An improved remora optimization algorithm for optimizing a support vector machine based network anomaly traffic detection model

To improve the detection performance of anomalous network traffic, a network anomaly traffic detection model was developed by integrating an improved Remora Optimization Algorithm (IROA) with Support Vector Machine (SVM). Specifically, the White Shark Optimizer was incorporated into the host-switching mechanism of the Remora Optimization Algorithm to enhance global exploration. An adaptive weight operator was adopted to refine the experiential attack process, thus improving the convergence accuracy. In addition, a quadratic interpolation strategy was embedded to strengthen the global search performance and the ability to escape local optima. The performance of IROA is first evaluated on the CEC2020 (dim = 10) and CEC2017 (dim = 50, 100) benchmark functions, confirming its superior convergence speed and robustness in high-dimensional search spaces. Subsequently, the IROA-SVM model is validated on the NSL-KDD dataset, with comprehensive comparisons against seven optimization-based SVM models and three conventional classifiers. Statistical significance is rigorously verified using the Friedman rank test (p = 0.0008) and pairwise Wilcoxon rank-sum tests (all p < 0.05 ). Results demonstrate that IROA-SVM achieves the highest performance across Accuracy, Precision, F1-score, ROC-AUC, and MCC. However, the inherently high computational complexity of IROA and the outdated nature of the NSL-KDD dataset limit its direct applicability to real-time detection in modern network environments. These limitations and corresponding future research directions are explicitly discussed.