Cloud computing (CC) is becoming an essential technology worldwide. This approach represents a revolution in data storage and collaborative services. Nevertheless, security issues have grown with the move to CC, including intrusion detection systems (IDSs). Intruders have developed advanced tools that trick the traditional IDS. This study attempts to contribute toward solving this problem and reducing its harmful effects by boosting IDS performance and efficiency in a cloud environment. We build two models based on deep neural networks (DNNs) for this study: the first model is built on a multi-layer perceptron (MLP) with backpropagation (BP), and the other is trained by MLP with particle swarm optimization (PSO). We use these models to deal with binary and multi-class classification on the updated cybersecurity CSE-CIC-IDS2018 dataset. This study aims to improve the accuracy of detecting intrusion attacks for IDSs in a cloud environment and to enhance other performance metrics. In this study, we document all aspects of our experiments in depth. The results show that the best accuracy obtained for binary classification was 98.97% and that for multi-class classification was 98.41%. Furthermore, the results are compared with those from the related literature.

Stochastic metaheuristic feature selection (FS) may generate unstable feature subsets across repeated runs, undermining reproducibility in Internet of Things (IoT) intrusion detection systems (IDSs). This paper presents Head–Tail Population Initialization (HTPI), a feature-importance-guided initialization approach for enhancing the stability of Adaptive Hybrid Genetic Algorithm–Simulated Annealing (AHGA-SA)-based FS. HTPI uses feature-importance scores to split candidate features into Head and Tail groups and initializes candidate subsets by prioritizing Head features and sampling Tail features with importance-based weights. HTPI is integrated into AHGA-SA as an incremental extension, termed HTPI-AHGA-SA, and modifies only the initialization and reinitialization steps. Experiments on eight IoT-oriented IDS datasets using 50 runs per configuration, with seeds paired across methods, showed significantly higher Nogueira stability under HTPI-AHGA-SA on all datasets after Holm correction, with non-overlapping 95% leave-one-run-out jackknife confidence intervals in every case. These results characterize algorithmic cross-run stability under a fixed data partition. All absolute differences in dataset-level mean F1 Macro remained below $0.003$; formal equivalence at this margin was supported for six datasets, while dataset-specific security-metric trade-offs remained. On three representative datasets, post hoc explainable artificial intelligence (XAI) analyses indicated generally higher permutation importance (PI)-based cross-run consistency and measurable predictive utility in the selected Head and Tail portions under retraining.

The increasing connectivity of Internet of Things (IoT)-oriented environments has made them more vulnerable to cyberattacks, requiring intrusion-detection systems (IDSs) to ensure their secure and reliable operation. The feature selection (FS) process of an IDS affects its performance, as effective FS can enhance detection accuracy and reduce the computational cost and model complexity. This paper presents Adaptive Hybrid Genetic Algorithm-Simulated Annealing (AHGA-SA) as an FS framework that integrates the global search ability of a genetic algorithm and the local exploitation ability of simulated annealing. AHGA-SA aims to find compact, informative feature subsets in high-dimensional intrusion-detection datasets at an acceptable computational cost while maintaining detection performance. The experimental results on three recent benchmarks demonstrate feature-space reduction, with classification accuracies of 99.04% on IoTID20 (using 12 features), 98.25% on WUSTL-EHMS (using seven features), and 99.18% on Edge-IIoTset (using nine features). The results also demonstrate reduced training and testing times, central processing unit usage, resident set size overhead, and subset size compared to the baseline. Furthermore, Shapley additive explanations, as an explainable artificial intelligence technique, are applied to explain the model’s predictions and to show the contribution of the selected features to the IDS decision-making process.