurity with Harris Hawks Optimization","publication_year":2025,"publication_date":"2025-10-04","ids":{"openalex":"https://openalex.org/W4414816278","doi":"https://doi.org/10.32604/cmc.2025.068958"},"language":"en","primary_location":{"id":"doi:10.32604/cmc.2025.068958","is_oa":true,"landing_page_url":"https://doi.org/10.32604/cmc.2025.068958","pdf_url":null,"source":{"id":"https://openalex.org/S4210191605","display_name":"Computers, materials & continua/Computers, materials & continua (Print)","issn_l":"1546-2218","issn":["1546-2218","1546-2226"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers, Materials & Continua","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.32604/cmc.2025.068958","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5103097189","display_name":"Amjad Rehman","orcid":null},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Amjad Rehman","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5018549351","display_name":"Tanzila Saba","orcid":"https://orcid.org/0000-0003-3138-3801"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tanzila Saba","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051158911","display_name":"Mona Jamjoom","orcid":"https://orcid.org/0000-0001-9149-2810"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mona M. Jamjoom","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5030636911","display_name":"Shaha Al\u2010Otaibi","orcid":"https://orcid.org/0000-0002-6720-9955"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shaha Al-Otaibi","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5045286608","display_name":"Muhammad Imran Khan","orcid":"https://orcid.org/0000-0002-6675-0491"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Muhammad I. Khan","raw_affiliation_strings":[],"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5103097189"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.33980026,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"86","issue":"1","first_page":"1","last_page":"15"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9959999918937683,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9959999918937683,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9945999979972839,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11652","display_name":"Imbalanced Data Classification Techniques","score":0.9682999849319458,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.6917999982833862},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5509999990463257},{"id":"https://openalex.org/keywords/outlier","display_name":"Outlier","score":0.4683000147342682},{"id":"https://openalex.org/keywords/dimensionality-reduction","display_name":"Dimensionality reduction","score":0.44449999928474426},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.39079999923706055},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.36570000648498535},{"id":"https://openalex.org/keywords/fitness-function","display_name":"Fitness function","score":0.3499999940395355},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.34869998693466187},{"id":"https://openalex.org/keywords/feature-selection","display_name":"Feature selection","score":0.34470000863075256}],"concepts":[{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.7745000123977661},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.7597000002861023},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7124000191688538},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6917999982833862},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5509999990463257},{"id":"https://openalex.org/C79337645","wikidata":"https://www.wikidata.org/wiki/Q779824","display_name":"Outlier","level":2,"score":0.4683000147342682},{"id":"https://openalex.org/C70518039","wikidata":"https://www.wikidata.org/wiki/Q16000077","display_name":"Dimensionality reduction","level":2,"score":0.44449999928474426},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.42800000309944153},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.39079999923706055},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.36570000648498535},{"id":"https://openalex.org/C176066374","wikidata":"https://www.wikidata.org/wiki/Q629118","display_name":"Fitness function","level":3,"score":0.3499999940395355},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.34869998693466187},{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.34470000863075256},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.3179999887943268},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.3165000081062317},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.3158999979496002},{"id":"https://openalex.org/C109718341","wikidata":"https://www.wikidata.org/wiki/Q1385229","display_name":"Metaheuristic","level":2,"score":0.30660000443458557},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.3052999973297119},{"id":"https://openalex.org/C2778827112","wikidata":"https://www.wikidata.org/wiki/Q22245680","display_name":"Feature engineering","level":3,"score":0.30219998955726624},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.2904999852180481},{"id":"https://openalex.org/C193254401","wikidata":"https://www.wikidata.org/wiki/Q2160088","display_name":"Robust optimization","level":2,"score":0.27379998564720154},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.2720000147819519},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.271699994802475},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.26759999990463257},{"id":"https://openalex.org/C46686674","wikidata":"https://www.wikidata.org/wiki/Q466303","display_name":"Boosting (machine learning)","level":2,"score":0.2612000107765198},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.25699999928474426},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2549999952316284},{"id":"https://openalex.org/C111030470","wikidata":"https://www.wikidata.org/wiki/Q1430460","display_name":"Curse of dimensionality","level":2,"score":0.2549000084400177}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.32604/cmc.2025.068958","is_oa":true,"landing_page_url":"https://doi.org/10.32604/cmc.2025.068958","pdf_url":null,"source":{"id":"https://openalex.org/S4210191605","display_name":"Computers, materials & continua/Computers, materials & continua (Print)","issn_l":"1546-2218","issn":["1546-2218","1546-2226"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers, Materials & Continua","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.32604/cmc.2025.068958","is_oa":true,"landing_page_url":"https://doi.org/10.32604/cmc.2025.068958","pdf_url":null,"source":{"id":"https://openalex.org/S4210191605","display_name":"Computers, materials & continua/Computers, materials & continua (Print)","issn_l":"1546-2218","issn":["1546-2218","1546-2226"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers, Materials & Continua","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Modern":[0],"intrusion":[1],"detection":[2],"systems":[3],"(MIDS)":[4],"face":[5],"persistent":[6],"challenges":[7],"in":[8,223,266,298],"coping":[9],"with":[10,74,204],"the":[11,27,52,101,117,133,138,158,212,217,225,229,236,239,244,249,255],"rapid":[12],"evolution":[13],"of":[14,65,160,207,238,251],"cyber":[15],"threats,":[16],"high-volume":[17],"network":[18,60],"traffic,":[19],"and":[20,29,35,54,67,81,86,92,163,174,179,195,242,264,278,284,305],"imbalanced":[21],"datasets.":[22],"Traditional":[23],"models":[24],"often":[25],"lack":[26],"robustness":[28,173],"explainability":[30],"required":[31],"to":[32,83,137,141,234,247],"detect":[33],"novel":[34],"sophisticated":[36,75],"attacks":[37],"effectively.":[38],"This":[39,168,291],"study":[40,246],"introduces":[41],"an":[42,205],"advanced,":[43],"explainable":[44,268],"machine":[45],"learning":[46],"framework":[47],"for":[48,209,288,295],"multi-class":[49],"IDS":[50,55],"using":[51,188],"KDD99":[53],"datasets,":[56],"which":[57],"reflects":[58],"real-world":[59],"behavior":[61],"through":[62],"a":[63,123,220],"blend":[64],"normal":[66],"diverse":[68,182],"attack":[69,149],"classes.":[70],"The":[71,151,184,198],"methodology":[72],"begins":[73],"data":[76,140],"preprocessing,":[77],"incorporating":[78],"both":[79,276,303],"RobustScaler":[80],"QuantileTransformer":[82],"address":[84],"outliers":[85],"skewed":[87],"feature":[88,131,282],"distributions,":[89],"ensuring":[90],"standardized":[91],"model-ready":[93],"inputs.":[94],"Critical":[95],"dimensionality":[96],"reduction":[97],"is":[98,135,154,258],"achieved":[99],"via":[100],"Harris":[102],"Hawks":[103],"Optimization":[104],"(HHO)":[105],"algorithm\u2014a":[106],"nature-inspired":[107],"metaheuristic":[108],"modeled":[109],"on":[110,127,231],"hawks\u2019":[111],"hunting":[112],"strategies.":[113],"HHO":[114],"efficiently":[115],"identifies":[116],"most":[118],"informative":[119],"features":[120],"by":[121,145,176],"optimizing":[122],"fitness":[124],"function":[125],"based":[126],"classification":[128,190],"performance.":[129],"Following":[130],"selection,":[132],"SMOTE":[134],"applied":[136],"training":[139],"resolve":[142],"class":[143],"imbalance":[144],"synthetically":[146],"augmenting":[147],"underrepresented":[148],"types.":[150],"stacked":[152],"architecture":[153],"then":[155],"employed,":[156],"combining":[157],"strengths":[159],"XGBoost,":[161],"SVM,":[162],"RF":[164],"as":[165],"base":[166],"learners.":[167],"layered":[169],"approach":[170,241],"improves":[171],"prediction":[172],"generalization":[175],"balancing":[177],"bias":[178],"variance":[180],"across":[181],"classifiers.":[183],"model":[185,218,230,257],"was":[186,202],"evaluated":[187],"standard":[189],"metrics:":[191],"precision,":[192],"recall,":[193],"F1-score,":[194],"overall":[196,200],"accuracy.":[197],"best":[199],"performance":[201],"recorded":[203],"accuracy":[206],"99.44%":[208],"UNSW-NB15,":[210],"demonstrating":[211],"model\u2019s":[213],"effectiveness.":[214],"After":[215],"balancing,":[216],"demonstrated":[219],"clear":[221],"improvement":[222],"detecting":[224],"attacks.":[226],"We":[227],"tested":[228],"four":[232],"datasets":[233],"show":[235],"effectiveness":[237],"proposed":[240,256],"performed":[243],"ablation":[245],"check":[248],"effect":[250],"each":[252],"parameter.":[253],"Also,":[254],"computationaly":[259],"efficient.":[260],"To":[261],"support":[262],"transparency":[263],"trust":[265],"decision-making,":[267],"AI":[269],"(XAI)":[270],"techniques":[271],"are":[272],"incorporated":[273],"that":[274,301],"provides":[275],"global":[277],"local":[279],"insight":[280],"into":[281],"contributions,":[283],"offers":[285],"intuitive":[286],"visualizations":[287],"individual":[289],"predictions.":[290],"makes":[292],"it":[293],"suitable":[294],"practical":[296],"deployment":[297],"cybersecurity":[299],"environments":[300],"demand":[302],"precision":[304],"accountability.":[306]},"counts_by_year":[],"updated_date":"2026-03-07T16:01:11.037858","created_date":"2025-10-10T00:00:00"}