Metaheuristic Optimization Algorithms for Cybersecurity: A Multi-Domain Experimental Study on Intrusion Detection, Cryptographic Key Optimization, and Malware Classification - Ekbatanifard, Amir (Metaheuristic Algorithms with Applications, 2025)
The escalating sophistication of cyber threats demands adaptive, intelligent security mechanisms that transcend the limitations of conventional rule-based and signature-driven approaches. This paper presents a comprehensive metaheuristic-based security optimization framework that addresses three critical cybersecurity problems simultaneously: 1) Network Intrusion Detection System (NIDS) feature selection and classifier optimization using Genetic Algorithm (GA), Particle Swarm Optimization (PSO), Grey Wolf Optimizer (GWO), Whale Optimization Algorithm (WOA), and Harris Hawks Optimization (HHO), 2) cryptographic Substitution-Box (S-box) generation and key scheduling optimization for symmetric ciphers, and 3) malware classification via metaheuristic-optimized ensemble learning. Extensive experiments were conducted on four benchmark datasets — NSL-KDD, UNSW-NB15, and CICIDS-2017 for intrusion detection, and Malimg for malware classification — under rigorous experimental conditions including 10-fold cross-validation and 30 independent runs per configuration. In the intrusion detection domain, GWO-Random Forest (RF) achieved the highest accuracy of 99.41% on NSL-KDD with a 78.0% feature reduction, selecting only 9 of 41 original features. For cryptographic S-box generation, HHO produced S-boxes with an average nonlinearity score of 112 (maximum possible: 120), approaching the quality of the Advanced Encryption Standard (AES) standard S-box while exhibiting a differential uniformity of 6. In the malware classification domain, PSO-optimized ensemble classifiers attained an F1-score of 98.76% on the Malimg dataset. Statistical significance was confirmed via Friedman test (χ² = 18.93, p < 0.001) and pairwise Wilcoxon signed-rank tests. This study provides the first comprehensive multi-domain comparison of modern metaheuristic algorithms across the cybersecurity spectrum, offering practitioners evidence-based guidance for algorithm selection in diverse security applications.