GOAMLP: Network Intrusion Detection With Multilayer Perceptron and Grasshopper Optimization Algorithm

In this paper, an intrusion detection system is introduced that uses data mining and machine learning concepts to detect network intrusion patterns. In the proposed method, an artificial neural network (ANN) is used as a learning technique in intrusion detection. The metaheuristic algorithm with the swarm-based approach is used to reduce intrusion detection errors. In the proposed method, the Grasshopper Optimization Algorithm (GOA) is used for better and more accurate learning of ANNs to reduce intrusion detection error rate. The role of the GOAMLP algorithm is to minimize the intrusion detection error in the neural network by selecting useful parameters such as weight and bias. Our implementation in MATLAB software and using the KDD and UNSW datasets show that the proposed method detects abnormal, malicious traffic and attacks with high accuracy. The GOAMLP method outperforms and is more accurate than the existing state-of-the-art techniques such as RF, XGBoost, and embedded learning of ANN with BOA, HHO, and BWO algorithms in network intrusion detection.


I. INTRODUCTION
Computer networks have grown significantly in recent years. A variety of them have been introduced and presented for different applications with different benefits. Some good examples include wireless sensor networks (WSNs) [1], vehicular ad hoc networks (VANETs) [2], and the internet of things (IoT) [3]. One of the standard features of these networks is that each device or node can share its information with other nodes over the internet [4].
The main problem with different computer networks is their security issues, which pose a significant challenge. In various computer networks, attackers and hackers have repeatedly sought gaps to infiltrate the network configuration, steal valuable network information, and disrupt normal function of the network. To this end, hackers or organized cyber-attacks are capable of disrupting entire countries' computer networks. Thus, network intrusion has widespread repercussions [5].
The associate editor coordinating the review of this manuscript and approving it for publication was Wai-Keung Fung .
In software-based methods, the hacker executes malicious code on a network server and disrupts its services, sometimes denying service even without running any code on the server. This attack is achieved simply by repeating a massive number of requests seen as a distributed denial of service (DDoS) attack [6].
Hackers try to break into networks by exploiting network tools such as port scanning used by network nodes. In this case, the hacker exploits ports that were dropped due to incorrect configuration or simple access levels. An example of these services is SSH and telnet [7].
Network intrusion can be the result of hackers, (1) guessing weak passwords, (2) using password guessing software, or (3) attacking the network via brute force [8]. By leveraging social engineering techniques, hackers can also communicate with people in social networks, messengers, and e-mails to obtain important information from the system toward network intrusion [9].
Network intrusion entails unusual traffic and thus has a set of features that distinguish it from regular traffic. Existing patterns in unusual traffic can be detected by various data mining and machine learning methods that facilitate an Intrusion Detection System (IDS). Network intrusion has a devastating effect on the network and can even disable the entire network. Therefore, various efforts have been aimed at designing intrusion and firewall systems to surmount this security challenge. Most intrusion detection methods attempt to remove or filter unauthorized network traffic via intrusion pattern recognition [10].
In other words, intrusion detection methods try to discretize normal and unusual traffic. Recent studies have designed network intrusion detection systems (NIDS) [11], in one example introducing a new IDS based on K-means clustering and the Firefly algorithm (FA). In this method, the Firefly Algorithm is used to improve the K-means clustering algorithm to detect the intrusion system. Another relevant study [12] has conducted extensive research on the NIDS of vehicular ad hoc networks (VANETs) and evaluated IDS based on their performance.
The use of fuzzy clustering to design an IDS in the cloud computing space has also been demonstrated [13]. Furthermore, a new method has applied machine learning and concepts of an evolutionary algorithm in intrusion detection [14]. In this proposed approach, the support vector machine (SVM) was chosen as the learning method in intrusion detection, and a Decision Tree (DT) was utilized to pick up features of the attacks. Moreover, Genetic Algorithm (GA) techniques were leveraged to improve feature selection. The findings confirmed that this method outperforms SVM in accurate intrusion identification.
IGA has also been used to discover effective rules for NIDS [15]. In the example cited, each set of rules was considered a variable-length chromosome. The implementation demonstrated that this method offers some quality rules for intrusion detection. Similar approaches using SVM and kernel principal component analysis have been taken with the GA mechanism [16].
IDS is also of paramount relevance to Wireless Sensor Networks (WSNs) [17]. IDS is vulnerable to various types of attacks such as flooding, root attack, port scanning, backdoor, etc. in the cloud computing space [18]. It is shown that ANN can be used as a data mining technique to identify the intrusion of the computer network. The GOA algorithm with a swarm-based approach can be used to further improve ANN accuracy in the IDS.
Some studies in IDS use a blacklist to detect network intrusion; however, these methods are not very useful because blacklists need to be updated continuously. On the other hand, data mining and machine learning methods are subject to significant error. We tried to minimize the error as much as possible. These methods enable considering this challenge as an optimization problem with a minimization approach that aims to reduce the detection error between normal and unusual traffic.
Among the recently proposed metaheuristic algorithms with the swarm-based approach is the Grasshopper Optimization Algorithm (GOA), which has been proven more accurate than the Particle Swarm Optimization Algorithm (PSO), Genetic Algorithm (GA), Bat Algorithm (BA), Firefly Algorithm (FA), Gravitational Search Algorithm (GSA), Flower Pollination Algorithm (FPA) and Differential Evolution (DE) [18].
Studies show that designing a NIDS requires an accurate classification process. There are several methods for classification, like the artificial neural network (ANN) method. ANN has different types; one of the simplest and most practical ones of which is the multilayer perceptron (MLP).
An essential advantage of an MLP compared to other neural networks (such as deep neural networks) is that MLP requires less time to learn. Reducing learning and analysis time is critical in an IDS.
In this section, we have reviewed the NIDS. The remainder of this paper is organized as follows. We introduce the classification of metaheuristic algorithms, GOA algorithm, and multilayer perceptron of ANN in Section II. In Section III, we formulate and present the proposed method. In Section IV, we provide the implementation and analysis of experiments. Finally, we offer conclusions for this paper in Section V.

II. RELATED WORK A. METAHEURISTIC ALGORITHMS
Metaheuristic algorithms are a set of pseudo-random methods based on the organisms' behavior or physical phenomena in nature. These algorithms can be modeled on organisms' behavior or non-living physical or mathematical phenomena.
In metaheuristic algorithms, each solution is coded as a natural element. These solutions (i.e., factors) are sent to the optimal answer via modeling. Several metaheuristic algorithms are divided into different categories based on their respective algorithmic approaches [19]. In this classification, metaheuristic algorithms are divided into six groups (Evolutionary Algorithms, Swarm-based Algorithms, Physical-based Algorithms, Human-based Algorithms, Bio-inspired algorithms, Nature-inspired algorithms), as summarized in Fig.1.
Evolutionary algorithms use the principles of competence and survival. The more appropriate a solution is, the more survival is promoted. These algorithms can produce similar solutions to those of the Genetic Algorithm (GA). Physical-based VOLUME 8, 2020 Algorithms are comprised of a physical element or are based on the laws of physics. Swarm-based Algorithms take the approach of modeling organisms' behaviors as a group. Human-based Algorithms give way to models of human behavior that reflect political, cultural, or social dimensions to solve optimization problems. In Bio-inspired algorithms, the swarm behaviors of cells or microscopic organisms lacking higher intelligence are used. Ultimately, Nature-inspired algorithms are partial to the use of behaviors from organisms for which intelligence is weak or absent [20].  [20].
The GOA is one of the population-based and swarm-based algorithms that has been used to model grasshopper invasion into farms and green plains. Grasshoppers are a group of insects that live together with a prescribed set of interactions. Thus, in this algorithm, each solution is considered as a single grasshopper. In each iteration, there exists a set of solutions in the form of the grasshopper population. The grasshopper swarm-based algorithm is modeled using three factors: tendency toward group, wind, and gravity [21].
In this algorithm, each solution (i.e., grasshopper) is updated according to the above three factors. Equation (1) models how each grasshopper is affected by the three aforementioned laws of tendency toward grasshopper aggregation, wind direction, and gravity [22]: Here, S i , G i and A i are defined as an attractive factor for the grasshopper population, effect of the Earth's gravity on the grasshopper's movement, and the wind factor in locating the grasshopper's activity, respectively. The GOA uses the function s d ij to control the intended steps of each grasshopper to navigate the problem space based on the distance between two grasshoppers, shown in equation (2) [22]: In this equation, f and l are the absorption coefficient of the grasshopper population and the absorption factor in the group, respectively; r is the distance between two grasshoppers in the group or population. In Fig.2, the performance of the function s is shown in the grasshopper's movement toward the center of the group. This illustrates how a grasshopper can modulate its distance from a swarm of grasshoppers based on the output value of the function s d ij .
The grasshoppers' movement toward a swarm of grasshoppers, which is just an effective behavior, changes the problem solutions [22]: The GOA does not directly use the wind, gravity, and movement toward a swarm of grasshoppers to change the grasshoppers' position; rather, the optimal answer is the center of the grasshopper swarm's position. This gives way to the more practical equation (3) [17]: In this equation,T is the most optimal position of a swarm of grasshoppers, ub d and lb d are the upper and lower range d of the objective function, respectively, and c is the convergence coefficient in the GOA -which is a decreasing value in terms of its iteration. The above equation is performed on each population member of the GOA in successive iterations to move the population members toward optimal solutions [23].

B. MULTILAYER PERCEPTRON (MLP) OF AN ANN
A neuron has three main parts: nucleus, dendrites, and axons. Each of these sections is considered in an ANN to solve complex problems. The network comprising the nervous system (i.e. neural network) is a complex problem-solving structure made up of billions of neurons. Algorithms emulating the behavior of this natural system have made it possible to solve challenging and complex problems. A single neuron performs weakly in decision making, but a set of neurons can be used to identify patterns and classifications. Typically, an ANN is comprised of different sections, depicted in Fig.3. In each section, several artificial neurons interact to create the output of an ANN: They present a new MLP prediction model (MLP-PM) to find the base station. E-ANDSF invokes MLP to select a base station and to predict the QoS [25].

C. INTRUSION DETECTION SYSTEM (IDS)
This section covers various studies carried out on the IDS. In Table 1, we compare algorithms, methods, challenges, and advantages.

III. THE PROPOSED METHOD
This section presents the GOAMLP method for reducing the ANN error rate with the GOA algorithm and MLP. We begin by presenting the challenge, following which the framework of the proposed method is described. Also, equations and modeling the GOAMLP algorithm are discussed. Finally, a flowchart illustrating the proposed method for detecting network intrusion is presented.
For NIDS, machine learning methods and data mining like MLP of ANN are essential tools to analyze network traffic.
To diagnose the small error rate of intrusion detection, weight and bias need to be well-evaluated and optimized. There exist several candidate strategies for optimization, including the GOA algorithm. GOA is an intelligent algorithm to solve np-hard problems. It gradually changes the nature of the search from global to local. On the other hand, there is no high complexity for this intelligence swarm algorithm. It is more accurate than conventional metaheuristic algorithms like genetic (GA) and particle swarm optimization (PSO) algorithms, thereby motivating the development of the proposed method.
ANN is an efficient method for classification in various areas. One of the essential applications of ANN is detecting network intrusion. In recent studies, metaheuristic algorithms have been used to improve and reduce classification errors in the multilayer perceptron of ANNs. In most of these studies, reducing the ANN's output error has been considered the main challenge. For example, the GOA algorithm has been used to minimize ANN error in breast cancer diagnosis [46]. Relative to this approach, we believe our proposed method to be superlative for multiple reasons outlined below: • The formulation of the method is limited to a two-layer perceptron of the ANN. In contrast, the method proposed herein assumes that each grasshopper has several sections for the hidden weight layers.
• The article's authors have relied exclusively on a medical dataset with a limited number of samples and features. Our method is based on the KDD dataset with 42 features and many records for detecting network attacks.
• An extraordinary advantage of our method is the use of feature selection in the preprocessing phase. The GOA algorithm is leveraged to reduce the dimensionality of big data through feature selection. Thus, the dimension of the network traffic is reduced and considered as the input of an ANN. This dimensionality reduction in network traffic means that ANN ''learning'' is performed only on essential features. Then, the GOA algorithm is responsible for assigning the network weight and bias.
• Additionally, the aforementioned article is a case study of a disease; whereas, our case study offers the terrific advantage of being the network. Moreover, our method offers feature selection and dimensionality reduction to facilitate learning that runs on substantial features. In our method, the blacklist concept is used in the ANN to interrogate the source traffic addresses in the list first. If the attack pattern is not found in the list, then a learning mechanism is carried out by the ANN to reduce detection time.

A. PROPOSED METHOD PHASES
To reduce NID error rate by ANN, weight and bias parameter selections are performed with comprehensive precision. NIDS neural network output error is associated with optimum weight and bias. To decrease the MLP of ANN output error in NIDS, the introduced method will utilize the following process: • Weight and bias of artificial neural networks are coded in the form of a vector. This vector is a grasshopper (i.e. a member of the GOA population).
• Each grasshopper (i.e. weight and bias vector) is analyzed with a cost function or average error rate of the NIDS in each iteration. GOA updates these vectors in each itearation.
• In the last iteration, the most optimum weight and bias vector are used for learning in the context of using ANN toward optimizing the output rate of the model.
• ANN is coded in the form of a member of the grasshopper optimization population.
• The primary population is initiated from random solutions in a grasshopper population that an ANN considers as a grasshopper.
• The population is analyzed with average NID error. • Grasshopper algorithm model is applied in neural networks, and weights and biases are updated.
• Most optimum ANN is selected in each iteration.
• The best ANN with optimal weights and biases is extracted. We will next discuss choosing the amount of weight and bias of ANN for decreasing the NID error. In Fig.4 are proposed steps for the NIDS with selection of optimum ANN weight and bias explained. It can be inferred that its mechanisms are akin to the following: Fig.5, the decreasing mechanism of multilayer ANN error with GOA is shown. This approach contrasts with standard framework by reducing ANN error in last phase learning by using GOA to determine optimum weight and bias in a neural network. The below schematic summarizes how we first utilize dimension reduction by feature selection on input traffic, following which ANN weight and bias are updated for error reduction by GOA in both normal and abnormal detection contexts.
According to the above diagram, the following steps can be taken toward NIDS using MLP of ANN and GOA: The preprocessing phase of the method in this paper contains two sections. First, the data is normalized and reduced  in dimensionality by feature selection. In the learning phase, the network traffic must be preprocessed and normalized.
Normalization is a process in which each traffic attribute's value is placed in a specific interval, such as [a, b]. The amplitude changes of all qualities and characteristics are in this interval. Equation (4) is used for the preprocessing of the normalization type: In this equation, f , f , min, max, a, and b are the normalized value, the abnormalized value of a feature in traffic, the lower and upper normal range for traffic, and its features. In the proposed method where the range is considered in the interval [0,1], normalization is shown in equation (5): Traffic normalization and its features increase ML, data, and traffic accuracy into normal and abnormal classifications. After normalizing the network traffic, dimension reduction and feature selection can be applied. In the proposed method, GOA is used for feature selection. A feature vector of network traffic is considered a grasshopper. Each feature vector has a zero, and one component shows no feature selection and feature selection, respectively. In the present method, a feature vector of network traffic for intrusion detection is defined by equation (6), which is considered a grasshopper, i.e. a member of the GOA: G i is a grasshopper or a feature vector, F j i is the j − th component of the feature vector, and D is the number of potential properties in a feature vector. In this equation, each component is equal to 0 or 1, indicating lack or existence of feature selection, respectively. In this equation, GOA i is a feature vector in network traffic analysis. Several feature vectors are created randomly as several grasshoppers. The feature vector is used to map network traffic to reduce the input of the classification technique in repetition. This technique has a definite error that can be used to scale up the feature vector. A feature vector is appraised based on the number of selected attributes and the average error of detecting normal from abnormal traffic. For this case, the objective function in equation (7) is suggested [47]: In this equation, each feature vector has a lower value for Cost, which is picked out as the optimal feature vector. E is the error of detection between normal and abnormal traffic, f is the number of selected features, and F is all selected features. Meanwhile, α is a random number between 0 and 1, and β is equal to 1 − α. Minimizing this objective function makes the selected feature vector optimal. It reduces the minimum error and number of features to minimize the firewall warning's dimensions and error.
By implementing the GOAMLP algorithm on feature vectors, the optimal feature vector can be calculated to reduce dimensions. It also reduced the feature space and trained the neural network inputs to reduce properties. The GOAMLP algorithm can improve the weight and bias to minimize the intrusion detection error.

C. SEVERAL STEPS OF THE PROPOSED METHOD
The flowchart in Fig.6 depicts the steps of the proposed method for the NIDS.
According to the proposed flowchart, it is first necessary to encode a multilayer ANN into a grasshopper. Equation (8) is a set of weights and biases considered as an array: {w 1 , w 2 , . . . , w m , b 1 , b 2 In this equation, w 1 , w 2 , . . . , w m and b 1 , b 2 , . . . , b k represent the weights and biases, respectively, of a multilayer ANN coded as a grasshopper herein. In the proposed method, several solutions -or grasshoppers -that are weight and bias vectors, are created randomly as the initial population based on equation (9): Here, Pop is the population of the GOA or an equivalent set of ANNs, and n is considered as the population number or initial population of the GOA. Each population member of the GOA (or equivalent of each ANN) needs to be estimated to define its appropriateness. It uses the average classification error in detecting intrusions for n data, according to equation (10): Here, o i andõ i are considered the primary and predicted class of i-th network traffic, respectively. In each iteration, according to equation (11) of the GOA algorithm, it performs on weight and bias vectors or grasshoppers' population. By using this equation, weights and biases update in each iteration: In this equation, Pop * is the weight and bias vector, and Pop(i) and Pop(j) are two weight and bias vectors wherein i and j represent the grasshopper population.
Meanwhile, s considers the flight step of the grasshopper. The above equation ensures that every weight and bias applied to the network is updated. By repetition of the algorithm, weight and bias are repeatedly modified to reduce intrusion detection error rate by ANNs.
By selecting the optimal ANN (i.e. fit grasshopper population), one can obtain a multilayer ANN optimized by its weights and bias; thus, reduced error rate among the optimum generated neural networks may be possible toward network intrusion detection. In algorithm 1, the pseudo-code of the GOAMLP algorithm is shown.

A. DATASET
By modeling the proposed method in the NIDS at this level, we implement and evaluate the algorithm with relevant datasets such as KDD in the MATLAB programming environment. In this research, the KDD dataset is used to assess and analyze the proposed method in the NIDS.
The KDD dataset [48] comprises of data transmitted to the US Air Force network. It can be used to evaluate the accuracy and efficiency of NIDS algorithms. This dataset has three essential features: • It is a compilation of normal and suspicious traffic, thus serving as an appropriate dataset for intrusion detection. Neural network training with any weight and bias of Grasshopper 26 Calculate the fitness of each weight and bias vector by cost Function and setpop(i). Cost 27 Update Best Weight and Bias Vector or Pop * 28 If End 31 End 32 End while 33 Return best weight and bias vector 34 Neural network training using the optimal weight and bias vector • This dataset is longitudinal and thus is not limited to instantaneous network traffic.
• The network traffic in this dataset is collected from a single host and entire network nodes.
The KDD dataset has 41 features, of which 34 are considered numerical, and the rest are non-numerical. There are four kinds of attacks used for classification in this dataset: U2R, R2L, DOS, and Prob. The dataset contains 42 different attributes each of which describes a traffic attribute such as the type of protocol used for traffic, the type of service requested by users, status of the flag, the number of sent or received bytes, segmentation errors, etc. [49].
Implementation of the algorithm for our proposed NIDS method is benefitted by the availability of an appropriate dataset (i.e. KDD) [48] and programming environment (i.e. MATLAB). In this implementation, average intrusion detection error based on GOA repetition is an imperative index and criterion for evaluating the optimum neural network weight and bias.

B. DATASET CHARACTERISTICS
As mentioned before, the KDD dataset has many records. Only a percentage of them are used to measure the efficiency of the NIDS algorithms [50]. This dataset has 42 different properties, each of which describes a traffic feature. These features are summarized in Table 2.

C. EVALUATION MEASURES
In the proposed method, we use accuracy, sensitivity, and specificity rate for intrusion detection. True positive (TP), False positive (FP), True negative (TN), and False negative (FN) are needed for these calculations. To this end, equations (12)(13)(14) are used to determine classification error and intrusion detection [51]: In addition to these measures, average error-index, and squared error of the normal to abnormal traffic detection error can be applied, as shown in equation (15) and (16), respectively:

D. IMPLEMENTATION PARAMETERS
In Table 3, we highlight several parameters that are critical to the simulation of the proposed method. According to GOA, each of these parameters are initially assigned a value. The implementations are presented according to these values:

E. ANALYSIS
In Fig.7, an example of the output of our method for the NIDS in MATLAB is shown. In this example, the output has a replication size of 20, and the initial population is considered with sizes of 5, 10, 15, and 20. NIDS error rate is shown in this context. According to the output, it is evident that the error reduction process is descending, which elucidates a reason for selecting weights and biases by way of algorithm iteration. The examination based on the mean error-index displays that this process varies from one experiment to another due to the pseudo-random behavior of GOA and metaheuristic algorithms. This approach seeks to make an ANN more efficient and intelligent for detecting intrusion. For this purpose, the proficiency of swarm-based grasshoppers is combined with the facility of ANN-based learning to cut down intrusion detection error in the network.
GOA reduces spam detection error by repetition rendering optimal choice of weight and bias for ANN. Output analysis of the proposed method shows that despite the initial population size, error reduction of the NIDS through algorithm repetition is a meaningful reduction process. Thus, we can conclude the following: • Increasing grasshopper population size will decrease the NIDS.
• Error reduction in the form of repetition facilitates timely convergence of weights and biases to an optimum amount. Figure 7 shows the intrusion detection error rate in terms of the algorithm iteration in different populations. The analysis shows that by increasing the weight and bias vectors' population size, the chances of finding the optimal weight and bias vector increases in ANN. Moreover, increasing the population reduces the intrusion detection error in the proposed method.
The results of 30 different experiments with initial population variables of 5, 10, 15, 20, and 30 iterations are illustrated in Fig.8; this demonstrates that population size in reducing the NIDS is excellent.
The experiments and subsequent analysis exhibit that with an increase in population size from 5 to 20. The MSE error of ID reduces from 0.217 to 0.094 -an error reduction of about 2.31 fold. This reduction in error is underscored by the heightened probability of identifying optimal weight and bias as population size increases. When the proposed method is implemented for 30 different experiments with a population size of 15 and 20 iterations, mean sensitivity, specificity, and accuracy index for detecting network intrusion are 93.17%, 89.25%, and 95.41%, respectively [52]. According to the diagram in Fig.9, the three indices mentioned earlier are consistent with better performance relative to SVM techniques, decision tree (DT) combined with PSO algorithm, and SVM in conjunction with particle algorithm [53].
A simple way (approach 1) to compute accuracy and other ANN parameters is to consider the GOA's population equal to 1 and the number of iterations equal to 0. This status is performed only in the ANN. An alternative method is to implement the ANN only in the MATLAB environment (approach 2). We have chosen the second approach to calculate accuracy, specificity, and sensitivity indexes associated with the ANN. Evaluations show that our method (GOAMLP) outper-  forms the basic method (MLP in ANN) in accuracy, specificity, and sensitivity of intrusion detection by 4.77%, 6.89%, 7.49%, respectively.
In Fig.10, we compare the accuracy of our method with Binary Particle Swarm Optimization (BPSO), Binary Bat Algorithm with Lévy Flights (BBAL), Binary Firefly Algorithm (BFA) and Naïve Bayesian Classifier (NBC) [53], [54]: This evaluation shows that the accuracy, sensitivity, and specificity index of our method surpasses SVM and DT techniques in combination with PSO for accurate detection of intrusion. Moreover, it is more accurate in detecting network intrusion than BPSO, BBAL, BFA, and NBC.
Tables 4 and 5, show a comparison between embedded learning methods of ANN and metaheuristic algorithms such as Butterfly optimization (BOA) (2019), Harris hawks optimization (HHO) (2019), and Black widow optimization (BOW) (2020) algorithms based on KDD and UNSW-NB15 datasets in IDS. In this comparison, two embedded learning methods such as random forest (RF) and XGBoost are also utilized: Experimental analysis shows that the proposed method has more accuracy, sensitivity, and specificity than embedded learning methods based on KDD and UNSW datasets. Among the embedded methods, after the proposed method, XGBoost is in second place in terms of accuracy in detecting network intrusion. The proposed method also has the highest specificity, while BWO is in the second place among metaheuristic methods.  A significant criterion in IDS is that the method has appropriate operating speed for analyzing network traffic. A noteworthy advantage of our proposed method is that the IDS was initially trained using small network traffic. We brought forth feature selection using the GOAMLP algorithm and ANN. The substantial features were then extracted and placed as a filter on the network traffic to reduce traffic volume. In our implementations, the number of features was reduced from 41 input features to 17 features. The traffic volume was thus reduced by a factor of ∼2.41. Therefore, the proposed method ultimately requires less time than ANN because it trains fewer features. Due to our use of GOA for optimal selection of weights and biases, some computational load is created. Still, in turn, this makes the proposed method nearly 2.41 times faster than the ANN.

V. CONCLUSION AND FUTURE WORKS
In this paper, a multilayer ANN and the GOA algorithm are proposed to design an IDS algorithm that reduces the amount of ANN output error in intrusion detection. Our implementation results show that three indicators of the proposed method are more accurate than state-of-the-art, such as RF, XGBoost, and embedded learning of ANN with BOA, HHO, and BWO algorithms in the KDD and UNSW databases. GOAMLP also outperforms the MLP and other IDS methods. In future research, due to the progressively growing IoT and increasing security challenges, we intend to provide a new IDS for the IoT infrastructure. One of our future works provides an improved and binary version of metaheuristic algorithms, such as the GOA algorithm, to reduce traffic mass using feature selection (FS). Besides, in future research, deep learning neural networks will be used along with FS to detect intrusion.