A systematic review of metaheuristics-based and machine learning-driven intrusion detection systems in IoT

2025-05-31

Swarm and Evolutionary Computation

AI Summary

IoT intrusion detection faces dual challenges of resource constraints and attack diversity, rendering conventional machine learning methods inadequate in balancing detection accuracy and edge deployability. This study conducts a systematic literature review of 217 papers following the PRISMA guidelines, establishing— for the first time—a cross-dimensional classification framework integrating metaheuristic algorithms with machine learning. It identifies 12 mainstream model categories, eight critical performance bottlenecks, and five key technical evolution pathways. We propose a novel evaluation standard grounded in two dimensions: reproducibility and edge adaptability. Leveraging a quality assessment matrix and cross-study meta-analysis, we deliver an empirically grounded roadmap for lightweight IDS design. The framework significantly enhances detection efficiency and deployment feasibility across heterogeneous IoT environments, advancing both theoretical understanding and practical implementation of edge-aware intrusion detection systems.

Technology Category

• Machine Learning: Learning on the Edge & Model Compression
• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Application Domains: Internet of Things, Sensor Networks & Smart Cities

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Security and Privacy: Large-scale security measurements

Problem

• Reviewing metaheuristics and ML for IoT intrusion detection
• Optimizing ML-based IDS for resource-constrained IoT networks
• Analyzing metaheuristics' role in feature selection and tuning

Innovation

• Combines metaheuristics with ML for IoT security
• Optimizes feature selection and hyperparameter tuning
• Analyzes hybrid uses in intrusion detection systems