{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,29]],"date-time":"2025-12-29T18:56:06Z","timestamp":1767034566337,"version":"3.48.0"},"reference-count":38,"publisher":"Public Library of Science (PLoS)","issue":"12","license":[{"start":{"date-parts":[[2025,12,29]],"date-time":"2025-12-29T00:00:00Z","timestamp":1766966400000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["www.plosone.org"],"crossmark-restriction":false},"short-container-title":["PLoS One"],"abstract":"<jats:p>An Intrusion Detection System (IDS) is an important component of cybersecurity, meant to monitor malicious behaviour, detect, and respond to unauthorized activities in computer systems or networks. Generally, Intrusion detection (IDS) is classified into host-based IDS (HIDS) and network-based IDS (NIDS), which monitor individual devices and network traffic, respectively. Existing models faced certain limitations, including the dilemma of balancing false positives against false negatives, the challenge of adjusting to evolving threats, handling issues with high-dimensional information and encrypted traffic, and limited resource competence when dealing with privacy concerns. The proposed research work currently aims at developing an intrusion detection system that is more adaptive and effective to hinder these existing challenges and improve the security of digital environments. The study is related to applying an elaborate Search-based learning-optimized ensemble tree classifier (SBO-based ensemble tree classifier) for improving ID in Vehicular Ad Hoc Networks (VANETs). The ensemble classifier incorporates decision tree, random forest, extra tree, and eXtreme Gradient Boosting (XG Boost) classifiers, which are fused to provide a comprehensive interpretation of potential attacks within the VANET environment. Moreover, the research is enriched by incorporating Search-based learning optimization that takes advantage of their collective and adaptive nature. This innovative amalgamation attempts to perfect the aggregated response generated by the ensemble classifier, which fine-tunes the proposed model for effective intrusion detection. To facilitate the multi-dimensional orientation, four separate outputs, such as alpha, beta, gamma, and delta, were introduced, which allow the categorization of intrusion attacks based on specific types. More specifically, the experimental results illustrate that the proposed SBO-based ensemble tree classifier achieved superior performance with an accuracy of 96.56%, F1-score of 96.63%, FPR of 0.97, MCC of 0.97, Precision of 96.59%, Sensitivity of 96.68%, and Specificity of 96.52% for intrusion detection and outperforms the other existing methods using the BOT-IOT Dataset.<\/jats:p>","DOI":"10.1371\/journal.pone.0339822","type":"journal-article","created":{"date-parts":[[2025,12,29]],"date-time":"2025-12-29T18:45:25Z","timestamp":1767033925000},"page":"e0339822","update-policy":"https:\/\/doi.org\/10.1371\/journal.pone.corrections_policy","source":"Crossref","is-referenced-by-count":0,"title":["Intrusion detection using search-based learning optimized ensemble tree classifier model"],"prefix":"10.1371","volume":"20","author":[{"given":"Afnan M.","family":"Alhassan","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8291-6121","authenticated-orcid":true,"given":"Nouf I.","family":"Altmami","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"340","published-online":{"date-parts":[[2025,12,29]]},"reference":[{"issue":"10","key":"pone.0339822.ref001","doi-asserted-by":"crossref","first-page":"9723","DOI":"10.1016\/j.jksuci.2021.12.008","article-title":"MapReduce based intelligent model for intrusion detection using machine learning technique","volume":"34","author":"M Asif","year":"2022","journal-title":"Journal of King Saud University - Computer and Information Sciences"},{"key":"pone.0339822.ref002","doi-asserted-by":"crossref","first-page":"2372","DOI":"10.1016\/j.procs.2020.04.257","article-title":"Building a intrusion detection system for IoT environment using machine learning techniques","volume":"171","author":"KVVNL Sai Kiran","year":"2020","journal-title":"Procedia Computer Science"},{"key":"pone.0339822.ref003","doi-asserted-by":"crossref","first-page":"386","DOI":"10.1016\/j.ins.2019.10.069","article-title":"A hybrid deep learning model for efficient intrusion detection in big data environment","volume":"513","author":"MM Hassan","year":"2020","journal-title":"Information Sciences"},{"key":"pone.0339822.ref004","doi-asserted-by":"crossref","first-page":"104604","DOI":"10.1016\/j.ssci.2020.104604","article-title":"Application of intrusion detection technology in network safety based on machine learning","volume":"124","author":"W Fang","year":"2020","journal-title":"Safety Science"},{"issue":"22","key":"pone.0339822.ref005","doi-asserted-by":"crossref","first-page":"17265","DOI":"10.1007\/s00500-020-05017-0","article-title":"A deep learning approach for effective intrusion detection in wireless networks using CNN","volume":"24","author":"B Riyaz","year":"2020","journal-title":"Soft Comput"},{"issue":"2","key":"pone.0339822.ref006","doi-asserted-by":"crossref","first-page":"1803","DOI":"10.1109\/TNSM.2020.3014929","article-title":"Multi-Stage Optimized Machine Learning Framework for Network Intrusion Detection","volume":"18","author":"M Injadat","year":"2021","journal-title":"IEEE Trans Netw Serv Manage"},{"issue":"4","key":"pone.0339822.ref007","doi-asserted-by":"crossref","first-page":"2565","DOI":"10.1007\/s12083-020-00999-y","article-title":"Analysis of intrusion detection in cyber attacks using DEEP learning neural networks","volume":"14","author":"P Kumar","year":"2020","journal-title":"Peer-to-Peer Netw Appl"},{"key":"pone.0339822.ref008","doi-asserted-by":"crossref","first-page":"292","DOI":"10.1016\/j.future.2019.07.045","article-title":"Interactive three-dimensional visualization of network intrusion detection data for machine learning","volume":"102","author":"W Zong","year":"2020","journal-title":"Future Generation Computer Systems"},{"issue":"3","key":"pone.0339822.ref009","doi-asserted-by":"crossref","first-page":"387","DOI":"10.1007\/s10207-020-00508-5","article-title":"A novel scalable intrusion detection system based on deep learning","volume":"20","author":"SN Mighan","year":"2020","journal-title":"Int J Inf Secur"},{"key":"pone.0339822.ref010","doi-asserted-by":"crossref","first-page":"103741","DOI":"10.1016\/j.micpro.2020.103741","article-title":"RETRACTED: A machine learning based IoT for providing an intrusion detection system for security","volume":"82","author":"DJ Atul","year":"2021","journal-title":"Microprocessors and Microsystems"},{"key":"pone.0339822.ref011","doi-asserted-by":"crossref","first-page":"41525","DOI":"10.1109\/ACCESS.2019.2895334","article-title":"Deep Learning Approach for Intelligent Intrusion Detection System","volume":"7","author":"R Vinayakumar","year":"2019","journal-title":"IEEE Access"},{"issue":"1","key":"pone.0339822.ref012","doi-asserted-by":"crossref","first-page":"16","DOI":"10.1016\/j.jnca.2012.09.004","article-title":"Intrusion detection system: A comprehensive review","volume":"36","author":"H-J Liao","year":"2013","journal-title":"Journal of Network and Computer Applications"},{"key":"pone.0339822.ref013","first-page":"1","article-title":"A survey of distributed denial of service attack","author":"KN Mallikarjunan","year":"2016","journal-title":"2016 10th International Conference on Intelligent Systems and Control (ISCO)"},{"key":"pone.0339822.ref014","author":"PJ Criscuolo","year":"2000"},{"issue":"6245","key":"pone.0339822.ref015","doi-asserted-by":"crossref","first-page":"255","DOI":"10.1126\/science.aaa8415","article-title":"Machine learning: Trends, perspectives, and prospects","volume":"349","author":"MI Jordan","year":"2015","journal-title":"Science"},{"key":"pone.0339822.ref016","doi-asserted-by":"crossref","unstructured":"Berthold MR, Cebron N, Dill F, Gabriel TR, K\u00f6tter T, Meinl T, Ohl P, Sieb C, Thiel K, Wiswedel B. Studies in classification, data analysis, and knowledge organization (GfKL 2007). 2007: 319\u201326.","DOI":"10.1007\/978-3-540-78246-9_38"},{"issue":"4","key":"pone.0339822.ref017","doi-asserted-by":"crossref","first-page":"2046","DOI":"10.1109\/SURV.2013.031413.00127","article-title":"A Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks","volume":"15","author":"ST Zargar","year":"2013","journal-title":"IEEE Commun Surv Tutorials"},{"key":"pone.0339822.ref018","doi-asserted-by":"crossref","first-page":"105","DOI":"10.3166\/ejc.13.105-133","article-title":"Security and Trust for Wireless Autonomic Networks Systems and Control Methods","volume":"13","author":"JS Baras","year":"2007","journal-title":"European Journal of Control"},{"key":"pone.0339822.ref019","first-page":"21","article-title":"A deep learning approach for network intrusion detection system","author":"A Javaid","year":"2016","journal-title":"Proceedings of the 9th EAI International Conference on Bio-inspired Information and Communications Technologies"},{"key":"pone.0339822.ref020","doi-asserted-by":"crossref","first-page":"353","DOI":"10.1016\/j.cose.2011.05.008","article-title":"Data preprocessing for anomaly based network intrusion detection: A review","volume":"30","author":"JJ Davis","year":"2011","journal-title":"Computers & Security"},{"issue":"22","key":"pone.0339822.ref021","doi-asserted-by":"crossref","first-page":"8609","DOI":"10.1016\/j.eswa.2015.07.015","article-title":"An intrusion detection system using network traffic profiling and online sequential extreme learning machine","volume":"42","author":"R Singh","year":"2015","journal-title":"Expert Systems with Applications"},{"key":"pone.0339822.ref022","first-page":"1","article-title":"Deep learning techniques for implementation of chatbots","author":"B Santhosh Kumar","year":"2020","journal-title":"2020 International Conference on Computer Communication and Informatics (ICCCI)"},{"key":"pone.0339822.ref023","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1155\/2019\/8124254","article-title":"Industrial Anomaly Detection and Attack Classification Method Based on Convolutional Neural Network","volume":"2019","author":"Y Lai","year":"2019","journal-title":"Security and Communication Networks"},{"key":"pone.0339822.ref024","doi-asserted-by":"crossref","first-page":"29","DOI":"10.1145\/1978672.1978676","article-title":"Statistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation","author":"J Song","year":"2011","journal-title":"Proceedings of the First Workshop on Building Analysis Datasets and Gathering Experience Returns for Security"},{"issue":"9","key":"pone.0339822.ref025","article-title":"An intrusion detection model to detect zero-day attacks in unseen data using machine learning","volume":"19","author":"Z Dai","year":"2024","journal-title":"PLoS One"},{"key":"pone.0339822.ref026","doi-asserted-by":"crossref","first-page":"32863","DOI":"10.1109\/ACCESS.2025.3543127","article-title":"HIDS-IoMT: A Deep Learning-Based Intelligent Intrusion Detection System for the Internet of Medical Things","volume":"13","author":"A Berguiga","year":"2025","journal-title":"IEEE Access"},{"key":"pone.0339822.ref027","doi-asserted-by":"crossref","first-page":"38404","DOI":"10.1109\/ACCESS.2025.3545918","article-title":"HIDS-RPL: A Hybrid Deep Learning-Based Intrusion Detection System for RPL in Internet of Medical Things Network","volume":"13","author":"A Berguiga","year":"2025","journal-title":"IEEE Access"},{"key":"pone.0339822.ref028","doi-asserted-by":"crossref","first-page":"140","DOI":"10.1016\/j.procs.2025.03.315","article-title":"Advanced AI-Powered Intrusion Detection Systems in Cybersecurity Protocols for Network Protection","volume":"259","author":"HM Rai","year":"2025","journal-title":"Procedia Computer Science"},{"key":"pone.0339822.ref029","unstructured":"BOT-IOT dataset: https:\/\/ieee-dataport.org\/documents\/bot-iot-dataset"},{"key":"pone.0339822.ref030","unstructured":"CICIDS2017 dataset: https:\/\/www.unb.ca\/cic\/datasets\/ids-2017.html"},{"key":"pone.0339822.ref031","doi-asserted-by":"crossref","first-page":"207","DOI":"10.1007\/978-1-4899-7641-3_9","article-title":"Support vector machine","volume-title":"Machine Learning Models and Algorithms for Big Data Classification","author":"S Suthaharan","year":"2016"},{"issue":"1","key":"pone.0339822.ref032","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1023\/A:1007670802811","article-title":"Technical Note: Naive Bayes for Regression","volume":"41","author":"E Frank","year":"2000","journal-title":"Machine Learning"},{"issue":"11","key":"pone.0339822.ref033","article-title":"Comparison of the CatBoost classifier with other machine learning methods","volume":"11","author":"AA Ibrahim","year":"2020","journal-title":"Int J Adv Comput Sci Appl"},{"key":"pone.0339822.ref034","first-page":"359","article-title":"A new diverse AdaBoost classifier. In: 2010 International Conference on Artificial Intelligence and","author":"T-K An","year":"2010","journal-title":"Computational Intelligence"},{"issue":"2","key":"pone.0339822.ref035","first-page":"40","article-title":"Feature selection using a multilayer perceptron","volume":"2","author":"DW Ruck","year":"1990","journal-title":"J Neural Network Comput"},{"issue":"4","key":"pone.0339822.ref036","first-page":"569","article-title":"An improved CNN approach for network intrusion detection system","volume":"23","author":"J Hu","year":"2021","journal-title":"Int J Network Secur"},{"issue":"2","key":"pone.0339822.ref037","doi-asserted-by":"crossref","DOI":"10.1007\/s42979-021-00991-0","article-title":"Intrusion Detection System Based on RNN Classifier for Feature Reduction","volume":"3","author":"B Deore","year":"2021","journal-title":"SN COMPUT SCI"},{"issue":"13","key":"pone.0339822.ref038","doi-asserted-by":"crossref","first-page":"5381","DOI":"10.3390\/app14135381","article-title":"A Deep Learning Approach for Intrusion Detection Systems in Cloud Computing Environments","volume":"14","author":"WH Aljuaid","year":"2024","journal-title":"Applied Sciences"}],"container-title":["PLOS One"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0339822","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,29]],"date-time":"2025-12-29T18:45:34Z","timestamp":1767033934000},"score":1,"resource":{"primary":{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0339822"}},"subtitle":[],"editor":[{"given":"Gen","family":"Li","sequence":"first","affiliation":[],"role":[{"role":"editor","vocabulary":"crossref"}]}],"short-title":[],"issued":{"date-parts":[[2025,12,29]]},"references-count":38,"journal-issue":{"issue":"12","published-online":{"date-parts":[[2025,12,29]]}},"URL":"https:\/\/doi.org\/10.1371\/journal.pone.0339822","relation":{},"ISSN":["1932-6203"],"issn-type":[{"value":"1932-6203","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,12,29]]}}}