NFIoT-GATE-DTL IDS: Genetic algorithm-tuned ensemble of deep transfer learning for NetFlow-based intrusion detection system for internet of things

Abstract

Industry 5.0 requires robust Internet of Things (IoT) networks, which are constantly vulnerable to cyber threats. Despite contributions in intrusion detection systems (IDS), creating generalized attack classification models remains a challenge. Conventional machine learning or deep learning-driven IDSs struggle to retain learned knowledge and to keep up with rapidly increasing IoT threats, whereas transfer learning-based models may lose the resilience required for model generalization. Thus, this study proposes a Genetic Algorithm-Tuned Ensemble of Deep Transfer Learning for NetFlow-Based Intrusion Detection System for Internet of Things (NFIoT-GATE-DTL IDS) to fill the gap. Two public NetFlow IoT datasets are preprocessed and transformed into three-dimensional images for convolutional neural networks (CNNs). Six pre-trained CNNs, including Xception, Inception, MobileNet, MobileNetV2, DenseNet121, and EfficientNetB0, undergo hyperparameter optimization using a Genetic Algorithm (GA). The top-five models are then combined using a soft voting ensemble to boost detection robustness across diverse attack types. Validation methods are employed, including assessing the impact of GA optimization, comparing it to optimizers like the covariance matrix adaptation evolution strategy and the coyote optimization algorithm, and comparing it to cutting-edge studies. The proposed framework consistently achieves 100% accuracy across 15 attack classes, including three highly minority threats like backdoors, ransomware, and theft in IoT networks. Furthermore, the NFIoT-GATE-DTL IDS outperforms recent methodologies, achieving a 5–7% multi-classification higher accuracy on average. This research significantly contributes to a robust IDS with a high detection rate for NetFlow-based IoT networks.