Sine-Cosine-Adopted African Vultures Optimization with Ensemble Autoencoder-Based Intrusion Detection for Cybersecurity in CPS Environment

A Cyber-Physical System (CPS) is a network of cyber and physical elements that interact with each other. In recent years, there has been a drastic increase in the utilization of CPSs, which makes their security a challenging problem to address. Intrusion Detection Systems (IDSs) have been used for the detection of intrusions in networks. Recent advancements in the fields of Deep Learning (DL) and Artificial Intelligence (AI) have allowed the development of robust IDS models for the CPS environment. On the other hand, metaheuristic algorithms are used as feature selection models to mitigate the curse of dimensionality. In this background, the current study presents a Sine-Cosine-Adopted African Vultures Optimization with Ensemble Autoencoder-based Intrusion Detection (SCAVO-EAEID) technique to provide cybersecurity in CPS environments. The proposed SCAVO-EAEID algorithm focuses mainly on the identification of intrusions in the CPS platform via Feature Selection (FS) and DL modeling. At the primary level, the SCAVO-EAEID technique employs Z-score normalization as a preprocessing step. In addition, the SCAVO-based Feature Selection (SCAVO-FS) method is derived to elect the optimal feature subsets. An ensemble Deep-Learning-based Long Short-Term Memory–Auto Encoder (LSTM-AE) model is employed for the IDS. Finally, the Root Means Square Propagation (RMSProp) optimizer is used for hyperparameter tuning of the LSTM-AE technique. To demonstrate the remarkable performance of the proposed SCAVO-EAEID technique, the authors used benchmark datasets. The experimental outcomes confirmed the significant performance of the proposed SCAVO-EAEID technique over other approaches with a maximum accuracy of 99.20%.


Introduction
A Cyber-Physical System (CPS) is a type of computing system combined with physical gadgets and can be broadly utilized in various areas, namely, energy, manufacturing, safety management, and traffic control [1]. The most common enabler for the intelligence sector is the integration of the Cloud Computing (CC) technique and CPS, which remains a common trend with numerous real-time cases, for example, Small and Medium Enterprises (SMEs), supporting industrial cluster collaboration with business cooperation and cloud manufacturing service platforms [2]. With the help of CC, more optimized techniques are The performance of the proposed SCAVO-EAEID technique was validated using two benchmark datasets such as the NSL-KDD 2015 and CICIDS2017 datasets.
The rest of the paper is organized as follows. Section 2 discusses the related works, and Section 3 offers the proposed model. Then, Section 4 provides the analytical results, and Section 5 concludes the paper.

Related Works
Huang et al. [11] introduced a new federated Execution and Evaluation dual network model (EEFED), which allows different federal participants to identify the local detection model. This phenomenon undermines the primary objective of Federated Learning (FL). Mansour [12] proposed a novel Poor and Rich Optimization with the DL method for BC-Assisted IDS in CPS Environments (PRO-DLBIDCPS). At first, the model implemented the Adaptive Harmony Search Algorithm (AHSA)-based FS method for an appropriate selection of the feature subset. The PRO technique with the Attention-based Bi-Directional Gated RNN (ABi-GRNN) system was used in this study for both the detection and classification of the intrusions. Henry et al. [13] introduced a method integrating CNN and GRU in which both combinations were used for the optimization of the network parameters. In this work, the author utilized the CICIDS-2017 benchmark datasets.
Ortega-Fernandez et al. [14] introduced the Network IDS (NIDS) model based on the DAE, trained with network flow data. This model had a benefit, i.e., no need to have previous knowledge about the underlying architecture or the network topology. The experimental result showed that the presented method was capable of detecting the anomalies, caused by distributed DoS attacks. The proposed method provided a low false alarm rate and high detection accuracy. It also outperformed the other methods and acted as a baseline and a state-of-the-art model for the unsupervised learning model. Likewise, the DAE model is capable of detecting abnormal behaviors in legitimate devices after an attack. Wang et al. [15] introduced a knowledge distillation method-based Triplet CNN technique to heavily enhance the speed and improve the AD performance of the model for industrial CPS in addition to the reduction of model complexity. In particular, during the training, a robust model loss function was devised to enhance the network's stability. A novel NN training model named K-fold cross-training was developed in this study to enhance anomaly detection performance.
Mittal et al. [16] introduced a new technique for the IDS. The presented technique applied a new variant of the gravitational search technique to attain the optimum cluster. In the presented method, Kbest was adapted as an exponentially-declining function with logistic-mapping-based chaotic behaviors. Presekal et al. [17] developed a new technique for online cyberattack awareness. This technique improves the power grid resilience and assists the power system operators during localization and identification processes of the active attack locations in the Operational Technology (OT) network on a real-time basis. The presented technique used a hybrid DL mechanism, i.e., deep convolutional network with Graph Convolutional LSTM (GC-LSTM), for time-series classification-related AD.
Though several ML and DL models have been proposed earlier for intrusion detection and classification, a need still exists to enhance the classification performance. Owing to the continuous evolution of the model, the number of parameters in DL models also increases quickly, bringing model overfitting issues. Since the trial-and-error method is a tedious and erroneous process for hyperparameter tuning, the metaheuristic algorithms are applied. Therefore, in this work, the authors employ the BO algorithm for the parameter selection of the LSTM-AE model.

Proposed Model
In this study, a new SCAVO-EAEID method has been developed for the classification of intrusions in the CPS environment. The SCAVO-EAEID algorithm performs the detection of intrusions in the CPS environment using major sub-processes namely, the LSTM-AE-based classification, Z-score normalization, SCAVO-FS technique, and the RMSProp optimizerbased hyperparameter tuning. The workflow of the proposed model is demonstrated in Figure 1.
In this study, a new SCAVO-EAEID method has been developed for the classification of intrusions in the CPS environment. The SCAVO-EAEID algorithm performs the detection of intrusions in the CPS environment using major sub-processes namely, the LSTM-AE-based classification, Z-score normalization, SCAVO-FS technique, and the RMSProp optimizer-based hyperparameter tuning. The workflow of the proposed model is demonstrated in Figure 1.

Data Used
In the current research work, the proposed model was experimentally validated upon two benchmark datasets such as the NSLKDD2015 (https://www.unb.ca/cic/datasets/nsl.html, accessed on 12 February 2023) and CICIDS2017 datasets (https://www.unb.ca/cic/datasets/ids-2017.html, accessed on 12 February 2023). The NSL-KDD 2015 dataset has a total of 125,973 samples with 41 features. The NSL-KDD 2015 dataset does not include any redundant records in the training set. So, the classifiers remain unbiased towards more frequent records. Likewise, CICIDS2017 has a total of 2,830,743 samples with 80 features. The CICIDS2017 dataset contains both benign and the most up-to-date common attacks, which resemble the true real-world data (PCAPs). It also includes the network traffic analysis results with the help of CICFlowMeter and labeled flows based on a few parameters such as the time stamp, source, destination IPs, source and destination ports, protocols, and attack.

Data Preprocessing
At first, the SCAVO-EAEID technique applies the Z-score normalization as a preprocessing step. This procedure is leveraged to attain the normalized values or ranges of the input dataset, from the unstructured dataset, by applying the concepts such as mean and standard deviation [18]. The normalized values or ranges can be obtained by dividing the presented data of every gate using standard deviation values and then subtracting the mean of every gate from that value. Equations (1) and (2) are utilized to map the value of the new input between the target ranges, i.e., [ , ].
Here, (t) denotes the scaling value of the -score-normalized field ( ) . ( ) and ( ) are evaluated from the training datasets, which represent the standard deviation and mean at every gate time , whereas min and max denote the absolute initial and final gate values that are noticed for the gate period during the testing dataset.

Data Used
In the current research work, the proposed model was experimentally validated upon two benchmark datasets such as the NSLKDD2015 (https://www.unb.ca/cic/datasets/ nsl.html, accessed on 12 February 2023) and CICIDS2017 datasets (https://www.unb.ca/ cic/datasets/ids-2017.html, accessed on 12 February 2023). The NSL-KDD 2015 dataset has a total of 125,973 samples with 41 features. The NSL-KDD 2015 dataset does not include any redundant records in the training set. So, the classifiers remain unbiased towards more frequent records. Likewise, CICIDS2017 has a total of 2,830,743 samples with 80 features. The CICIDS2017 dataset contains both benign and the most up-to-date common attacks, which resemble the true real-world data (PCAPs). It also includes the network traffic analysis results with the help of CICFlowMeter and labeled flows based on a few parameters such as the time stamp, source, destination IPs, source and destination ports, protocols, and attack.

Data Preprocessing
At first, the SCAVO-EAEID technique applies the Z-score normalization as a preprocessing step. This procedure is leveraged to attain the normalized values or ranges of the input dataset, from the unstructured dataset, by applying the concepts such as mean and standard deviation [18]. The normalized values or ranges can be obtained by dividing the presented data of every gate using standard deviation values and then subtracting the mean of every gate from that value. Equations (1) and (2) are utilized to map the value of the new input between the target ranges, i.e., [x, y].
Here, A Zad(t) denotes the scaling value of the z-score-normalized field A Za(t) .A i (t) and A j (t) are evaluated from the training datasets, which represent the standard deviation and mean at every gate time t, whereas A ZS min and A ZSmax denote the absolute initial and final gate values that are noticed for the gate period during the testing dataset.

Processes Involved in the SCAVO-FS Technique
In this work, the SCAVO-FS system is derived to elect the optimal feature subsets. The AVO algorithm is stimulated by the navigational and foraging behaviors of the African vultures [19]. The biological nature of these vultures with regard to competing and searching for food is outlined in four different phases as follows. Consider N number of vultures in the atmosphere, which describes the amount of population, i.e., n = {1, 2, . . . , N}. In the following equation, the fitness function of every location is evaluated.
Here, p n represents the probability of choosing either the first or second group, F n denotes the fitness function of the nth location [19]. Next, the formation of the 1st and 2nd groups during all the iterations is attained as follows.
Here, the ranges of L 1 and L 2 are 0 ≤ L 1 , L 2 ≤ 1 and L 1 + L 2 = 1, respectively. The satiated vulture with sufficient energy can move a long distance to find food, whereas a hungry one cannot fly longer as denoted below.
In Equations (5) and (6), A denotes the vulture with high energy, it and IT max denote the present and the maximal iterations, correspondingly, h and rand 1 indicate the random number in the range of [−1, 1], [−2, 2], and [0, 1], correspondingly; and z describes the probability of entering the exploration phase.
The procedure of seeking food by African vultures defines the exploration stage in which the parameter p 1 , 0 ≤ p 1 ≤ 1 defines the selection of strategy.
In this expression, P(it + l) represents the location vector of the vulture in the second iteration. q = 2 × rand 3 , where rand 3 denotes the randomly generated value in the range of [0, 1].
u b and l b denote the upper and lower boundaries correspondingly, while Rand 4 and Rand 5 indicate the randomly generated integers that lie in the range of 0 to 1.
The exploitation phase includes two stages with dissimilar strategies. The selection of any method relies on both p 2 and p 3 parameters, while its values lie in the range of 0 to 1. If |F| ranges between 0.5 and 1, then the exploitation phase enters the initial phase, which defines the siege fight and rotating flight strategies.
Here, rand 6 denotes a randomly generated value in the range of [0, 1]. The solution to Equation (11) is given below.
Next, the rotational flight of the vulture can be modeled as given below.
Here, rand 8 and rand 9 denote the two randomly-generated integers in the range of [0, 1]. If |F| > 0.5, then the exploitation phase enters the second phase, which describes the aggressive siege and accumulation fight strategies for finding the food. Based on the following condition, any strategy can be selected. where Best vulture1 (it) and Best vulture2 (it) represent the better vultures of the first and second groups, correspondingly as shown below.
Here, d 1 signifies the dimension of the problem. Levy(d 1 ) is evaluated as given below.
The best possible solution is not known at the initial stage of the AVO algorithm. Therefore, it is better to use a large step in the beginning, which might generate the calculation process farther from the optimum location [20]. Consequently, the scaling variable is used for changing the situation in the initial phase. In the SCAVO algorithm, the vulture is repositioned at the end of every iteration based on sine-and cosine-adapted scaling factors, as given below [20].
Now, the SCaSF denotes the scaling factor as follows In Equation (24), RNDI indicates a randomly-generated value; W 1 and W 2 denote the weighting factors, and it and Max_it indicate the current and maximal iteration, re- spectively. The scaling factor is used to control the vulture's development at the initial stage. Different upsides of W are tried and appointed for a proper choice of W 1 and W 2 . It is to be noted that the best possible results are attained when W 1 and W 2 are selected as 10 and 9 correspondingly. The scaling factor has changed the vulture's position at the underlying period of the pursuit interaction, thus increasing the hunting capability of the AVO technique further. The calculation should provide the option to locate the best location between two locations for the exploitation of the search range. These cycles ensure the best exploitation and exploration capabilities of the calculation.
The fitness function considers the number of features selected and the accuracy of the classifier. It reduces the size of features selected and increases the classification accuracy. Consequently, the subsequent fitness function is used to evaluate the individual solution.
Here, α, which is usually set to 0.9, is used to control the importance of subset length and classification quality. ErrorRate is the classification error rate based on the number of features selected. ErrorRate can be evaluated as the percentage of incorrect classifications to the whole number of classifications made, and its values lie in the range of 0 to 1. ErrorRate is the complement of classification accuracy. #SF denotes the total features selected, and #All_F represents the overall number of features in the original data.

Classification Model
For accurate classification of the intrusions, the LSTM-AE model is leveraged for both the identification and the classification of the intrusions. The deep RNN (particularly LSTM) model is the underlying structure of the DL model that is applied to time-series and sequential data to learn the features and patterns. But, the LSTM [21], out of the RNN method, contains memory cells for pattern recognition that is dependent on short -and long-term input datasets. These are beneficial in the detection and forecasting of the outliers in time-series datasets [22]. The LSTM cell comprises three memory gates such as the forget, input (update), and output gates.
In Equation (26), B and M denote the bias and weight of the LSTM, respectively. Furthermore, the dataset fed as input to the LSTM cells gets upgraded by the input gate (I t ).
At last, the output gate plays its role by transmitting the dataset created to the output cell (H t ) or the succeeding state vector (C t ).
In this expression, x t stands for input dataset, h t−1 denotes the prior short-term state, and B and M represent the bias and weight matrices, correspondingly. Meanwhile, the LSTM model has a state vector C t that includes tanh and sigmoid functions. The model evaluates the gradient error at every time point, whereas the derivative items of tanh and sigmoid functions become additive. It prevents the model from suffering gradient disappearing problems. Unlike other gradient descent models, the LSTM exploits a minibatch method at the time of training the data samples. Usually, the LSTM model comprises a single layer of cells, whereas the ensemble and a combination of numerous LSTM models increase the depth of the layer. This in turn increases the model's performance and accuracy in training. It also helps in identifying the short-and long-term continuous patterns and big datasets.
On top of that, the AE method is utilized with LSTM for training the long-term patterns and the most important features. AE is an unsupervised type of ANN that intends to learn the essential hidden representation of the datasets by decoding and encoding processes. The output and the input datasets are compared to evaluate the differences. In the case of large differences, it shows that the reconstruction loss is higher. Based on this output, it can be assumed that the model can handle the reconstructed dataset. Accordingly, the data are recognized as irregular.
The LSTM-AE is an application of AE in which the LSTM cells are employed in the encoder-decoder layer. This setup brings the advantages of both methods for time-series or sequential datasets. In this work, the LSTM-AE is employed because it provides certain advantages over the normal (regular) AEs, for instance, LSTM-AE can handle sequence data as input (time-series dataset), whereas the normal AE cannot accept a sequential sample as the input dataset. Furthermore, the LSTM-AE models take a wider range of input lengths (short-or long-term), while on the other hand, the regular AE takes only a fixed size of the input dataset. At last, the data dimension increases, and the computation becomes complicated, since the long-and short-term dependence on time in previous data affects the current IIoT data. To resolve these problems, LSTM-AE is applied for the extraction of the fundamental feature with benefits over normal AEs. The structure of the AE is shown in Figure 2. to learn the essential hidden representation of the datasets by decoding and encoding processes. The output and the input datasets are compared to evaluate the differences. In the case of large differences, it shows that the reconstruction loss is higher. Based on this output, it can be assumed that the model can handle the reconstructed dataset. Accordingly, the data are recognized as irregular.
The LSTM-AE is an application of AE in which the LSTM cells are employed in the encoder-decoder layer. This setup brings the advantages of both methods for time-series or sequential datasets. In this work, the LSTM-AE is employed because it provides certain advantages over the normal (regular) AEs, for instance, LSTM-AE can handle sequence data as input (time-series dataset), whereas the normal AE cannot accept a sequential sample as the input dataset. Furthermore, the LSTM-AE models take a wider range of input lengths (short-or long-term), while on the other hand, the regular AE takes only a fixed size of the input dataset. At last, the data dimension increases, and the computation becomes complicated, since the long-and short-term dependence on time in previous data affects the current IIoT data. To resolve these problems, LSTM-AE is applied for the extraction of the fundamental feature with benefits over normal AEs. The structure of the AE is shown in Figure 2. The AE model comprises the output layer, input layer, and Hidden Layer (HL), whereas the interconnected layer is made up of an LSTM cell to create the output layer dataset. The HL takes the sample from various sampling times to estimate and calculate the impact on the succeeding sample datasets at another sampling period. The next time point values are attained as the output values by modeling and integrating the impact as the forecasted values. The respective sample of the HL is characterized by an equation in which the sample of remains the input instance of the data sample from , signifies the weight matrices, and characterizes the bias vector between the input layer and the HLs. The function updates the next input layer to make as the output value in the AE architecture. The AE model comprises the output layer, input layer, and Hidden Layer (HL), whereas the interconnected layer is made up of an LSTM cell to create the output layer dataset. The HL takes the sample from various sampling times to estimate and calculate the impact on the succeeding sample datasets at another sampling period. The next time point values are attained as the output values by modeling and integrating the impact as the forecasted values. The respective sample of the HL is characterized by an equation in which the sample of x i remains the input instance of the data sample from X, N w signifies the weight matrices, and P w characterizes the bias vector between the input layer and the HLs. The function δ updates the next input layer to make C i as the output value in the AE architecture. C j = δ N w .x j + P w (31)

Hyperparameter Tuning Model
At last, the RMSProp optimizer is exploited for the hyperparameter tuning of the LSTM-AE model. In the vertical direction, the RMSProp optimizer [22] restricts the oscillation. Thus, in the horizontal direction, the learning rate gets improved and the algorithm takes a large step in converging at a faster rate. The RMSProp calculation is given as follows. The value of the momentum is represented as beta and is set to 0.9 [22].
In backward propagation process, dW and db are used to update the W and b parameters with the help of the following expression [22]: Let us assume the exponentially-weighted average square values of dW and db instead of independently using the dW and db values for all the epochs [22].
Here, β represents the hyperparameter in the range of 0 to 1. The newly weighed average can be formed with the help of current value square, weights and the average of the previous values. The parameters will be updated after the evaluation of the exponentiallyweighted averages [22].
S dW is relatively lower in such a way that it is divided by dW. Here, S db is relatively higher so that when it is divided by db with a comparatively large number, it slows down the update on the vertical dimension.

Results Analysis
The performance of the SCAVO-EAEID method was experimentally validated on two datasets such as NSL-KDD 2015 and CICIDS 2017. The proposed model was simulated in the Python 3.6.5 tool on a PC configured with these specifications; i5-8600k, GeForce 1050Ti 4GB, 16 GB RAM, 250 GB SSD, and 1 TB HDD. The parameter settings are given as follows: learning rate, 0.01; dropout, 0.5; batch size, 5; epoch count, 50; and activation, ReLU.  In Table 3 and Figure    The TACC and VACC values, achieved by the proposed SCAVO-EAEID system upon the NSL-KDD 2015 dataset are shown in Figure 4. The outcomes exhibit that the SCAVO-EAEID method yielded better performance with maximum TACC and VACC values. It is noticeable that the SCAVO-EAEID methodology gained the maximum TACC outcomes. The TACC and VACC values, achieved by the proposed SCAVO-EAEID system upon the NSL-KDD 2015 dataset are shown in Figure 4. The outcomes exhibit that the SCAVO-EAEID method yielded better performance with maximum TACC and VACC values. It is noticeable that the SCAVO-EAEID methodology gained the maximum TACC outcomes.
The TLS and VLS values, accomplished by the proposed SCAVO-EAEID system upon the NSL-KDD 2015 dataset, are shown in Figure 5. The results display that the SCAVO-EAEID approach showcased a superior performance with low TLS and VLS values. It is noticeable that the SCAVO-EAEID method achieved the least VLS outcomes. The TLS and VLS values, accomplished by the proposed SCAVO-EAEID system upon the NSL-KDD 2015 dataset, are shown in Figure 5. The results display that the SCAVO-EAEID approach showcased a superior performance with low TLS and VLS values. It is noticeable that the SCAVO-EAEID method achieved the least VLS outcomes. In Table 4 and Figure 6, the experimental outcomes of the SCAVO-EAEID method  The TLS and VLS values, accomplished by the proposed SCAVO-EAEID system upon the NSL-KDD 2015 dataset, are shown in Figure 5. The results display that the SCAVO-EAEID approach showcased a superior performance with low TLS and VLS values. It is noticeable that the SCAVO-EAEID method achieved the least VLS outcomes. In Table 4 and Figure 6 TRS/TSS, the SCAVO-EAEID technique accomplished an accu y of 98.74%, prec n of 99.24%, reca l of 98.14%, and F score of 99.53%. Finally, with 80:20 of TRS/TSS, the SCAVO-EAEID method achieved an accu y of 99.10%, prec n of 97.92%, reca l of 98.54%, and F score of 98.64%.  The TACC and VACC values, achieved by the proposed SCAVO-EAEID method upon the CICIDS-2017 dataset are shown in Figure 7. The outcomes demonstrate that the SCAVO-EAEID method achieved a superior performance with maximum TACC and VACC values. Notably, the SCAVO-EAEID methodology attained the highest TACC outcomes. The TACC and VACC values, achieved by the proposed SCAVO-EAEID method upon the CICIDS-2017 dataset are shown in Figure 7. The outcomes demonstrate that the SCAVO-EAEID method achieved a superior performance with maximum TACC and VACC values. Notably, the SCAVO-EAEID methodology attained the highest TACC outcomes.
The TLS and VLS values, acquired by the proposed SCAVO-EAEID technique upon the CICIDS-2017 dataset, are portrayed in Figure 8. The results confirm that the SCAVO-EAEID method achieved a superior performance with low TLS and VLS values. Notably, the proposed SCAVO-EAEID method displayed the minimal VLS outcomes.
A comparative accu y examination was conducted between the proposed SCAVO-EAEID technique and other recent methods [12,23] and the results are shown in Table 5 and   The TLS and VLS values, acquired by the proposed SCAVO-EAEID technique upon the CICIDS-2017 dataset, are portrayed in Figure 8. The results confirm that the SCAVO-EAEID method achieved a superior performance with low TLS and VLS values. Notably, the proposed SCAVO-EAEID method displayed the minimal VLS outcomes. A comparative examination was conducted between the proposed SCAVO-EAEID technique and other recent methods [12,23] and the results are shown in Table 5 and

Methods
Accuracy (%) SCAVO-EAEID 99.20 PRO-DLBIDCPS Model [12] 99.00 BBFO-GRU Model [23] 98.79 DT Model [12] 96.85 MLIDS Model [12] 94.02 CSPSO Model [12] 74.98 CO Model [12] 98.47 DNN-SVM Model [12] 93.31 GA-Fuzzy [12] 97.51 FCM Model [12] 97.4 GBT Model [12] 84.64 To exhibit the enhanced performance of the SCAVO-EAEID technique, a brief time complexity analysis was conducted and the results are shown in Table 6. The outcomes infer that the DNN-SVM, GA-Fuzzy, FCM Model, GBT Model, BBFO-GRU, MLIDS, and CSPSO techniques demanded higher TRT and TST values. However, the SCAVO-EAEID technique accomplished a superior performance with minimal TRT and TST values such as 0.542 min and 0.246 min, respectively. These results highlight the supremacy of the proposed SCAVO-EAEID technique. To exhibit the enhanced performance of the SCAVO-EAEID technique, a brief time complexity analysis was conducted and the results are shown in Table 6. The outcomes infer that the DNN-SVM, GA-Fuzzy, FCM Model, GBT Model, BBFO-GRU, MLIDS, and CSPSO techniques demanded higher TRT and TST values. However, the SCAVO-EAEID technique accomplished a superior performance with minimal TRT and TST values such as 0.542 min and 0.246 min, respectively. These results highlight the supremacy of the proposed SCAVO-EAEID technique.

Conclusions
In this study, a new SCAVO-EAEID system has been introduced for intrusion classification in the CPS environment. The presented SCAVO-EAEID method emphasizes the detection of intrusions in the CPS environment using major sub-processes, namely, LSTM-AE-based classification, Z-score normalization, the SCAVO-FS technique, and RM-SProp optimizer-based hyperparameter tuning. At the primary level, the SCAVO-EAEID technique applies Z-score normalization as a preprocessing step. Moreover, the SCAVO-FS technique is derived to elect the optimal feature subsets. Furthermore, the LSTM-AE model is applied for the detection and classification of intrusions. At last, the RMSProp optimizer is used for hyperparameter tuning of the LSTM-AE model. To demonstrate the remarkable performance of the proposed SCAVO-EAEID technique, two benchmark datasets were used. The experimental outcomes reiterated the significant performance of the proposed SCAVO-EAEID technique over other approaches. In the future, the performance of the presented method can be enhanced using metaheuristics-based feature selection techniques. Data Availability Statement: Data sharing not applicable to this article as no datasets were generated during the current study.

Conflicts of Interest:
The authors declare that they have no conflict of interest. The manuscript was written through the contributions of all authors. All authors have given approval to the final version of the manuscript.