This work introduces a novel LXAIDM-CTLSN method. The aim is to detect and classify cyberattacks to achieve cybersecurity. The LXAIDM-CTLSN model encompasses processes such as data normalization, MOA-based feature selection, SDAE-based cyberthreat detection, HOA-based parameter selection, and the LIME process, shown in Fig. 2. The novelty of the LXAIDM-CTLSN model is in its integrated and customized framework that integrates min-max normalization, MOA-based feature selection, and SDAE-based cyberattack detection. Enhanced further by the HOA model for hyperparameter tuning and LIME for explainable threat classification, this comprehensive approach outperforms conventional methods in both performance and interpretability.

Data normalization

In the initial phase, the LXAIDM-CTLSN method performs data normalization using the Min-max normalization technique³⁴. Min-max normalization is a data preprocessing method that converts features into the typical scale, usually from zero to one. Based on cyberattacks, min-max normalization standardizes several attack indicators, namely response times, frequency of attacks, and severity scores. This is vital for successful threat comparison and detection, allowing cybersecurity systems to detect anomalies and patterns accurately. Data normalization makes it easy to analyze and integrate data from numerous sources, augmenting the performance of threat detection systems.

MOA-based feature selection

The MOA is used for the feature selection method, which sequentially decreases the computational complexity³⁵. This model is chosen due to its efficiency in mitigating computational complexity while maintaining high accuracy. Unlike conventional methods, MOA can effectually navigate large and intrinsic datasets by selecting the most relevant features, thus enhancing the overall model performance. Its behaviour of replicating the mayfly’s swarm behaviour allows it to explore the feature space effectively, avoiding the risk of local optima. Also, MOA is computationally less expensive than other optimization techniques, making it more appropriate for real-time applications. By mitigating the number of features, MOA not only speeds up the training process but also assists in mitigating the risk of overfitting, ensuring a more robust model. This makes it an ideal choice for handling large-scale datasets in cybersecurity applications. Figure 3 illustrates the steps involved in the MOA technique.

Steps involved in the MOA model.

This study discusses the usage of MOA as an optimization algorithm. A comparative study was conducted using PSO and FA with a similar objective function to evaluate the effectiveness of the MOA model. This study sheds light on the mayfly (MF) species, well-known for its extraordinarily short twenty-four‐hour lifespan. The researcher workers witnessed a difference between female and male MFs within flocks; due to natural force differences, male MFs constantly show higher optimization levels than female MFs. These characteristics resemble PSO, where individuals in the PSO, similar to MFs, update position \(X\left(t\right)\) and velocity \(v\left(t\right)\) according to the present state.

(1) The actions of male mayflies

In the context of MOA, males change their location according to their individual speed. \({x}_{i}\) refers to the area of the \({i}^{th}\) male MFs at \({t}^{th}\) existing time step in the search range.

The male MF actively engages in exploration and exploitation duties at the initial iteration. During velocity updating, the MF considers the existing fitness values as \(\left({x}_{i}\right)\), and\(f\left({x}_{hi}\right)\) is the better fitness value witnessed on its trajectory in the past. The males alter the velocity if \((X)\)is higher than \(\left({x}_{hi}\right)\). This can be defined by three major factors: its existing speed, the separation between its exiting and the best locations, and the best trajectory in the past. Also, it allows the males to enhance their movement strategy once they observe fitness progress.

The linear descent of the variable \(g\) from maximum to minimum values is directed by weight parameters \(a1,a2\), and \(\beta\). The \({r}_{p}\) and \({r}_{g}\) are variables that evaluate the Cartesian distance between prior best placements and individuals. The second norm is calculated for the distance array in Cartesian space. The distances between individuals and the past best location within the swarm are as follows:

The male MF uses a random dance coefficient, represented by ‘\(d,\)‘ to update the velocity from the present value once the fitness values \(f\left({x}_{i}\right)\) are less than \(f\left({x}_{hi}\right)\). \({r}_{i}\) is a uniform distribution random value in [1,1].

(2) The actions of female mayflies

Compared to male MFs Female, MFs show different behaviours. They actively find males for the breeding purpose rather than congregating. Consider that it is the existing location of the females in the search range at \(t\) time; its location can be changed by adding the speed \({v}_{i}\left(t1\right)\) to the present location as follows:

Different techniques are used to update females’ speed. Wingless females usually have a lifespan of 1–7 days. They exhibit a sense of urgency in locating males for breeding and mating. In response to the actions and characteristics of the chosen male MF, the females adapt their velocity.

When \(\left({y}_{i}\right)>f\left({x}_{i}\right)\), then the \({i}^{th}\) female MF utilizes Eq. (6) for updating the velocity. Here, the speed can be adjusted by the further constant, \({a}_{3}\), and \({r}_{m}\)is the Cartesian distance between them.

If \(f\left({y}_{i}\right), then females alter the velocity speed using a random dance coefficient represented by \(fl\). \({r}_{2}\) is a variable representing a random number within [\(\text{1,1}\)].

(3) Mayflies mating

Most male and female MFs participate in mating, which leads to offspring production. They inherit qualities from their parents and undergo random evolutionary changes where \(L\) is the set of random numbers from the Gaussian distribution.

(4) Mayflies variation

To overcome the premature convergence issues, the optimum value might be a local optimum instead of a global one, so a uniform distribution random number is introduced into the mutation process for offspring MFs. This can be mathematically modelled as follows:

In Eq. (10), \(\sigma\) indicates the standard deviation. \(N(0,1)\) is a uniform distribution with a mean of \(0\) and variance of \(1\). The mutant individual is estimated to be around 5% of the male MFs, rounded to the near whole number.

The FF considers the classifier outcomes and the number of features chosen. It reduces the classifier performance and the size of the selected features. Therefore, the succeeding FF is used to assess the individual solution.

In Eq. (11), \(ErrorRate\) denotes the classifier error rate. \(ErrorRate\) is evaluated as the amount of improper classification to the amount of classifier made within [0,1]. \(\#SF\) refers to the number of features chosen, and \(\#All\_F\) denotes the overall number of attributes in the dataset. \(\alpha\) controls the prominence of classifier quality and subset length.

Cyberthreat detection using SDAE

Next, the SDAE technique recognizes and classifies cyber threats³⁶. This model is chosen because it can learn robust feature representations while effectually denoising input data. Unlike conventional models, SDAE can handle noisy and incomplete data, making it ideal for real-world cybersecurity scenarios where data may be corrupted or sparse. Its sparse structure forces the network to concentrate on the most significant features, improving its generalization and ability to detect complex threats. Additionally, SDAE is highly effective in detecting subtle cyberattack patterns, which other models may overlook. The method’s capability to learn hierarchical features from raw data ensures it can detect known and novel threats. Moreover, its unsupervised learning capability reduces the requirement for large labelled datasets, making it more flexible and scalable for various cybersecurity tasks. Figure 4 represents the architecture of SDAE.

An AE contains a decoder and an encoder where the encoder draws higher-dimension input instances to the lower‐dimension abstract representation to attain sample density and decrease dimensionality. At the same time, the decoder transforms the lower‐dimension demonstration into the predictable output for achieving the representation of an input. An AE displays effective non-linear extraction of feature capability that can get feature vectors, signify the structure of input data, and cover non-linear features.

The procedure of encoder and decoder as defined below:

Whereas \(y\) and \(x\) signify the output and input data, respectively; \(h\) signifies the reduction of dimensionality; \({W}_{1}\) and \({W}_{2}\) epitomize the weights of the encoder and decoder networks; \({\lambda}_{1}\) and \({\lambda}_{2}\) signify the unit bias of the output layer and the hidden layer (HL); and \(f\) and \(g\) represent the activation functions.

When equated beside input data, the \(h\) dimension decreases, but it still covers the key data of an input. Analyzing and processing \(h\) decreases the computational cost. AE feature extraction permits dealing with non-linear data constructs like load curves, which are shown in real-world use.

To rebuild an input, the objective of AE is to minimize the error of reconstruction that defines the intimacy between output and input. The error of reconstruction \({L}_{AE}\) is definite as below

The enhancement of AE is achieved by including restraints that are dissimilar to \({L}_{AE}\). This presents noise coding and sparse constraint, which is known as SDAE. The sparse constraint denotes the defeat of a few neurons in HL to recover the computational efficacy and network speed and express higher-dimension data; therefore, the NN can yet remove the feature and form of the instance when there are numerous neurons in HL. The noise coding denotes including noise in an input dataset to improve the sturdiness of AE and allow the absorption of the vital features of input data.

Let’s assume \({a}_{h}^{\left(2\right)}\left({x}^{i}\right)\) signifies the neuron activation degree in \(h\); the \(\wedge\rho\wedge\rho\) of neuron on every training sample have been expressed below:

The divergence of KL is applied to assess the sparsity of neurons. Its formulation is expressed below:

Here, \(\rho\) refers to a parameter of sparsity, which is near to \(0.\)

The noised input \(\wedge x \wedge x\) was produced by inserting noise at random into \(\chi\) initial input, and the equivalent output is \(\wedge\:y\wedge\:y.\) If \(\wedge\:y\wedge\:y\) generates \(x\) to the highest degree, it specifies that AE holds effectual strength. The \({L}_{DAE}\) of denoising AE is expressed below

Here, \(\lambda\) denotes the constraint of noise weight.

Finally, \({L}_{SDAE}\) of SDAE is modified as

Here, \(\beta\) refers to the weight co-efficient of the sparsity penalty.

The SDAE is made by minimalizing the loss function of Eq. (18) over the gradient descent method.

Parameter optimizer

This work employs the HOA method for fine-tuning the hyperparameter included in the SDAE approach³⁷. This methodology is chosen because it can effectively explore and exploit the solution space. HOA replicates the behaviour of hikers seeking the highest peak, effectively fine-tuning hyperparameters to improve the model’s performance. Unlike other optimization techniques, HOA strikes a balance between exploration and exploitation, preventing premature convergence and improving the search for optimal solutions. Its simplicity and adaptability allow it to work well with complex models and massive datasets, making it appropriate for various applications, including cybersecurity. Additionally, HOA is computationally efficient, which assists in real-time optimization tasks, reducing the time required for hyperparameter tuning. This makes it a robust choice for improving the accuracy and robustness of ML models. Figure 5 specifies the architecture of the HOA model.

Workflow of the HOA technique.

This section discusses the mathematical background and inspiration of HOA. In addition, the study defines the HOA technique and its computation difficulty. The HOA is inspired by the hiker’s experience attempting to summit mountain rocks, hills, or peaks.

High, steep trails and terrains decelerate the hikers and eventually increase the hike.

Hikers can estimate or determine the time taken to reach the peak equipped with an awareness of the terrain’s geography. This is similar to the agent searching for the global or local optima of the optimization problems. Furthermore, in the search for global optima, the agent becomes stuck in the search area due to its complication of optimization problems, and this might extend the time it will take to locate the global optima, which is much like how hikers experience during hiking.

The mathematical background of HOA is inspired by Tobler’s Hiking Function (THF), an exponential equation that defines a hiker’s speed, which considers the slope or steepness of the trail or terrain.

The THF is represented as follows:

In Eq. (19), \({\mathcal{W}}_{i,t}\) refers to hiker \(j\) velocity \((\)viz., \(km/h)\) at \({t}^{th}\) time or iteration, and \({S}_{i,t}\) denotes the slope of the trail or terrain.

In Eq. (20), \(dh\) and \(dx\) are the elevation variance and the hiker’s travel distances. \({\theta}_{i,t}\), refers to the inclination angle of the terrain or trail in \(\left[\text{0,5}{0}^{o}\right].\)

HOA exploits the advantages of the hiker’s social thinking and the cognitive capabilities of hiker individuals. The THF, the lead hiker location, and the actual hiker location define the actual or updated hiker’s velocity of initial velocity. Therefore, the present velocity of \(\:{j}^{th}\) hikers is as follows:

In Eq. (21), \(\:{\gamma\:}_{i,t}\) denotes a uniform distribution number in [0,1]; \(\:{\mathcal{W}}_{i,t}\) and \(\:{\mathcal{W}}_{i,t-1}\) are the present and initial velocities of the \(\:{j}^{th}\) hikers. \(\:{\beta\:}_{best}\) indicates the location of the lead hiker and \(\:{\alpha\:}_{i,t}\) shows the sweep factor (SF) of \(\:{j}^{th}\) hikers within [1,3]. The SF confirms that the hiker doesn’t stray far from the leader hikers; hence, they can perceive where the lead hikers are headed and receive signals from them.

The updated position \(\:{\beta\:}_{i,t+1}\) of hiker \(\:j\) is given by considering the hiker velocity in Eq. (19):

In metaheuristic algorithms such as the HOA, the agent’s initial position is an essential factor that considerably affects the possibility of a feasible solution and the speed at which convergence is obtained. The HOA performs the random initialization method to initialize the agent location, although alternate methods, such as problem-specific initialization or heuristic-based approaches, also exist.

The initialization of hiker locations \(\:{\beta\:}_{i,t}\) can be defined by the \(\:{\varphi\:}_{j}^{1}\) and \(\:{\varphi\:}_{j}^{2}\) lower and upper bounds of the solutions as follows:

In Eq. (23), \(\:{\delta\:}_{j}\) refers to a uniform distribution integer in \(\:\left[\text{0,1}\right].\) \(\:{\varphi\:}_{j}^{1}\) and \(\:{\varphi\:}_{j}^{2}\) are the lower and upper boundaries of the \(\:{j}^{th}\) parameter. This profoundly affects the distance between the lead trails and other hikers. Moreover, the trail’s slope influences hikers’ velocity and the HOA’s exploitative and exploratory behaviours.

Increasing the SF range encourages an exploitation stage within the HOA. On the other hand, once the SF range is decreased, the HOA leans towards an exploratory stage. In addition, reducing the trail’s inclination angle tends to lead to the exploitation stage. This factor collaborates to shape the HOA’s performance and behaviour in resolving optimization problems.

The HOA is used to derive an FF to attain enhanced classifier outcomes. It defines a positive integer to characterize the better outcome of the candidate solution. Now, reducing the classifier error rate is regarded as an FF.

Model explanation of XAI using LIME

Finally, the LXAIDM-CTLSN method incorporates the XAI method LIME for the optimum understanding and explainability of the Blackbox technique for superior classification of cyberattacks. Interpretability is selected in cyber threat detection by combining LIME to improve the model’s accuracy³⁸. LIME delivers clarifications for distinct predictions prepared by the method, presenting insights into the features donating to every identification decision.

LIME aids in understanding the model, delivering insights into the forecasts prepared by an assumed method. By interpreting the model’s reasoning, consumers can get assurance in its predictions. LIME attains this by clarifying distinct instances, which assess the model performance. The LIME formulation is shown in Eq. (25), with goals to minimize the loss function \(\:L\:\)while ensuring that the clarification closely looks like the original behaviour of the model. Where \(\:\varphi\:\left(x\right)\) denotes the clarification, for instance, \(\:x\) produced by the method \(\:\theta\:.\)

Here, \(\:\theta\:\) signifies the interpretable method in the class G. \(\:g\) denotes the family of methods. \(\:\psi\:\left(x\right)\) represents the proximity evaluation of the neighbourhood employed to make the description, for instance. \(\:\varOmega\:\left({\phi\:}_{t}\right)\) denotes the complication of the model, just like the amount of features included. \(\:P\) signifies the possibility of \(\:x\:\)thatbelongs to an exact class.