Firefly Algorithm Optimized Hybrid Deep Learning Framework for Intrusion Detection in IoT Environments

The rapid proliferation of Internet of Things (IoT) technologies has transformed critical domains such as the Internet of Vehicles (IoV), the Internet of Medical Things (IoMT), and the Industrial Internet of Things (IIoT), while simultaneously introducing significant cybersecurity challenges. The increasing scale, heterogeneity, and dynamism of IoT networks have made them attractive targets for a wide range of sophisticated cyberattacks, placing Intrusion Detection Systems (IDSs) at the core of network defense mechanisms. However, conventional IDS approaches often suffer from limited detection accuracy and scalability due to high-dimensional data, feature redundancy, and stringent real-time processing requirements. To address these challenges, this paper proposes FA-CNN-RNN, a novel hybrid deep learning-based intrusion detection framework that integrates the Synthetic Minority Oversampling Technique (SMOTE) for class imbalance handling, the Firefly Algorithm (FA) for optimized IoT-specific feature selection, and a hybrid Convolutional Neural Network–Recurrent Neural Network (CNN–RNN) architecture for effective spatial–temporal feature learning. The proposed framework is evaluated using two widely adopted benchmark IoT-IDS datasets, NF-BoT-IoT-v2 and IoTID20, under both binary and multi-class intrusion detection scenarios. Experimental results demonstrate that FA-CNN-RNN achieves detection accuracies of 99.9% and 98.2% on NF-BoT-IoT-v2 and IoTID20, respectively, consistently outperforming conventional machine learning models, FA-optimized individual deep learning architectures, and state-of-the-art metaheuristic-based CNN–RNN models, including those optimized using Particle Swarm Optimization (PSO), Genetic Algorithm (GA), and Grey Wolf Optimizer (GWO). These findings confirm the effectiveness of FA-based feature optimization in reducing dimensionality while preserving discriminative power, resulting in improved detection performance and computational efficiency. Overall, the proposed FA-CNN-RNN framework demonstrates strong robustness, scalability, and practical potential for real-time intrusion detection in heterogeneous IoT environments. Future work will focus on deployment-oriented optimization for edge and fog computing platforms, integration with Explainable Artificial Intelligence (XAI) and blockchain technologies, and extended evaluation on additional large-scale datasets incorporating advanced and emerging cyber threats.