Adversarially Robust Hierarchical Intrusion Detection Using Hybrid Deep Learning and Metaheuristic Optimization

Adversarially Robust Hierarchical Intrusion Detection Using Hybrid Deep Learning and Metaheuristic Optimization | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article Adversarially Robust Hierarchical Intrusion Detection Using Hybrid Deep Learning and Metaheuristic Optimization Motab F. Alenezi, Fahad M. Alotaibi This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-9314868/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted 8 You are reading this latest preprint version Abstract Background The security of modern networked systems has been increasingly challenged by sophisticated cyber-attacks, particularly due to severe class imbalance in intrusion detection datasets and vulnerability to adversarial manipulation. Conventional intrusion detection systems (IDS) often fail to accurately detect minority attacks and lack robustness against adversarial examples, leading to significant degradation in detection performance. Objective This study proposes a comprehensive hierarchical adversarial-resilient framework designed to enhance the accuracy, robustness, and minority attack detection capability of IDS in complex network environments. Methods The proposed framework integrates multiple advanced techniques, including Harris Hawks Optimization (HHO) for feature selection and dimensionality reduction, a hybrid CNN–Transformer–BiLSTM architecture for multi-level feature learning, and Focal Loss (γ = 3.0) to address class imbalance. Adversarial robustness is achieved using Fast Gradient Sign Method (FGSM)-based training to strengthen model decision boundaries. Furthermore, a two-stage hierarchical classification strategy incorporating ensemble learning is employed to improve discrimination of minority attack classes. Results The framework demonstrates superior performance across benchmark datasets. On NSL-KDD, an accuracy of 99.45% is achieved. For CICIDS2017, the model attains 99.23% accuracy with a minority recall of 94.17%, while on KDD Cup 1999, it achieves 99.78% accuracy and 95.28% minority recall. The proposed approach significantly improves minority class detection by up to 66 percentage points through Focal Loss optimization. Adversarial robustness evaluation using PGD attacks (ε = 0.1) shows a substantial improvement, achieving 92.14% accuracy compared to 55.28% for non-hardened models. Comparative analysis against 15 state-of-the-art methods confirms consistent performance gains of 5–12% in minority recall. Conclusion The proposed hierarchical framework effectively addresses key challenges in intrusion detection by combining advanced feature selection, hybrid deep learning, class imbalance handling, and adversarial defense mechanisms. Its strong performance, robustness, and generalization across multiple datasets highlight its potential for deployment in real-world cybersecurity applications. Physical sciences/Engineering Physical sciences/Mathematics and computing Network Intrusion Detection Cybersecurity Harris Hawks Optimization Transformer Neural Networks Focal Loss Adversarial Machine Learning Class Imbalance Ensemble Learning Deep Learning Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Review Version 1 posted Reviewers agreed at journal 03 May, 2026 Reviews received at journal 28 Apr, 2026 Reviewers agreed at journal 28 Apr, 2026 Reviewers invited by journal 28 Apr, 2026 Editor assigned by journal 20 Apr, 2026 Editor invited by journal 14 Apr, 2026 Submission checks completed at journal 10 Apr, 2026 First submitted to journal 10 Apr, 2026 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-9314868","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":633578910,"identity":"d4b7d41e-c85e-4b44-9eba-d6ed48389be9","order_by":0,"name":"Motab F. Alenezi","email":"","orcid":"","institution":"King Abdulaziz University","correspondingAuthor":false,"prefix":"","firstName":"Motab","middleName":"F.","lastName":"Alenezi","suffix":""},{"id":633578911,"identity":"bdbacff7-2819-4df1-80bb-2e9169ded22b","order_by":1,"name":"Fahad M. Alotaibi","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA7UlEQVRIiWNgGAWjYBAC9gYg8QCI2SQYGx82gMUS8GvhOQBWYwDS0mxImhYGCQY2SeK0iJ1O/JBQ8UeeT7q5rXJGzWEGfvYcA8YfNXi0SOdulkg4Y2DYJnOw7eaGY4cZJHveGDDzHMOtxV46d4NEYpsBYxuQvPmA7TCDwY0cA2YGNvy2/ABqsQdpKXzw7zCD/Q2Qw/7h1bINZEsiSAvjxjagLRI5Bgy8bfi1WCScMU4G+qVZcmZfOo/EmWcFh3n78DvsxocKOdv5s9sffuz5Zi3H35688eGPb7i1YJoBIg6QoGEUjIJRMApGARYAAM7EUq7jrQ9HAAAAAElFTkSuQmCC","orcid":"","institution":"King Abdulaziz University","correspondingAuthor":true,"prefix":"","firstName":"Fahad","middleName":"M.","lastName":"Alotaibi","suffix":""}],"badges":[],"createdAt":"2026-04-03 16:25:13","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-9314868/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-9314868/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":108805335,"identity":"8cb10671-b711-4584-b2e7-89fc1584ae27","added_by":"auto","created_at":"2026-05-08 15:25:37","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":835301,"visible":true,"origin":"","legend":"","description":"","filename":"ScientificreportMotabrevSR.pdf","url":"https://assets-eu.researchsquare.com/files/rs-9314868/v1_covered_d68a37d8-c0e1-4d81-ba5c-9473a24bf3be.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Adversarially Robust Hierarchical Intrusion Detection Using Hybrid Deep Learning and Metaheuristic Optimization","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true},"keywords":"Network Intrusion Detection, Cybersecurity, Harris Hawks Optimization, Transformer Neural Networks, Focal Loss, Adversarial Machine Learning, Class Imbalance, Ensemble Learning, Deep Learning","lastPublishedDoi":"10.21203/rs.3.rs-9314868/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-9314868/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003ch2\u003eBackground\u003c/h2\u003e \u003cp\u003eThe security of modern networked systems has been increasingly challenged by sophisticated cyber-attacks, particularly due to severe class imbalance in intrusion detection datasets and vulnerability to adversarial manipulation. Conventional intrusion detection systems (IDS) often fail to accurately detect minority attacks and lack robustness against adversarial examples, leading to significant degradation in detection performance.\u003c/p\u003e\u003ch2\u003eObjective\u003c/h2\u003e \u003cp\u003eThis study proposes a comprehensive hierarchical adversarial-resilient framework designed to enhance the accuracy, robustness, and minority attack detection capability of IDS in complex network environments.\u003c/p\u003e\u003ch2\u003eMethods\u003c/h2\u003e \u003cp\u003eThe proposed framework integrates multiple advanced techniques, including Harris Hawks Optimization (HHO) for feature selection and dimensionality reduction, a hybrid CNN\u0026ndash;Transformer\u0026ndash;BiLSTM architecture for multi-level feature learning, and Focal Loss (γ\u0026thinsp;=\u0026thinsp;3.0) to address class imbalance. Adversarial robustness is achieved using Fast Gradient Sign Method (FGSM)-based training to strengthen model decision boundaries. Furthermore, a two-stage hierarchical classification strategy incorporating ensemble learning is employed to improve discrimination of minority attack classes.\u003c/p\u003e\u003ch2\u003eResults\u003c/h2\u003e \u003cp\u003eThe framework demonstrates superior performance across benchmark datasets. On NSL-KDD, an accuracy of 99.45% is achieved. For CICIDS2017, the model attains 99.23% accuracy with a minority recall of 94.17%, while on KDD Cup 1999, it achieves 99.78% accuracy and 95.28% minority recall. The proposed approach significantly improves minority class detection by up to 66 percentage points through Focal Loss optimization. Adversarial robustness evaluation using PGD attacks (ε\u0026thinsp;=\u0026thinsp;0.1) shows a substantial improvement, achieving 92.14% accuracy compared to 55.28% for non-hardened models. Comparative analysis against 15 state-of-the-art methods confirms consistent performance gains of 5\u0026ndash;12% in minority recall.\u003c/p\u003e\u003ch2\u003eConclusion\u003c/h2\u003e \u003cp\u003eThe proposed hierarchical framework effectively addresses key challenges in intrusion detection by combining advanced feature selection, hybrid deep learning, class imbalance handling, and adversarial defense mechanisms. Its strong performance, robustness, and generalization across multiple datasets highlight its potential for deployment in real-world cybersecurity applications.\u003c/p\u003e","manuscriptTitle":"Adversarially Robust Hierarchical Intrusion Detection Using Hybrid Deep Learning and Metaheuristic Optimization","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-05-06 09:17:16","doi":"10.21203/rs.3.rs-9314868/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"reviewerAgreed","content":"20061329514291953463372419580191913000","date":"2026-05-03T09:58:17+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-04-29T03:07:31+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"118242689726222718082150880983832309894","date":"2026-04-28T05:22:56+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2026-04-28T04:40:01+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2026-04-20T09:31:14+00:00","index":"","fulltext":""},{"type":"editorInvited","content":"","date":"2026-04-14T05:56:45+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2026-04-10T13:37:10+00:00","index":"","fulltext":""},{"type":"submitted","content":"Scientific Reports","date":"2026-04-10T12:08:55+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"f6d1ed1a-7fec-49e3-8f55-e55905607495","owner":[],"postedDate":"May 6th, 2026","published":true,"recentEditorialEvents":[{"type":"reviewerAgreed","content":"20061329514291953463372419580191913000","date":"2026-05-03T09:58:17+00:00","index":59,"fulltext":""}],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[{"id":67434154,"name":"Physical sciences/Engineering"},{"id":67434155,"name":"Physical sciences/Mathematics and computing"}],"tags":[],"updatedAt":"2026-05-06T09:17:16+00:00","versionOfRecord":[],"versionCreatedAt":"2026-05-06 09:17:16","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-9314868","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-9314868","identity":"rs-9314868","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}