This paper proposes a novel SADDBN-AMOA technique for smart city-based IoHT networks. The main aim of the SADDBN-AMOA technique is to provide a resilient attack detection method in the IoHT environment of smart cities to mitigate security threats. It contains data pre-processing, feature optimizer, DL with attack detection, and model tuning with IHHO. Figure 2 depicts the entire process of the SADDBN-AMOA model.

Data Pre-processing through normalization

The data pre-processing step initially applies the Z-score normalization method for transforming input data into a structured pattern³¹. This method is chosen for its efficiency in standardizing data by converting features to have a mean of zero and a standard deviation of one, which assists in stabilizing the training process and speeds up convergence. Unlike min-max scaling, which can be sensitive to outliers, Z-score normalization is more robust as it accounts for data distribution, mitigating the impact of extreme values. This method ensures that features with diverse units or scales contribute equally to the model, averting bias towards variables with larger ranges. Additionally, it enhances the performance of models such as DBN, which usually assume distributed input data. Hence, this improves the model’s stability, accuracy, and generalization compared to other scaling techniques.

Z-score normalization, or standard score normalization, is a data pre-processing model that converts feature values by centring them near the mean with a standard deviation of 1. Concerning attack detection in IoHT atmospheres, this model assistances guarantees that each feature corresponds to the detection method, particularly after they have dissimilar units or scales. This is important for ML methods aware of feature sizes, like neural networks, SVM, or k-NN. This model improves model accuracy, performance, and convergence speed by decreasing bias from leading features. In IoHT methods, while sensor data might differ extensively, this standardization enhances the dependability of intrusion detection or anomaly. It also facilitates more efficient classification and feature selection in resource-restricted IoHT devices.

Feature optimization with SMO model

For selecting the feature process, the proposed SADDBN-AMOA model utilizes the SMO method to choose the most related features from the data³². This model was selected for its robust global search capability and efficient exploration-exploitation balance, which assists in avoiding premature convergence, which is common in other algorithms. Unlike conventional methods like genetic algorithms (GA) or particle swarm optimization (PSO), SMO illustrates faster convergence and improved adaptability to intrinsic, high-dimensional data. Its bio-inspired mechanisms effectively detect the most relevant features, mitigating dimensionality without losing critical data. This results in an enhanced accuracy of the model and reduced computational cost. Moreover, the simplicity and fewer parameters of the model make it easier to implement and tune, presenting a robust and reliable approach for optimizing feature subsets in IoHT security applications. SMO is chosen due to its latest success as a meta-heuristic model stimulated by foraging behaviour and slime mould dispersion. The SMO has three stages: wrap, approach, and search for food. The mathematical representation of all expressions is mentioned below.

Stage 1-Approaching Food: Subject to the smell (scent) that food creates, SM might approach it. Like the technique of using mathematical equations to observe the mode of contraction approaching behaviours, the succeeding equations are presented to mimic it. The equation that inspires the SM to approach food is calculated by Eq. (1)

Here, (:overrightarrow{{v}_{b}}) refers to parameters ranging from (:-1) to (:+1), and (:overrightarrow{{v}_{c}}) linearly reduces from 1 to (:0) for the last specific iteration. (:W) denotes the slime mould’s weight, and (:t) represents the iteration that is now in progress. From the SM, the (:{overrightarrow{X}}_{A}left(tright)) and (:{overrightarrow{X}}_{B}left(tright)) are selected randomly. The (:overrightarrow{X}) characterizes the location of the SM, while (:{overrightarrow{X}}_{b}) specifies the present individual’s location at the odour focus of the meal is greater. Equation (2) is utilized for calculating the (:p)-value.

The fitness of (:overrightarrow{X}) was characterized by (:Sleft(iright)), whereas the maximal fitness gained through each iteration (:S(iin:text{1,2},3dots:dots:dots:n)) is signified by DF. The (:overrightarrow{{v}_{b}}) value varies from − a to (:a), and the (:a) value is calculated using Eqs. (3) and (4).

The weight ((:W)) value is measured by Eq. (5) as shown,

The above equation has the following elements: (:r) embodies randomly generated values within the range (:left[text{0,1}right]), which specifies that (:Sleft(iright)) is acknowledged for ranking in the higher portion. The (:{b}_{f:})and (:{w}_{f}) characterize the best and worst values of fitness gained within the present iterative method. The (:{text{m}text{a}text{x}}_{iter}) specifies the maximal iteration amount. (:Medleft[Sright])refers to median operator representation. The (:SmellIndexleft(SIright))displays the values of fitness in sequential order.

Stage 2-Food Wrapping: The quality and nature of the SM search model are impacted. A position’s weight will rise after a considerable focus on food is greater. It is compelled to search another area when the attention is lower as the area’s weight falls. This stage consists of upgrading the position of the SM utilizing Eq. (7):

Whereas (:z) denotes probability applied to attack a balance between exploitation and exploration, and (:UB) and (:LB) represent upper and lower bound limits.

Stage 3-Food Grabbling: SM moves to places with high food attention. (:W,) (:overrightarrow{{v}_{b}},) and (:overrightarrow{{v}_{c}}) characterize changing venous widths. (:overrightarrow{{v}_{b}}) and (:overrightarrow{{v}_{b}}) swing correspondingly between ([-a, a]) and [-1, 1]. For example, (:overrightarrow{{v}_{b}}) and (:overrightarrow{{v}_{b}}) become nearer to 0 when iteration improves.

The fitness function (FF) deliberates the classification accuracy and the preferred features. It maximizes the classification accuracy and reduces the set size of the selected attributes. Then, the succeeding FF is deployed to approximate unique results, as presented in Eq. (8).

Now, (:ErrorRate) symbolizes the classification (:ErrorRate) utilizing the chosen features. (:ErrorRate) is calculated as the incorrect percentage categorized to the sum of classifications produced, identified as the value among (0,1), (:#SF) denotes preferred feature counts, and (:#All_F) stands for the complete quantity of features in the novel data set. (:alpha:) is used for controlling the prominence.

DL for attack detection

The DBN method is followed for the attack classification process³³. This method is chosen for its effectual capability in learning hierarchical feature representations from complex and high-dimensional data, which is common in IoHT environments. Unlike conventional classifiers, DBN efficiently extracts deep features without extensive manual pre-processing, thus enhancing detection accuracy. The model also integrates unsupervised pretraining with fine-tuning, improving generalization and mitigating overfitting. Compared to models such as standard neural networks or SVMs, DBNs are more efficient in capturing complex patterns and dependencies in security breach data. This results in robust and reliable classification performance, making DBNs appropriate for the dynamic and diverse nature of IoHT security threats. Figure 3 demonstrates the structure of DBN.

DBNs are a DL method designed to capture composite hierarchic data representation. They include numerous stochastic, latent variables layers and can learn complex designs from higher-dimensional data. DBNs are valuable in settings, whereas feature learning and reducing the dimensions are essential, like network intrusion detection. This part examines the numerical basics, architecture, and DBNs application, highlighting their part in recognizing networking assaults. A DBN comprises numerous Restricted Boltzmann Machine (RBMs) layers and the supervised method’s last layer, often softmax classifiers. The DBN structure consists of the following elements:

RBMs: All RBMs in the DBN are two-layered, stochastic NN comprising a visible layer (VL) and a hidden layer (HL). The VL characterizes the input data, whereas the HL takes high-level characteristics. The network is trained to maximize the data probability, and the links among the layers are aimless. The main modules are:

• VL: Characterizes the detected information and has real-valued or binary elements.

• HL: Signifies the feature learning from the input information and takes concealed designs.

• Weights: The relations between the HL and VL are characterized by weighting that is learned in training.

The RBM’s energy function is provided by:

Whereas (:nu:) and (:h) represent hidden and visible elements, (:{w}_{ij}) are weighted, and(::{b}_{i}) and (:{c}_{j}) are biased.

Stacking RBMs: They are produced by stacking numerous RBMs in the deeper structure. All RBMs are trained layer-by-layer, whereas the output only RBM acts as the input to the following.

Last Layer of Classification: Afterward, RBM’s pretraining, the last supervised layer, is added to carry out regression or classification assignments. The learning procedure in DBNs consists of dual primary stages: fine-tuning and pretraining.

Pretraining: This stage consists of training all RBMs autonomously utilizing unsupervised learning. The aim is to learn the weights, which maximizes the data probability. The model of contrastive divergence is usually applied to train RBMs:

Here, (leftlangle {nu _{i} h_{j} } rightrangle _{{data}}) refers to the predictable value of the output from the information’s hidden and visible components, and (leftlangle {nu _{i} h_{j} } rightrangle _{{model}}) denotes the predicted value from the model distribution.

Finetuning: Afterward, the complete DBN is finetuned. This includes upgrading the weighting of the last layer of classification and, possibly, the weighting of the RBMs. This stage utilizes gradient descent to reduce the function of loss:

Meanwhile, (:{y}_{i}) denotes true labels, and (:{widehat{y}}_{i}) represents forecast likelihoods.

DBNs may be used for learning the hierarchic representation of networking traffic data, allowing the recognition of composite attacking designs. The capability to remove and learn from higher-level attributes makes DBNs suitable for identifying unknown or known intrusions. By using DBNs, networking intrusion detection methods can take advantage of enhanced dimensionality reduction and feature extraction, improving their capability to recognize subtle patterns and anomalies suggestive of mischievous action. DBNs’ deeper hierarchical architecture permits further complex classification and understanding of networking traffic, possibly resulting in high precision and strength in identifying network attacks. Generally, DBNs provide a robust architecture to learn hierarchic feature representation. Their capability for modelling composite designs and decreasing dimensions makes them a helpful device in the current strength to improve cybersecurity through progressive DL methods.

Model tuning with IHHO approach

Eventually, the IHHO technique adjusts the DBN model’s hyperparameter values, resulting in greater classification performance³⁴. This model is chosen for its superior exploration and exploitation balance, which effectively avoids local optima and ensures global search efficiency. This model enables dynamic adaptation and faster convergence compared to conventional optimization methods, namely GA or PSO, replicating the cooperative hunting strategy of Harris hawks. Its improved ability to fine-tune hyperparameters results in enhanced detection accuracy and mitigated false positives in complex IoHT environments. Moreover, the flexibility and robustness of the model make it appropriate for optimizing DL models, ensuring reliable performance even with high-dimensional and noisy data.

The HHO model is one of the population-based optimizer models that emulate the cooperative behaviour and hunting approach of the predacious bird HHO in the foraging process. Amongst the running of the model, the HHO has the candidate solution, and the target approach is the optimum solution with iterations. The HHO model might be segmented into 3 phases: local exploitation, conversion among exploitation and exploration, and global exploration.

The intention of the HHO model generates an issue with the following simplicity:

• The tactic of arbitrarily initializing the population is employed. The arbitrary creation of the population results in the arbitrary distribution of created HHO individuals in the searching area, which results in the technique’s uncertainty.

• In the method’s iterative procedure, only the data of the finest location is employed, which affects the complete model, falling into a local optimal when the existing finest location has a local optimal.

• During the search process, the HHO model chooses the optimum acquiring approach completely reliant on the parameters (:lambda:) and (:E.) These dual parameters will instantly impact the HHO’s ending outcome. The decrease approach of escaping energy (:E) should attempt to fit the modification of the target’s energy in the procedure of escaping the actual situation, and the parameter value (:lambda:) additionally guarantees the unpredictability. Otherwise, it will decrease the model’s capability to exploit and search.

Logistic-tent chaotic mapping initializing populations

This model is accepted to resolve the irregular distribution of population initialization. The examination has depicted that integrating several lower-dimension chaotic mapping techniques to establish a complex, chaotic technique might effectively resolve the issues.

Here, (:mu:) represents the control parameter, and (:X) depicts the system variable. Logistic chaotic mapping has similar issues once the system parameters range from zero to one.

Here, X specifies the system variable and (:alpha:in:left(text{0,1}right)). It concerns some controlling parameters and restricted intervals of chaos.

According to the standard of Logistic-tent chaotic maps, the logistic and tent combined chaotic maps method might be formed by taking the outputs of Logistic maps as the input of Tent maps and iteratively analyzing them. This complex chaotic maps method shows the speed of iteration, and auto-correlation effectively resolves the arbitrary initialization of the population.

(:n) represents the location of arbitrarily generated HHO, and (:{X}_{n+1}) indicates the location of (:n)th HHO once chaotic mapping is composited.

Population hierarchies improve search strategy

This approach has a type of population hierarchy, choosing the first five optimum locations in every iteration process rather than the one optimum location accepted initially. This increases the interaction among populations and effectively decreases the risky model falling into the local optimal.

(:a,b,) (:c,d), and (:e) are the top 3 optimum locations regarding fitness value, (:{X}_{rabbit}) specifies the optimum location chosen in every iteration, (:t) represents iteration counts, and (:fleft({X}_{ir}left(tright)right)) indicates the fitness value of the optimum location in the 10-th iteration.

Enhancement of reducing escape energy approach

It is motivated by the fractional order predator-prey dynamical technique with housings; an advanced model is projected for escaping the energy-reducing approach, which presents a contraction function in the energy-reducing equations to prevent the model from getting stuck in local optima by ensuring the escaping energy (:E) remains lower in mid and late iterations.

The IHHO model initiates an FF to obtain heightened classification performance. It summarizes progressive numbers to characterize the enriched outcome of the candidate solutions. In this paper, the minimization of the classification rate of error is imitated as the FF, as provided in Eq. (18).