Fish Optimization Algorithm Boosts Deep Learning Network Attack Detection Accuracy

A computational framework combining an enhanced restricted Boltzmann machine with a nature-inspired bitterling fish optimization algorithm has demonstrated marked improvements in identifying diverse network security attacks across large-scale flow datasets. Developing automated intrusion detection systems has become increasingly imperative for information and communications technology frameworks that handle sensitive user records across corporate, institutional, and industrial networks. Traditional defensive mechanisms such as standalone firewalls, signature-based anti-virus suites, protocol monitoring, and basic encryption-decryption protocols frequently exhibit elevated false positive rates and struggle to recognize intricate, voluminous cyber threats. Although conventional machine learning algorithms have been widely investigated to improve traffic discrimination, classical methods often demonstrate subpar diagnostic reliability when processing high-dimensional flow statistics and noisy traffic environments. To overcome these operational vulnerabilities, researchers have introduced an integrated pipeline that couples linear dimensionality reduction through principal component analysis with a structurally modified neural architecture whose internal hyperparameters are tuned through bitterling fish behavior.

The experimental study focused on multiclass attack classification across two benchmark cybersecurity collections, namely the CICIDS2017 dataset and the consolidated CSE-CICIDS2018 dataset. The CICIDS2017 repository contains 2,830,743 network flow entries representing more than eighty captured features and comprises 2,273,097 normal traffic records, 252,672 denial-of-service samples, 128,027 distributed denial-of-service samples, 13,835 brute force events, 1,966 botnet communications, 2,180 web attack patterns, 36 infiltration records, and 158,930 port scanning instances. The CSE-CICIDS2018 collection comprises 16,232,943 post-consolidation records derived from an infrastructure spanning thirty servers, four hundred client terminals, and fifty attacking hosts. Within this second repository, the traffic distribution encompasses 13,484,708 normal records, 654,300 denial-of-service instances, 1,263,933 distributed denial-of-service instances, 380,949 brute force attempts, 286,191 botnet patterns, 928 web attacks, and 161,934 infiltration records. The investigators consolidated port scanning inside the infiltration category for the 2018 evaluation because port sweeps are embedded within its overarching infiltration attack scenarios.

Data preparation began with systematic data cleaning followed by feature scaling through the Min-Max normalization method. Real-world network traces routinely contain extreme outlier values, unpopulated fields, and duplicate flow records that impede algorithmic convergence and bias downstream parameter estimations. By filtering null entries and standardizing every continuous feature value to the closed numerical range between zero and one, the preprocessing pipeline prevented features with larger numerical magnitudes from disproportionately dominating early computational cycles. Following data normalization, the researchers applied principal component analysis to reduce dimensional overhead without sacrificing essential classification variance. Principal component analysis calculated the empirical covariance matrix from the standardized training instances, computed the corresponding eigenvalues, and established an orthogonal transformation matrix. By evaluating the resulting scree plot and retaining the smallest subset of components capable of explaining at least ninety-five percent of the cumulative training variance, the team extracted exactly twenty principal components from more than eighty original traffic dimensions.

Rather than deploying a standard binary-to-binary restricted Boltzmann machine, the authors formulated an enhanced variant incorporating three structural alterations independent of heuristic hyperparameter search. In conventional restricted Boltzmann machines, both visible and hidden neurons operate as discrete binary units governed by Bernoulli distributions, requiring continuous data to be transformed into binary vectors that often obscure fine-grained numerical gradients. The enhanced model replaces the standard visible layer with continuous Gaussian visible nodes, enabling direct ingestion of Min-Max-normalized network attributes while preserving stochastic Bernoulli activations across the hidden layer. Furthermore, the unsupervised training procedure incorporates explicit sparsity regularization alongside weight decay within the contrastive-divergence learning routine, preventing redundant hidden node co-activation and constraining runaway weight parameters to mitigate overfitting. Finally, the learned latent representations are connected directly to an eight-node supervised SoftMax classification layer, allowing joint discriminative fine-tuning using labelled network records for multiclass traffic categorization across normal traffic and seven distinct threat classes.

To bypass the time-consuming trial-and-error procedures typical of manual neural parameter selection, the team employed the bitterling fish optimization algorithm to establish optimal architectural configurations. This metaheuristic models the reproductive and survival behaviors of bitterling fish, which utilize freshwater mussels and oysters as protective spawning hosts. In the algorithmic formulation, each candidate parameter combination is represented as an individual fish within the search space, while the objective fitness function evaluates the viability of host oysters. Candidate solutions navigate the multidimensional hyperparameter landscape by combining global exploration, governed by oyster-search and escape mechanisms, with local exploitation driven by simulated reproduction around high-performing sites. The movement parameter K progressively contracts from global searching strides toward refined local adjustments using a cosine-based chaotic trajectory, while the threshold parameter Q steadily diminishes via an inverse function resembling arctangent behavior. A decreasing dispersal radius S governs local offspring distribution, allowing candidate solutions to refine parameters surrounding optimal regions.

The metaheuristic optimization procedure was implemented using an objective fitness metric centered entirely on validation classification accuracy, supplemented by an explicit model-complexity penalty to prevent unwarranted architectural expansion. Through this validation-guided search, the bitterling fish algorithm concurrently calibrated five core structural and training variables: the total hidden-unit count, the initial learning rate, the momentum coefficient, the sparsity regularization strength, and the mini-batch size. The population size was configured to ten candidate solutions operating over a maximum threshold of one hundred evolutionary iterations, governed by an early stopping criterion that terminated search routines when fitness improvements remained below one part in one million across ten consecutive cycles. All feature transformations, scaling boundaries, and principal component projections were derived exclusively from stratified training partitions and transferred without alteration to validation and testing sets, thereby eliminating data contamination and preventing predictive leakage across evaluation boundaries.

Comparative performance evaluations against established deep learning architectures demonstrated consistent diagnostic improvements across multiple standardized evaluation metrics. In empirical benchmarking across identical data partitions, the enhanced restricted Boltzmann machine guided by bitterling fish optimization outperformed comparative models in classification accuracy, exceeding a stacked long short-term memory autoencoder by 9.35 percent, a hybrid convolutional and long short-term memory network by 6.85 percent, a standard multilayer perceptron by 4.47 percent, and a conventional restricted Boltzmann machine by 2.19 percent. Parallel improvements were recorded for classification recall, where the proposed framework surpassed the autoencoder baseline by 9.44 percent, the hybrid convolutional model by 6.92 percent, the multilayer perceptron by 4.51 percent, and the unoptimized Boltzmann network by 2.20 percent. Precision measurements revealed corresponding margins of superiority of 9.54 percent, 6.99 percent, 4.55 percent, and 2.22 percent against the respective baselines, confirming that the framework achieves heightened threat sensitivity while suppressing false alarms.

Comprehensive evaluation using harmonic and correlation metrics further confirmed balanced classification capability across asymmetric class distributions. In terms of the Matthews correlation coefficient, which evaluates multiclass confusion matrices under extreme category imbalances, the optimized framework achieved improvements of 8.52 percent over the long short-term memory autoencoder, 5.97 percent over the convolutional long short-term memory baseline, 3.54 percent over the multilayer perceptron, and 1.21 percent over the standard restricted Boltzmann machine. Similarly, the overall F1-score of the optimized system exceeded the four comparison architectures by 8.61 percent, 6.03 percent, 3.57 percent, and 2.31 percent, respectively. Stratified five-fold cross-validation confirmed model stability across variable sample splits, yielding mean accuracies of 98.84 percent on the 2017 benchmark and 98.72 percent on the 2018 dataset, alongside corresponding area under the curve metrics of 0.992 and 0.991, precision averages of 98.79 percent and 98.66 percent, and Matthews correlation coefficient values of 98.57 percent and 98.42 percent.

Statistical validation over ten independent experimental trials confirmed that the observed performance gains were reproducible and statistically meaningful rather than accidental artifacts of stochastic parameter initialization. Across these independent test executions, the proposed architecture maintained an average overall accuracy of 98.84 percent with a tight standard deviation of 0.16 percent. Parametric paired t-tests evaluating accuracy advantages against the baseline deep learning models yielded significance values below 0.001 across all pairings, while non-parametric Wilcoxon signed-rank tests produced probability values of 0.002. Furthermore, ninety-five percent confidence intervals calculated for each comparative margin excluded zero, and large Cohen’s d effect sizes indicated substantial practical advantages. An ablation study isolating structural elements revealed that conventional restricted Boltzmann machines achieved 96.65 percent and 96.51 percent baseline accuracy across the two datasets, with incremental gains generated by principal component reduction, Gaussian visible modifications, and bitterling fish parameter tuning, culminating in an aggregate gain of 2.20 percent.

Detailed inspection of multiclass confusion matrices and receiver operating characteristic profiles demonstrated robust diagnostic capability across individual intrusion behaviors. On the 2017 dataset, class-specific correct prediction rates extended from 97.75 percent for infiltration attacks to 99.20 percent for normal network flows, while port scanning detection reached 99.06 percent. On the 2018 benchmark, class-wise accuracies ranged from 97.91 percent for web attacks to 99.31 percent for legitimate traffic. Area under the curve metrics mirrored this precision, ranging from 0.982 for infiltration to 0.999 for normal traffic in the 2017 evaluations, accompanied by micro-average and macro-average values of 0.997 and 0.992. Minor confusion arose between distributed denial-of-service and standard denial-of-service instances, as well as between brute force, web exploitation, and infiltration activities, driven by overlapping flow characteristics and shared transport-layer signatures inherent to high-volume connection requests.

Computational overhead analysis established that the framework incurs notable upfront training costs to deliver low-latency inference during active deployment. Implementing the architecture in MATLAB required 46.8 minutes of training time for the 2017 benchmark and 132.6 minutes for the larger 2018 collection, exceeding the training requirements of simpler multilayer perceptrons and unoptimized Boltzmann models due to iterative population evaluations across one hundred optimization steps. However, once hyperparameter configurations converged, the trained classifier achieved an operational inference latency of 0.19 milliseconds per traffic record while consuming approximately 3.2 gigabytes of peak system memory. This sub-millisecond per-sample processing rate confirms the operational feasibility of deploying the pre-trained neural network for rapid online traffic filtering following the completion of offline evolutionary tuning.

Despite these favorable classification metrics, several operational boundaries and architectural constraints govern the practical scope of the reported findings. The authors explicitly emphasize that the framework operates purely as a network-flow classifier rather than a specialized insider-threat or data-exfiltration monitoring tool. Because public benchmark repositories record flow summaries rather than user privilege levels, endpoint logs, host audit trails, or behavioral profiles, flow-level detection cannot attribute unauthorized infiltration to specific human operators. Additionally, principal component analysis relies on linear assumptions that may suppress low-variance attributes relevant to subtle zero-day intrusions, while synthetic laboratory datasets lack encrypted traffic payloads, concept drift, and adversarial evasion vectors found in enterprise networks. Future development must explore lightweight model compression, adaptive online learning mechanisms, and integration within distributed security event management architectures operating over live high-speed data streams.

Subject of Research: Deep learning and metaheuristic optimization for network security intrusion detection

Article Title: Classification of network security attacks using novel enhanced restricted Boltzmann machine-based bitterling fish optimization algorithm

Article References: Ranjani, B., Chinnadurai, M., Manivannan, R., & Rajalakshmi, R. (2026). Classification of network security attacks using novel enhanced restricted Boltzmann machine-based bitterling fish optimization algorithm. Discover Computing, 29(1), Article 785. https://doi.org/10.1007/s10791-026-10654-4

Image Credits: AI Generated

DOI: 10.1007/s10791-026-10654-4

Keywords: network security, intrusion detection system, restricted Boltzmann machine, bitterling fish optimization, deep learning, principal component analysis, CICIDS2017, CSE-CICIDS2018, multiclass classification, denial of service, distributed denial of service, botnet detection, brute force attack, hyperparameter tuning, contrastive divergence, Min-Max normalization, traffic flow analysis