Hybrid ABC–HBA feature optimization with self-training using simulated unlabelled data for robust intrusion detection

Abstract

The increasing scale and heterogeneity of network traffic pose significant challenges for intrusion detection systems (IDS), particularly in detecting extremely rare attack classes and generalising to previously unseen threats under severe class imbalance. This study proposes a hybrid intrusion detection framework that integrates swarm intelligence–based feature optimisation with self-training using unlabelled data simulation to address these limitations. A novel ABC–HBA feature selection strategy is introduced, combining the efficient exploration capability of the Artificial Bee Colony (ABC) algorithm with the strong global exploitation and fast convergence of the Honey Badger Algorithm (HBA), resulting in a highly discriminative and compact feature subset. A Random Forest(RF) classifier augmented with a pseudo-labelling mechanism is then employed to enhance learning from unlabelled and unseen attack samples, enabling effective detection of novel attack patterns absent from the training set. To further mitigate extreme class imbalance, a hybrid resampling strategy is applied. Experimental evaluation on the KDD Cup 1999 dataset demonstrates that the proposed framework achieves an overall accuracy of 99.95% and a detection rate of 98.16%, while significantly improving the recognition of extremely rare attack classes, including a 92.86% detection rate for U2R attacks, which constitute less than 0.01% of the dataset. The proposed method consistently outperforms baseline RF, ABC-based, and several other state-of-the-art meta-heuristic and deep learning approaches, confirming its effectiveness in enhancing rare attack detection and generalisation to unseen threats in realistic intrusion detection scenarios.