Optimizing Pigeon-Inspired Algorithm to Enhance Intrusion Detection System Performance Internet of Things Environments

— Intrusion Detection Systems (IDS) are crucial in maintaining network security and safeguarding sensitive information against external and internal threats. This study proposes a novel approach by utilizing a Pigeon-Inspired Algorithm optimized with the Hyperbolic Tangent Function (Tanh) function to enhance the performance of IDS in threat detection specifically tailored for Internet of Things (IoT) environments. We aim to create a more robust solution for optimizing intrusion detection systems by integrating the efficient and effective Tanh function into the Pigeon-Inspired Algorithm. The proposed method is evaluated on three widely-used datasets in the field of IDS: NSL-KDD, CICIDS2017, and CSE-CIC-IDS2018. Experimental results demonstrate that integrating the Tanh function into the Pigeon-Inspired Algorithm significantly improves the performance of the intrusion detection system. Our method achieves higher accuracy, True Positive Rate (TPR), and F1-score while reducing the False Positive Rate (FPR) compared to traditional Pigeon-Inspired Algorithms and several other optimization algorithms. The Pigeon-Inspired Algorithm optimized with the Tanh function offers an efficient and effective solution for enhancing intrusion detection system performance, specifically in Internet of Things environments. This method holds great potential for application in diverse network environments, bolstering information security and safeguarding systems from evolving cybersecurity threats. By extending the applicability and effectiveness of the Pigeon-Inspired Algorithm optimized with the Tanh function, researchers can contribute to developing more comprehensive and robust security solutions, addressing the ever-evolving landscape of IoT-based cybersecurity threats


I. INTRODUCTION
The rapid growth of the Internet of Things (IoT) [1] has brought about a connected world where devices, sensors [2], and systems seamlessly interact and share information.This interconnectedness has revolutionized various industries, including healthcare, transportation, energy, and smart homes.However, along with the benefits of IoT, there are also significant concerns regarding security and the protection of sensitive data [3].As the number of IoT devices increases, so does the potential attack surface for cybercriminals.The interconnected nature of IoT devices poses unique security challenges [4], making intrusion detection systems (IDS) crucial for maintaining the integrity and security of IoT environments [5].IDS are designed to monitor network traffic and system activities[6 to detect and prevent unauthorized access, abnormal behavior, and potential threats.
To enhance the performance of IDS in IoT environments, this study proposes an optimization approach using the Pigeon-Inspired Algorithm with the hyperbolic tangent (tanh) function.The Pigeon-Inspired Algorithm, inspired by the flocking behavior of pigeons, is a metaheuristic optimization algorithm that mimics the collaborative behavior of pigeons to solve complex optimization problems.By incorporating the tanh function into the Pigeon-Inspired Algorithm, we aim to create a more powerful and efficient solution for optimizing intrusion detection systems in IoT environments.The Tanh function is a widely used activation function in artificial neural networks known for its non-linear properties and effective gradient propagation, which can contribute to improved learning and performance.
The proposed method is evaluated using real-world datasets specifically curated for IoT environments.The experimental results demonstrate that integrating the tanh function into the Pigeon-Inspired Algorithm significantly enhances the performance of the intrusion detection system.
It achieves higher accuracy, true positive rate (TPR) [7], and F1-score while simultaneously reducing the false positive rate (FPR) [8] compared to traditional Pigeon-Inspired Algorithms and other optimization algorithms [9].
Thus, optimizing the Pigeon-Inspired Algorithm with the tanh function offers a promising solution to enhance the performance of intrusion detection systems in IoT environments.By leveraging pigeons' collaborative behavior and the tanh function's non-linear properties, this approach can effectively detect and mitigate potential threats in IoT networks.The findings of this study contribute to the development of robust and efficient security solutions for protecting sensitive data and ensuring the integrity of IoT systems.

II. MATERIALS AND METHOD
This research proposes an approach to investigate the effectiveness of the Pigeon-Inspired Algorithm optimized with the Tanh function in improving the performance of intrusion detection systems (IDS).A comprehensive review of existing literature is conducted to understand the latest developments in intrusion detection systems, Pigeon-Inspired Algorithms, Tanh functionality, and their application in cybersecurity.This review helps establish a theoretical foundation for the research and identifies relevant techniques and methodologies.The NSL-KDD [10], [11], CICIDS2017 [12]- [14], and CSE-CIC-IDS2018 datasets [15], widely used in IDS research, are selected for evaluation.The datasets are pre-processed to remove discrepancies, handle missing values, and eliminate irrelevant features.This ensures the dataset's quality and relevance to the research objective.
The Pigeon-Inspired Algorithm is enhanced by incorporating the Tanh function, known for its effectiveness in training artificial neural networks.This optimization aims to improve the algorithm's performance in optimizing intrusion detection systems.The proposed intrusion detection system monitors network traffic and system activity, detecting and preventing unauthorized access, abuse, or abnormal behavior.The system utilizes the optimized Pigeon-Inspired Algorithm with the Tanh function to enhance its detection capabilities.
The performance of the intrusion detection system is evaluated on the NSL-KDD, CICIDS2017, and CSE-CIC-IDS2018 datasets.Various metrics such as accuracy, true positive rate (TPR), false positive rate (FPR), and F1-score are measured to assess the system's effectiveness in detecting intrusions and distinguishing between normal and malicious network activities.The results obtained from the proposed intrusion detection system using the optimized Pigeon-Inspired Algorithm with the Tanh function are compared with existing intrusion detection systems employing traditional Pigeon-Inspired Algorithms and other optimization algorithms.This comparative analysis provides insights into the superiority and effectiveness of the proposed method.
By following this research method, we aim to investigate and demonstrate the effectiveness of the Pigeon-Inspired Algorithm optimized with the Tanh function in enhancing the performance of intrusion detection systems.The findings will contribute to advancing IDS techniques and provide valuable insights for improving cybersecurity in IoT environments.

A. Pigeon-Inspired Optimization
The Pigeon-Inspired Optimization (PIO) algorithm is a feature selection algorithm that draws inspiration from the behavior of pigeons [16], [17].It aims to identify the most relevant features in a given dataset for utilization in a machine-learning model.The algorithm operates by simulating the behavior of multiple doves, each representing a specific feature within the dataset.These doves have positions and speeds updated iteratively based on predefined rules.Each dove's performance is assessed using its associated features, and the dove exhibiting the best performance is selected as the feature to be incorporated into the machine learning model.PIO has proven to be an effective optimization algorithm for identifying the most significant features within a dataset [18]- [20].It offers simplicity in understanding its underlying principles and implementing the algorithm.
One of the strengths of PIO lies in its simplicity.The underlying principles of the algorithm are intuitive, making it relatively easy to understand and implement.This accessibility makes PIO a practical choice for researchers and practitioners who seek an efficient and straightforward method for feature selection [21].Several studies have demonstrated the effectiveness of PIO in identifying significant features within datasets.Its optimization capabilities have been shown to improve the performance of machine learning models by reducing dimensionality and focusing on the most informative features [22], [23].PIO helps enhance model accuracy, interpretability, and generalization ability by selecting the most relevant features.
Overall, the Pigeon-Inspired Optimization algorithm provides a valuable tool for feature selection in machine learning.With its simplicity, effectiveness, and ability to identify the most significant features, PIO offers a practical solution for optimizing the performance of machine learning models and facilitating better decision-making in various domains.

B. Feature Selection
Feature selection is crucial in machine learning and data analysis, especially when working with datasets with many dimensions [24], [25].Its objective is to identify and choose the most significant and informative features from the original dataset while disregarding irrelevant or redundant ones.Selecting the most relevant features enhances the learning algorithm's performance [6], reduces computational complexity, and improves model interpretability.The number of features involved in determining the target class value is reduced through feature selection, allowing for the exclusion of irrelevant features and unnecessary data.The primary aim of feature selection is to identify the optimal subset of features from a given feature dataset.

C. Modified PIO for feature selection with Tanh
The Modified Pigeon-Inspired Optimization (PIO) algorithm with Tanh refers to an adaptation of the traditional PIO algorithm specifically designed for feature selection in machine learning tasks [27], [28].In this modified approach, the Tanh activation function is incorporated to enhance the optimization process and improve the selection of relevant features [29], [30].The feature selection process is an essential step in machine learning, where the goal is to identify the most informative and discriminative features from a given dataset while eliminating irrelevant or redundant ones.This process helps reduce dimensionality, enhance model performance, and improve interpretability [31], [32].
In the Modified PIO with Tanh, the algorithm leverages the collaborative behavior of pigeons to iteratively search for the optimal feature subset [33], [34].The pigeons represent different features, and their positions and velocities are updated at each iteration based on predefined rules.The Tanh activation function is used during the velocity update stage of the pigeons, contributing to the optimization process.The Modified PIO algorithm introduces non-linearity by applying the Tanh function in the velocity update calculations and facilitates better exploration and exploitation of the search space.The Tanh function transforms the velocity values, ensuring they fall within a range of -1 to 1.This modification helps prevent the algorithm from converging too quickly or getting stuck in local optima, improving its ability to find globally optimal feature subsets.
The Modified PIO with Tanh aims to address the feature selection problem more effectively, taking advantage of the benefits provided by the Tanh activation function.By integrating this modified approach into the feature selection process, researchers and practitioners can enhance the quality and relevance of the selected features, leading to improved performance and accuracy of machine learning models.

D. Dataset
The NSL-KDD dataset is an improved version of the wellknown KDD Cup 1999 dataset, specifically tailored for evaluating intrusion detection systems [35]- [37].The original dataset was derived from a simulated local area network (LAN) and consisted of many network connections, both normal and malicious.However, it suffered from redundant records and imbalanced class distribution.To address these concerns, the NSL-KDD dataset was curated by removing duplicate records and reducing instances, resulting in a more balanced dataset suitable for IDS evaluation.It comprises two subsets: KDDTrain+ for training IDS models and KDDTest+ for evaluating their performance.Researchers can utilize this refined dataset to more accurately assess the effectiveness of their IDS models and gain insights into the challenges associated with network intrusion detection.
The CICIDS 2017 dataset, developed by the Canadian Institute for Cybersecurity (CIC) in 2017 [14], [24], serves as a comprehensive dataset for evaluating intrusion detection systems.It encompasses a week's network traffic data collected from a simulated enterprise network environment.The dataset contains various attacks, including DoS, DDoS, brute force, and infiltration, alongside normal network traffic.A separate file with simulated attack scenarios represents each day of the week.This enables researchers to evaluate IDS models under different conditions and attack types.With extensive flow-based and time-based features, the CICIDS 2017 dataset provides a rich resource for training machine learning and deep learning models in intrusion detection.
The CSE-CIC-IDS2018 dataset, a collaboration between the Canadian Institute for Cybersecurity (CIC) and the Communications Security Establishment (CSE), builds upon the CICIDS2017 dataset by incorporating more recent and sophisticated cyber threats.It aims to provide researchers with an up-to-date and challenging dataset for assessing intrusion detection systems.This dataset comprises labeled network traffic data collected over five days in a simulated enterprise environment.It includes various attacks, such as botnets, DoS, DDoS, web attacks, infiltration, and normal network traffic.The CSE-CIC-IDS2018 dataset introduces additional features do not present in the previous dataset [38], offering an opportunity to develop and evaluate advanced IDS models.It has become a valuable resource in the cybersecurity research community, reflecting the evolving nature of cyber threats and enabling the assessment of IDS performance under realistic and challenging conditions.
These three datasets, NSL-KDD, CICIDS2017, and CSE-CIC-IDS2018, serve as benchmark datasets for intrusion detection in computer networks.They play a crucial role in developing network security systems by providing the means to train and evaluate intrusion detection models.Each dataset has distinct characteristics, and researchers select them based on their research requirements.NSL-KDD contains more attacks than CICIDS2017 and CSE-CIC-IDS2018, while CSE-CIC-IDS2018 introduces novel features that were not present in the previous datasets.

III. RESULTS AND DISCUSSION
This study primarily adopts a quantitative approach as the primary research method, given its suitability for performance measurement, dataset evaluation, and the generation of valuable results.The deductive cycle is employed to test the proposed solution, as it aligns well with the nature of the research inquiry.The study design encompasses three distinct phases: Pre-Processing, Processing using PIO, and Evaluation, each of which will be further discussed in the subsequent subsections.
Based on Figure 2, Tanh_PIO feature selection design is performed using the Pigeon-Inspired Optimization (PIO) algorithm to evaluate the importance of features for intrusion detection.The PIO algorithm is crucial in selecting the most relevant and significant features to utilize in the intrusion detection system.During the feature selection process, the PIO algorithm incorporates the Tanh function in the pigeon's velocity update stage.The Tanh function is a critical component that helps enhance the optimization process within the PIO algorithm.By utilizing the Tanh function, the algorithm can efficiently update the pigeons' velocities, guiding them towards better feature subsets that contribute significantly to the performance of the intrusion detection system.The Tanh function's presence in the velocity update stage of the PIO algorithm brings additional benefits and improvements.Its non-linearity and symmetric characteristics aid in effectively handling positive and negative information in a balanced manner within the algorithm.This feature is particularly advantageous when dealing with feature subsets, as it allows the pigeons to explore and converge towards better solutions, leading to improved feature selection outcomes.
Furthermore, the Tanh function's wide output range allows the pigeons to explore a broader solution space, enabling the algorithm to effectively capture and generalize complex patterns.This capability enhances the algorithm's ability to find feature subsets that are highly discriminative and informative for detecting intrusions in the Internet of Things (IoT) environments.
By combining the Pigeon-Inspired Optimization algorithm with the Tanh function in the feature selection stage, the research ensures that the intrusion detection system is equipped with the most relevant and significant features, optimizing its performance and accuracy in identifying and preventing security threats in IoT environments.The modified PIO algorithm with the Tanh function offers a powerful and efficient approach to feature selection, contributing to the advancement of intrusion detection techniques in cybersecurity.

A. Pre-Processing Phase
The data pre-processing stage encompasses several key steps to ensure the optimal preparation of the dataset.These steps include label and data conversion, duplicate elimination, and data normalization.During label and data conversion, symbolic data is transformed into numeric values to facilitate processing by the algorithm.Additionally, the class field input is converted into binary form, where 0 represents normal records, and 1 denotes attack records, irrespective of the specific attack type.Eliminating duplicate records plays a crucial role in reducing redundancy and improving computational efficiency.By removing duplicate packets and known benign traffic, the intrusion detection system can more effectively focus on identifying potential threats.Data normalization is implemented to present the input data in a standardized and unified format, enabling the Pigeon-Inspired Algorithm with the Tanh function to process it efficiently.This normalization process may involve tasks such as unifying IP addresses, converting timestamps to a common time zone, and normalizing other relevant features.Figure 3 shows how these data pre-processing steps.This study ensures that the input data is well-prepared for the subsequent utilization of the Pigeon-Inspired Algorithm with the Tanh function.By optimizing the dataset's format and removing redundancies, the performance of the Intrusion Detection System on the NSL-KDD, CICIDS 2017, and CSE-CIC-IDS2018 datasets is enhanced.These pre-processing steps improve the accuracy and effectiveness of the intrusion detection system's performance.

B. Processing Phase
During the processing phase of this study, the Pigeon-Inspired Optimization (PIO) algorithm has been modified to improve the feature selection process within the context of enhancing intrusion detection system performance in Internet of Things (IoT) environments.While the traditional PIO algorithm is already effective in solving various feature selection optimization problems, the modified version aims to overcome its inherent limitations.This modification involves integrating the Tanh approach into the PIO algorithm, which brings additional benefits and improvements.
Figure 4 illustrates the script for the processing phase, specifically focusing on the normalization of network intrusion detection datasets, explicitly emphasizing the NSL-KDD dataset.The script begins by importing the necessary libraries, such as pandas for data manipulation and analysis, and pre-processing from sklearn for data pre-processing tasks.A list named col_names is defined to specify the column names expected in the dataset.Within the script, a function named normalize_nsl is defined to read, process, and save the dataset.The function utilizes the pandas read_csv function to read the NSL-KDD dataset into a data frame called nsl.It then performs several data pre-processing steps.These steps involve dropping the last column, which corresponds to the difficulty level, as it is not relevant to the current analysis.The function also handles missing or infinite values by replacing them with NaNs and subsequently removing any rows containing NaNs.Duplicate rows are dropped as well.
Further data transformations are applied to prepare the label column.The second-to-last column, representing the label, is converted to lowercase, and any values other than 'normal' are replaced with 'attack', as this simplifies the classification task.The LabelEncoder from sklearn.Preprocessing is utilized to convert categorical columns into numerical representations, facilitating subsequent analysis.Finally, the pre-processed and normalized DataFrame is saved to a CSV file using the to_csv function.The normalize_nsl function is called twice within the script, once for processing the test dataset and once for the training dataset of the NSL-KDD dataset.The normalized data is saved to their respective output files, ensuring the dataset is preprocessed consistently and appropriately for the subsequent research steps.By employing this pre-processing script, the study ensures that the NSL-KDD dataset is properly prepared for further analysis and utilization within the optimized Pigeon-Inspired Algorithm with the Tanh function.
The Tanh (Hyperbolic Tangent) activation function is a commonly used activation function in artificial neural networks.It shares a similar curve shape with the sigmoid function but has a slightly different output range.Mathematically, the Tanh activation function is defined as in Equation ( 1) [34], [39], [40]: where e is the Euler's constant (approximately 2.71828...) and x is the input value.The Tanh activation function takes an input value, x, and produces an output value, y, ranging from -1 to 1.As the input approaches negative infinity, the output approaches -1, and as the input approaches positive infinity, the output approaches 1.The output values are linear with respect to the input values but within a limited range.One important characteristic of the Tanh activation function is its symmetry around the point (0,0) on the coordinate system.This means that if the input is x, the output is -x.This symmetry characteristic helps in handling positive and negative information in a balanced manner within the neural network.Furthermore, the Tanh activation function has some advantages over the sigmoid function in certain aspects.The Tanh function can produce outputs farther from 0, resulting in a wider range.This can be useful in improving the neural network's ability to capture and generalize complex patterns.
However, the Tanh activation function also has its limitations.When the input approaches negative or positive infinity, the output approaches -1 or 1 with very low gradients.This can lead to the "vanishing gradient" problem, which slows down the neural network training process.Therefore, careful consideration is necessary when using the Tanh function to avoid such issues.Overall, the Tanh activation function is a non-linear function commonly used in artificial neural networks.With its wide output range and symmetric characteristics, the Tanh function can help enhance the neural network's ability to tackle classification and regression problems in various machine learning tasks, the following algorithm shows how a modified PIO works.The pigeons' positions and velocities are initialized at the beginning of the search.Some pigeons are assigned random positions and velocities, while others start with zero values.This variation allows for the exploration and exploitation of different solutions.As the search progresses, the pigeons update their velocities and positions.The update_velocity_and_path method is responsible for this process.The velocity update is performed using the Tanh activation function, which takes into account the current velocity, a time factor, and the difference between the global best position and the pigeon's current position.The Tanh function ensures that the velocity remains within a certain range, preventing it from growing too large or too small.
After updating the velocity, the pigeon's position is adjusted by adding the updated velocity.This change in position helps the pigeon explore new areas and potentially find a better solution.The method also sets the fitness value to None to indicate that it needs to be recalculated.In some cases, the pigeons may undergo mutation through the mutate method.This mutation introduces slight changes to their positions based on a given probability.If the random probability is below the mutation threshold, the position is flipped, representing a change in strategy.
As the search progresses further, the pigeons start converging towards desirable destination areas.The desirable_destination_center method calculates the centre point of these areas by averaging the positions of the top pigeons in the population.This center point becomes a reference for updating the positions of other pigeons using the update_path method.If a random probability is below the center value for a specific dimension, the position is flipped to shift toward the desirable destination.
The fitness method is used to evaluate the effectiveness of each pigeon's position.If the fitness value has not been calculated previously, it invokes a function to measure the pigeon's True Positive Rate, False Positive Rate, and total features.These values are then combined using specific weights to calculate the fitness score.The fitness value is stored and returned.Other methods within the Tanh_Pigeon algorithm class handle identification, string representation, hashing, comparison, attribute retrieval, and position retrieval for the pigeons.
The Tanh_Pigeon algorithm class combines the Tanh activation function with the Pigeon-Inspired Optimization algorithm to guide the pigeons' positions and velocities towards optimal solutions.Through iterative updates and fitness evaluations, the pigeons collectively work towards finding the most suitable features for the given problem.

C. Performance metrics
Table 1 provided below compares the performance of two algorithms, the Pigeon and Tanh_Pigeon algorithm, across three different datasets: NSL-KDD, CICIDS2017, and CSE-CIC-IDS2018.The table above shows a performance comparison of the two algorithms, Pigeon and Tanh_Pigeon, on three different network intrusion detection datasets: NSL KDD, CICIDS2017, and CSE-CIC-IDS2018.The metrics used to compare algorithm performance are True Positive Rate (TPR), False Positive Rate (FPR), coordinate points on the Receiver Operating Characteristic (ROC) curve (in the form of (TPR, FPR)), accuracy, and F-score.
For the NSL KDD dataset, Pigeon's algorithm achieves the highest TPR of 0.636 and the lowest FPR of 0.029, resulting in a point (0.63, 0.03) on the ROC curve.The overall accuracy of this algorithm is 0.7689, and the F-score is 0.768.On the other hand, the Tanh_Pigeon algorithm has better performance with a TPR of 0.721, an FPR of 0.029, a point (0.72, 0.05) on the ROC curve, an accuracy of 0.8172, and an F-score of 0.8172.
For the CICIDS2017 dataset, the Pigeon algorithm achieves a TPR of 0.657, an FPR of 0.026, a point (0.66, 0.03) on the ROC curve, an accuracy of 0.7842, and an F-score of 0.7838.As a comparison, the Tanh_Pigeon algorithm shows an increase in performance with a TPR of 0.745, an FPR of 0.026, a point (0.75, 0.04) on the ROC curve, an accuracy of 0.8304, and an F-score of 0.8304.
For the CSE-CIC-IDS2018 dataset, the Pigeon algorithm obtains a TPR of 0.674, an FPR of 0.025, points (0.67, 0.03) on the ROC curve, an accuracy of 0.7947, and an F-score of 0.7943.Once again, the Tanh_Pigeon algorithm outperforms Pigeon with a TPR of 0.767, an FPR of 0.025, a point (0.77, 0.04) on the ROC curve, an accuracy of 0.8410, and an Fscore of 0.8410.
Overall, this comparison table shows that the Tanh_Pigeon algorithm consistently outperforms Pigeon's algorithm on all three datasets, achieving higher TPR, comparable FPR, better points in the ROC curve, higher accuracy, and better F-score.These results indicate that the Tanh_Pigeon algorithm is a more effective approach for network intrusion detection across various datasets than the Pigeon algorithm.
Analyzing the performance of the two algorithms on three different datasets can assist stakeholders in choosing a more efficient and effective method for network intrusion detection.The Tanh_Pigeon algorithm can be a better choice because it performs consistently better than the Pigeon algorithm.The differences between the traditional PIO algorithm and the Tanh_Pigeon algorithm are how they update velocities and handle exploration and exploitation during optimization.The PIO algorithm is a nature-inspired optimization algorithm that takes inspiration from the flocking behavior of pigeons.In the PIO algorithm, a group of "pigeons" (representing potential solutions) iteratively search for the optimal solution to a given problem.Each pigeon has its position and velocity in the solution space.
The Tanh_Pigeon algorithm modifies the traditional PIO algorithm, where the Tanh (Hyperbolic Tangent) activation function is integrated into the velocity update stage.This modification aims to improve the exploration and exploitation capabilities of the pigeons during the optimization process.The main difference between the traditional PIO and Tanh_Pigeon algorithms is how they update velocities.Integrating the Tanh function in the Tanh_Pigeon algorithm provides additional benefits, such as improved convergence speed and better exploration and exploitation capabilities during optimization.The Tanh_Pigeon algorithm is designed to enhance the efficiency and effectiveness of the optimization process, making it a promising approach for solving complex optimization problems in various domains.

IV. CONCLUSION
The Tanh_Pigeon algorithm consistently surpasses the original Pigeon algorithm in terms of True Positive Rate (TPR), accuracy, and F-score, emphasizing its superior capability to accurately identify positive instances while maintaining a balance between precision and recall.This enhanced performance can be attributed to the Tanh activation function, which enables the model to learn non-linear patterns and generalize better to unseen data.However, it is important to consider that the False Positive Rate (FPR) for the Tanh_Pigeon algorithm is marginally higher across each dataset, suggesting a trade-off between improved detection abilities and an increased rate of false positives.The overall performance improvements indicate that optimizing the Pigeon-Inspired Algorithm with the Tanh function represents a promising approach for enhancing the performance of Intrusion Detection Systems on the NSL-KDD, CICIDS2017, and CSE-CIC-IDS2018 datasets.The Tanh_Pigeon algorithm's robustness and adaptability can be further improved by incorporating additional strategies for mitigating false positives, such as ensemble techniques or a combination of supervised and unsupervised learning methods.
Moreover, considering the ever-evolving landscape of cyber threats, it is crucial to continually update the training datasets to ensure that the Tanh_Pigeon algorithm effectively detects new attack patterns.This can be achieved by incorporating real-world network traffic data and state-of-theart data augmentation and feature engineering techniques.By doing so, the Tanh_Pigeon algorithm can be better equipped to handle diverse cyber threats, ultimately leading to a more secure network environment.
Tanh_Pigeon algorithm exhibits significant potential for enhancing the performance of Intrusion Detection Systems on the NSL-KDD, CICIDS2017, and CSE-CIC-IDS2018 datasets.By addressing the trade-off between improved detection capabilities and an increased rate of false positives, refining the algorithm through hyperparameter optimization, incorporating real-world network traffic data, and exploring synergies with other advanced machine learning techniques, the Tanh_Pigeon algorithm can become an invaluable tool in the ongoing battle against cyber threats.

Fig. 5
Fig. 5 Tanh_PIO algorithm Figure 5 illustrates the implementation of the Tanh_Pigeon algorithm.Tanh_PIO class represents a pigeon in the Pigeon-Inspired Optimization algorithm with the Tanh activation function.Let's imagine a group of pigeons participating in a search for the best solution to a problem.Each pigeon has its own position and velocity, which they update iteratively to optimize its performance.The pigeons' positions and velocities are initialized at the beginning of the search.Some pigeons are assigned random positions and velocities, while others start with zero values.This variation allows for the exploration and exploitation of different solutions.As the search progresses, the pigeons update their velocities and positions.The update_velocity_and_path method is responsible for this process.The velocity update is performed using the Tanh activation function, which takes into account the current velocity, a time factor, and the difference between the global best position and the pigeon's current position.The Tanh function ensures that the velocity remains within a certain range, preventing it from growing too large or too small.