Enhancing the Artificial Rabbit Optimizer Using Fuzzy Rule Interpolation

Abstract

Metaheuristic optimization algorithms have demonstrated their effectiveness in solving complex optimization tasks, such as those related to Intrusion Detection Systems (IDSs). It was widely used to enhance the detection rate of various types of cyber attacks by reducing the feature space or tuning the model’s hyperparameters. The Artificial Rabbit Optimizer (ARO) mimics rabbits’ intelligent foraging and hiding behavior. The ARO algorithm has seen widespread adoption in the optimization field. The widespread use of the ARO algorithm occurs due to its simple design and ease of implementation. However, ARO can get trapped in local optima due to its limited diversity in population dynamics. Although the transition between phases is managed via an energy shrink factor, fine-tuning this balance remains challenging and unexplored. These limitations could limit the ARO algorithm’s effectiveness in high-dimensional space, as with IDS systems. This paper introduces a novel enhancement of the original ARO by integrating Fuzzy Rule Interpolation (FRI) to compute the energy factor during the optimization process dynamically. In this work, we integrate the FRI along with the ARO algorithm to improve solution accuracy, maintain population diversity, and accelerate convergence, particularly in high-dimensional and complex problems such as IDS. The integration of the FRI and ARO aimed to control the exploration-exploitation balance in the IDS application area. To validate our proposed hybrid approach, we tested it on a diverse set of intrusion datasets, covering eight different benchmark intrusion detection datasets. The suggested hybrid approach has been demonstrated to be effective in handling various intrusion classification tasks. For binary intrusion classification tasks, it achieved accuracy rates ranging from 96% to 99.9%. In the case of multiclass intrusion classification tasks, the accuracy was slightly more consistent, falling between 91.6% and 98.9%. The suggested approach effectively reduced the number of feature spaces, achieving reduction rates from 56% up to 96%. Furthermore, the proposed approach outperformed other state-of-the-art methods in terms of detection rate.

1. Introduction

Recently, the number of cyber attacks has been growing due to the shift to online services and the lack of suitable detection methods. Moreover, the intruders execute more sophisticated attacks. Thus, there is an urgent need for an effective Intrusion Detection System (IDS). Typical IDS systems suffered in detecting novel attack patterns due to the lack of informative attributes [1]. Recently, researchers have increasingly focused on machine learning (ML), deep learning (DL), and nature-inspired optimization techniques to enhance the detection rate of intrusion detection models [2].

The metaheuristic algorithms have demonstrated their effectiveness for solving complex and nonlinear optimization tasks. Many optimization algorithms were implemented in the IDS application area, either for feature selection or for parameter tuning. The Artificial Rabbit Optimizer (ARO), a recent addition to the family of nature-inspired algorithms, mimics the intelligent foraging and hiding behavior of rabbits in the wild [3].

The ARO algorithm has demonstrated competitive performance in various application areas, particularly in IDS systems. This is due to simple design, fast convergence, and ease of implementation. However, some literature, as discussed by Anka et al. in [4], highlights some limitations for the classical ARO, summarized as follows: In high-dimensional or complex search spaces, ARO can get trapped in local optima due to its limited diversity in population dynamics. Although the transition between phases is managed via an energy-shrink factor, fine-tuning this arrangement remains challenging in dynamic environments. These limitations could limit the ARO algorithm’s effectiveness in high-dimensional space, as with IDS systems. In response to this challenge, our work introduced a novel enhancement of the original ARO by integrating Fuzzy Rule Interpolation (FRI) to compute the energy factor during the optimization process dynamically.

In this work, we integrate the FRI along with the ARO algorithm to improve solution accuracy, maintain population diversity, and accelerate convergence, particularly in high-dimensional and complex problems such as IDS. The integration of the FRI and ARO aimed to control the exploration and exploitation balance in IDS, which represents a novel approach not extensively covered in the existing literature. The FRI inference engine targets the energy factor A of ARO, which has not been thoroughly investigated. FRI, especially beneficial when a complete rule base is unavailable, allows for smooth reasoning even in sparse conditions, making it an ideal fit for dynamic optimization problems where conditions change rapidly. This integration results in an intelligent variant of the algorithm, which we refer to as FRI-ARO.

FRI-ARO offers the adaptability and interpretability of fuzzy systems to guide the optimizer’s behavior without introducing excessive complexity. By representing the energy factor using fuzzy linguistic variables such as low, medium, and high and computing interpolated values based on the optimizer’s current state, the proposed FRI-ARO provides a more flexible adjustment process. This adaptation of the energy factor parameter controls a better balance between exploration and exploitation throughout the optimization process.

To validate the performance of the proposed FRI-ARO, we apply it to a classification problem within the context of intrusion detection. Particularly, we employ FRI-ARO to optimize the selection of features and classifier parameters for identifying malicious activities in network traffic. The effectiveness of an IDS not only depends on the choice of classifier but also heavily relies on the relevance and quality of selected features. By integrating the FRI reasoning engine into ARO’s search process, our approach is capable of intelligently navigating the feature space to identify high-quality subsets that improve detection accuracy while reducing redundancy. Moreover, the proposed FRI-ARO maintains the simplicity and computational efficiency of the original algorithm while improving its adaptability and robustness. The purpose of this combination (ARO + FRI) lies in their complementary strengths. Together, they generate a hybrid system that can adaptively learn from the environment and adjust its strategies—an essential IDS application area capability.

The main contribution of this work is to address the issues of using a pre-defined (fixed) energy factor parameter in the Artificial Rabbit Optimizer (ARO). The energy factor parameter in the ARO algorithm is considered an important parameter for controlling the exploration and exploitation mechanisms. However, in some optimization tasks, its computation may not adapt well to different optimization landscapes. To overcome this limitation, this paper introduces a Fuzzy Rule Interpolation (FRI) mechanism to dynamically infer the energy factor based on the current search state.

In summary, the contributions of this paper are fourfold.

• First, we introduce a fuzzy rule interpolation mechanism to compute the energy factor of ARO dynamically, resulting in an intelligent and adaptive optimization algorithm.
• Second, we design a multi-objective fitness function that jointly optimizes two critical aspects: maximizing classification accuracy and minimizing the number of selected features.
• Third, we apply enhanced ARO to the classification task in intrusion detection, addressing both feature selection and model optimization.
• Fourth, we provide comprehensive experimental validation demonstrating that FRI-ARO achieves improved classification performance over baseline methods.

The remainder of this paper is organized as follows: Section 2 provides a review of recent related works in fuzzy optimization, ARO, and intrusion detection. Section 3 details the methodology behind the proposed FRI-ARO, including its fuzzy system design and integration strategy. Section 4 presents and discusses the experimental setup, datasets, and results. Section 5 concludes the paper and provides future research directions.

2. Related Work

2.1. Fuzzy System in Intrusion Detection Systems

The fuzzy system remains a suitable technique for handling uncertainty and ambiguity in the Intrusion Detection System (IDS) application area. The fuzzy system offered gradual transitions between normal and malicious behavior by modeling membership values rather than binary decisions. For example, Qiu et al. in [5] suggested a combination of fuzzy systems and Convolutional Neural Network (CNN) ensemble for the sake of detecting Internet of Things (IoT) attacks. The suggested combination of fuzzy systems consisted of two steps; the first step was performing the network decomposition, and the second step was clustering the decomposition results and assigning each observation to the nearest subnet. The authors performed backward elimination as feature selection to reduce the dimension space. The suggested method achieved acceptable results in terms of accuracy.

Heidari et al. in [6] proposed a hybrid technique that integrates the fuzzy system and Particle Swarm Optimization (PSO) algorithm. The PSO algorithm was utilized to perform the optimization task. The suggested model was evaluated using the KDD-99 intrusion dataset. The results showed the ability of the suggested approach to detect various types of attacks within the KDD-99 within a very short time. Sharma et al. in [7] proposed a detection model using ANFIS. The suggested detection model was adapted to work as a classifier to detect various types of attacks. The authors investigated different membership function shapes, such as triangular, Gaussian, and sigmoidal functions. According to the KDD99 dataset, the Gaussian shape was a suitable shape function for detecting different types of attacks within the KDD99 dataset.

From another perspective, Subramani and Selvi in [8] investigated the strength of metaheuristic optimization algorithms (ant colony optimization) and fuzzy systems. The authors propose a model able to secure routing in wireless networks. The ant colony optimizer was used to discover the route along with fuzzy systems. Moreover, the suggested model was implemented as a detection mechanism against different attacks within the NSL-KDD dataset. The results demonstrated the strength of this combination between fuzzy systems and ant colony optimization for securing wireless networks. In addition, Almseidin et al. in [1] proposed a threefold fuzzy approach for handling phishing attacks. The suggested fuzzy approach adopted fuzzy rule interpolation instead of classical reasoning methods. The suggested fuzzy approach was initiated by establishing the required neighboring fuzzy rules. The suggested fuzzy detection approach offered the ability to interpolate the results using a few fuzzy rules. The suggested model was evaluated using three phishing attack datasets and demonstrated its effectiveness for handling various attack scenarios.

Recent studies showed the continued relevance of fuzzy systems in the design of IDS. By modeling uncertainty using membership functions and utilizing human-interpretable rules, fuzzy systems contribute both to improved detection performance and enhanced system transparency. This capability is particularly valuable in complex or ambiguous network environments where crisp boundaries between normal and malicious behavior are difficult to define. The ability of fuzzy systems to handle imprecise input data while offering explainable decision-making processes has been validated across multiple applications and datasets.

2.2. Artificial Rabbit Optimizer in Intrusion Detection

The Artificial Rabbit Optimizer (ARO) is a recent bio-inspired metaheuristic that has attracted attention for IDS applications [3]. ARO simulates rabbit foraging behaviors (exploration and hiding) to search for optimal solutions. In the IDS domain, ARO has been used primarily for feature selection and hyperparameter tuning [9].

Another application of the ARO algorithm was to explore its potential in reducing the dimension space as well as securing smart healthcare environments. Patni and Lee in [10] integrate the ARO algorithm along with a deep extreme learning machine for detecting different types of attacks in a smart health environment. The ARO algorithm was established to tune the hyperparameters of a deep extreme learning machine. The Cleveland heart dataset, which includes 303 samples along with 76 features, was used to evaluate the suggested model. The results demonstrated the suggested model’s effectiveness for detecting various types of attacks. From another perspective, Almseidin et al. in [9] adapted the ARO algorithm as wrapper feature selection along with the decision tree for detecting various IoT attacks. The authors adapted the encoded technique to select only the relevant features within the IoT environment. The N-BaIoT benchmark datasets were used to evaluate the suggested detection approach. Moreover, the suggested ARO-based wrapper technique was compared with other metaheuristic algorithms. The results showed that the suggested detection approach was able to effectively reduce the dimension space as well as enhance the detection rate.

Shahba et al. in [11] explored the strength of the ARO algorithm for the sake of enhancing the detection of fake news and phishing attacks. The authors utilized the ARO algorithm as a feature selection technique. This step aimed to keep only the relevant features that affect phishing attacks and fake news. The authors employed three machine learning algorithms (multilayer perceptron, random forest, and XGBoost). UCI and Tan datasets were used to evaluate the classification models-based ARO. The suggested ARO feature selection technique effectively enhanced the accuracy rate for the classification model.

In addition, Hamdipour et al. [12] examined the effects of dimensionality reduction and its potential to improve classification models. The authors integrated the DBSCAN algorithm along with the ARO algorithm for reducing the dimension space. The DBSCAN algorithm was used to avoid the issue related to the local optima. The proposed model was tested and evaluated using UCI benchmark datasets. The results demonstrated the effectiveness of the proposed model for reducing the dimension space as well as enhancing the classification process.

Furthermore, Mahesh and Tallapally [13] studied the Software-Defined Networking (SDN) and the impact of intrusions on its infrastructure. The proposed framework started by handling the missing values, normalization, and data skewness correction. The binary version of the ARO algorithm was applied for the sake of feature selection and dimensionality reduction. Furthermore, the PSO algorithm was used to optimize the required hyperparameters for the deep networks. The InSDN, ToN-IoT, and IoT-23 datasets were used to evaluate the suggested framework. The results highlighted the efficacy of the suggested framework for reducing the dimension space as well as enhancing the detection rate.

2.3. Hybrid Approaches Combining Metaheuristics Algorithms

Recent studies in Intrusion Detection Systems (IDS) frequently combine fuzzy logic with machine learning or deep learning methods, as well as optimization techniques, to take advantage of their complementary capabilities.

Souza and Sayyadzadeh in [14] combined the Gray Wolf Optimizer (GWO) along with the fuzzy neural network. The mutual information was used to initialize the weights of the input layer, while the GWO optimizer was used to fine-tune the consequent parts of fuzzy rules. This combination of a metaheuristic algorithm and a fuzzy system produced an effective classification model. The suggested model was evaluated using binary classification datasets. The results reported the effectiveness of the suggested model for solving the required classification tasks. From another perspective, Logeswar et al. in [15] introduced a hybrid feature selection technique that leverages the ANFIS fuzzy engine along with the Quantum-Inspired Particle Swarm Optimization (QIPSO) algorithm. This integration aimed to enhance the intrusion detection within the IoT environment. The relevant features that were selected by the hybrid technique were forwarded to the multi-stage classification engine built on capsule networks. The suggested model was evaluated using TON-IoT and BOT-IoT datasets. The results demonstrated the efficiency of the suggested hybrid framework.

Furthermore, Madhuridevi and Lakshmi in [16] proposed a detection model based on deep learning integrated with the elephant clan optimizer. The initial step of the proposed model was to scale the input parameters using the min-max technique. Moreover, the flow features were forwarded to the structured deep architecture. The deep neural network was optimized using the elephant clan optimizer. The IDS 2018 intrusion dataset was used to evaluate the proposed model. The results showed the model’s robustness for detecting the studied attacks within the IDS 2018 intrusion dataset.

Zhang et al. in [17] introduced a hybrid feature selection technique based on meta-heuristic optimization algorithms. The authors integrated the crow search algorithm and flower pollination algorithm for the sake of avoiding the local optima as well as speeding up the convergence rates. Moreover, the suggested feature selection technique aimed to balance the efficiencies between the global search and local search. The UNSW-NB15 and CIC-IDS2017 datasets were used to show the capability of the proposed hybrid feature selection technique. The results reported the effectiveness of the suggested hybrid technique to reduce the dimension space.

Maazalahi and Hosseini in [18] proposed a hybrid feature selection technique for the sake of intrusion detection. The hybrid feature technique included three phases. The three phases included the preprocessing, feature ranking, and detection engine. Through the preprocessing step, normalization and outlier removal were adapted. Sailfish optimizer and whale optimization algorithms were combined for the sake of selecting only the relevant features. The detection engine was adapted using K-nearest neighbors. The BOT-IOT and UNSW-NB15 datasets were used to demonstrate the effectiveness of the proposed hybrid technique. The accomplished results showed its ability to reduce the dimension space and detect various types of intrusions. Table 1 summarized the previous related works studies.

Table 1. Comparative Summary of related studies.

Author(s)	Year	Method	Dataset(s)	Limitation(s)
Qiu et al. [5]	2025	Fuzzy system + CNN ensemble	IoT attack datasets	High computational complexity and dependence on deep learning models
Heidari et al. [6]	2025	Fuzzy system + PSO	KDD-99	Requires parameter tuning and fixed optimization strategy
Sharma et al. [7]	2025	ANFIS-based IDS	KDD-99	Sensitive to membership function selection and rule design
Subramani and Selvi [8]	2024	Fuzzy system + Ant Colony Optimization	NSL-KDD	Performance depends on predefined fuzzy rules
Almseidin et al. [1]	2024	Fuzzy Rule Interpolation-based IDS	Phishing datasets	Not integrated with metaheuristic optimization algorithms
Patni and Lee [10]	2024	ARO + Deep Extreme Learning Machine	Cleveland Heart Dataset	Focuses on hyperparameter tuning rather than adaptive search control
Almseidin et al. [9]	2024	ARO-based wrapper feature selection + DT	N-BaIoT	Uses static parameter settings for exploration and exploitation

2.4. Discussion and Motivation for Modifying the ARO Algorithm

The Artificial Rabbit Optimization (ARO) algorithm was introduced in 2022 [3]. The ARO algorithm could be a suitable framework for solving various optimization problems. The ARO algorithm is employed in various fields for solving optimization tasks due to its simple design, fast convergence, and ease of implementation. However, there are some limitations of the classical ARO algorithm as discussed by Anka et al. in [4], summarized as follows:

• Premature convergence: The issues related to the limited diversity in population could lead to suffering from local optima in large-scale datasets.
• Exploration-exploitation imbalance: Although the shift between phases is controlled via an energy-shrink factor, adjusting this balance remains challenging in dynamic environments.
• Performance variability: In several benchmark and engineering tasks, ARO often ranked second or lower when compared to its hybridized versions (e.g., GBO-ARO, ABC-ARO, or AO-ARO).

Furthermore, statistical insights presented in the comprehensive review about advances in the ARO algorithm introduced by Anka et al. [4] in 2024 show that approximately 31% of ARO-related studies focused on improving the algorithm, highlighting a clear research need for enhancement strategies. Moreover, the previous literature highlights the effectiveness of both fuzzy systems and ARO in enhancing intrusion detection systems. However, the specific integration of fuzzy systems into ARO to dynamically control exploration and exploitation parameters remains underexplored. Given these findings, our work seeks to enhance the classical ARO algorithm by addressing the above limitations through the integration of the Fuzzy Rule Interpolation (FRI). In this work, we integrate the FRI along with the ARO algorithm to improve solution accuracy, maintain population diversity, and accelerate convergence, particularly in high-dimensional and complex problems such as IDS. The integration of the FRI and ARO aimed to control the exploration and exploitation balance in IDS, which represents a novel approach not extensively covered in existing literature. The FRI inference engine targets the energy factor A of ARO, which has not been thoroughly investigated.

The proposed FRI-ARO approach introduces several distinctive features compared to earlier studies, summarized as follows:

• Integration of FRI into ARO: The proposed method introduces a novel hybrid approach (FRI-ARO) by incorporating an FRI inference engine into the ARO algorithm. This integration dynamically adjusts the energy factor A, which controls the balance between exploration and exploitation phases. Contrary to traditional ARO variants that rely on linearly decaying strategies, this fuzzy adaptation enables the algorithm to respond more intelligently to population diversity and iteration progress.
• A Multi-objective Fitness Function: In this work, we design a multi-objective fitness function that maximizes classification accuracy and minimizes the number of selected features.
• Comprehensive Analysis of Large-Scale Intrusion Detection System Datasets: The proposed FRI-ARO method was evaluated on eight intrusion detection datasets. These datasets cover a wide range of intrusions, including Denial of Service (DoS), phishing attacks, and various IoT attack scenarios.
• Use of Simple Classifier for Evaluation: The decision tree algorithm was used to assess the performance of the selected subset features within a 5-fold cross-validation.

3. The Proposed Hybrid FRI-ARO Strategy

This section introduces a novel hybrid approach that integrates the ARO with the FRI for the sake of feature selection and dimensionality reduction. The main idea behind this integration is to enhance the adaptability of the ARO algorithm by allowing it to dynamically adjust its key control parameter (the energy factor A). This dynamic adjustment, paired with a carefully designed multi-objective fitness function, allows the proposed approach to maintain high classification accuracy while reducing the number of selected features.

The original ARO algorithm [3] is a recent metaheuristic inspired by the natural behaviors of rabbits in the wild, particularly their strategies for escaping predators. These behaviors are modeled through two main phases in the algorithm: exploration, where rabbits move through wide areas to search for food, and exploitation, where they hide and protect themselves in specific areas (burrows). The core idea behind ARO is to balance these two phases using an adaptive parameter called the energy factor A. When $A>1$, the algorithm emphasizes exploration, it chooses random individuals to generate new solutions. When $A\le 1$, it focuses on exploitation by refining the best solutions found so far. Each solution (or “rabbit”) is represented as a position vector in the search space. During each iteration, mathematical operations are applied to simulate rabbit behavior, such as running (controlled by a random length L) and hiding. The main steps of the original ARO are summarized as follows:

3.1. Main Steps of the Original ARO Algorithm

• Initialize the population of solutions randomly within the defined search bounds.
• Evaluate the fitness of each solution using the target benchmark function.
• Determine the best solution found so far.
• For each iteration:

  (a)

  

  (b)

  If $A>1$, perform exploration:

  • Select a random solution and move in its direction, modified by a random step length L and noise.

  (c)

  If $A\le 1$, perform exploitation:

  • Modify the current solution using directional vectors and Gaussian noise to simulate hiding behavior.

  (d)

  Apply boundary control to ensure the new solution remains within the search space.

  (e)

  Evaluate the new fitness and update the solution if improved.

• Record the best fitness found at each iteration.

The FRI inference engine is well-suited for addressing uncertainty and ambiguity, particularly in cases where complete rule bases are difficult to construct. One of the main reasons for selecting FRI over traditional reasoning methods, such as the Mamdani inference system, is its ability to operate effectively even when only a limited number of fuzzy rules are available. Unlike classical approaches requiring a fully populated rule base to work correctly, FRI can interpolate missing rules and produce meaningful and consistent outputs. In the context of this work, FRI is utilized to generate the energy factor dynamically in the ARO algorithm, using a minimal set of fuzzy rules, while nevertheless maintaining the interpretability and adaptability needed for complex optimization tasks.

These components ensure that the fuzzy reasoning process can adaptively guide the exploration and exploitation behavior of ARO based on current optimization conditions. They are outlined as follows:

• Define the input parameters: The first step involves selecting and setting up the relevant input variables that influence the dynamic behavior of the energy factor. In this work, the inputs are chosen as the optimization stage and the solution variability, which together reflect the progress of the optimization process and the variability within the population.
  Design membership functions and fuzzy rule base: Each input and output variable had linguistic values such as Low, Mid, and High. Additionally, a concise set of fuzzy rules is constructed to describe how combinations of input conditions affect the output energy factor. FRI is particularly effective here, as it can operate reliably even when the rule base is sparse.
  Apply the FRI inference mechanism: Once the inputs and rules are defined, the FRI engine is used to interpolate the fuzzy rules and infer an appropriate output value for A. This enables the system to handle missing or incomplete rule coverage while still producing valid reasoning outcomes.
  Integrate the output with ARO: The defuzzified result from the FRI (the computed energy factor A) is fed directly into the ARO algorithm at each iteration. This allows ARO to dynamically adjust its behavior based on real-time feedback, improving its ability to balance global exploration and local exploitation.

3.2. Fuzzy Inputs for Dynamic Energy Control in FRI-ARO

In the proposed FRI-ARO, the energy factor A, which controls the balance between exploration and exploitation, is not statically defined. Instead, it is dynamically adjusted at each iteration using a linear FRI inference engine. The FRI inference engine had two inputs: optimization stage and solution variability. These inputs were chosen because they offer the required feedback about the status of the optimization process.

The optimization stage input represents the relative progress of the algorithm across its iterations. It is calculated as the ratio between the current iteration number and the maximum number of iterations:

$$\mathrm{OptimizationStage}={\displaystyle \frac{It}{MaxIt}}$$

(1)

where: $It$ is the current iteration number, $MaxIt$ is the total number of iterations.

The ratio starts at 0 and gradually increases to 1 as the algorithm moves forward. At the beginning, the algorithm leans more toward exploration, while in the later stages, it naturally shifts its focus to exploitation. This input helps the FRI inference engine tune the energy factor A based on where the algorithm is in its progress. In addition, the solution variability input measures the degree of diversity within the current population. It is computed using the standard deviation of all values in the binary population matrix and then normalized to ensure it remains within the [0, 1] range.

$$\mathrm{SolutionVariability}=min\left(max\left(\mathrm{std}\left(\mathrm{PopPos}\right(:\left)\right),0\right),1\right)$$

(2)

This value reflects how different the candidate solutions are from one another. Higher values indicate more diverse solutions (which encourages continued exploration), while lower values suggest convergence, triggering more exploitation-focused behavior. Consequently, using these two input parameters, the FRI inference engine controls the energy factor A whether searching new areas or refining existing solutions.

3.3. Fuzzy Sets and Fuzzy Rule Generations

The FRI-ARO algorithm had two inputs, optimization stage and solution variability, and a single output, the adaptive energy value A. The inputs and the output variable are associated with three triangular membership functions representing linguistic terms: low, mid, and high. These fuzzy sets enable the FRI-ARO to map continuous values into linguistic categories. The triangular membership functions were used for the sake of simplicity. Table 2 summarizes the membership function values for each fuzzy input. Figure 1 visualizes the suggested membership function for the FRI-ARO algorithm.

Table 2. Triangular membership function definitions of FRI-ARO.

Input/Output	Linguistic Term	Triangular MF Range
Optimization Stage	Low	[0, 0.2, 0.3]
	Mid	[0.4, 0.5, 0.6]
	High	[0.7, 0.9, 1]
Solution Variability	Low	[0, 0.3, 0.4]
	Mid	[0.5, 0.6, 0.8]
	High	[0.9, 0.9, 1]
Energy Factor	Low	[0, 0.5, 0.9]
	Mid	[1.2, 1.4, 1.6]
	High	[1.8, 1.9, 2]

Figure 1. Triangular Membership Functions for FRI-ARO.

Figure 2 presents the antecedent input space of the FRI based on the optimization stage and solution variability variables. The two input variables, optimization stage and solution variability, form a 2D domain, while the vertical axis shows the degree of membership associated with different rules.

Figure 2. The Antecedent Input Space of the FRI System.

The design of membership functions ensures that both early- and late-stage optimization behaviors, as well as the diversity among candidate solutions, are considered when generating the energy factor. Furthermore, the fuzzy rules were designed to keep only the most critical cases, keeping the fuzzy rules minimal and focused. Specifically, the utilized fuzzy rules are generated to to capture general relationships between the optimizer’s search behavior and the required adjustment of the energy factor. Due to the strength of FRI the dense/complete fuzzy rules is not required.

This design works well with the FRI inference engine, which can effectively interpolate and generate outputs even when only a few fuzzy rules are available. Each rule follows a simple format: If the optimization stage is X and solution variability is Y, then A is Z    $\stackrel{\mathrm{Conclusion}}{\to }$    $A=Z$.

This structure keeps the rule base compact and interpretable while still offering dynamic control of the output. The suggested fuzzy rules are shown in Table 3. Figure 3 presents the dynamic energy factor adjustment process flow with FRI and ARO.

Table 3. Suggested fuzzy rules for controlling the energy factor A in FRI-ARO.

Optimization Stage	Solution Variability	Output $\mathit{A}$
Low	High	High
Low	Low	Mid
Mid	Mid	Mid
High	High	Mid
High	Low	Low

Figure 3. Process Flow for Dynamic Energy Factor Adjustment with FRI and ARO.

In this work, we design a multi-objective fitness function that balances two targets: maximizing classification accuracy and minimizing the number of selected features. This dual-use objective is fundamental in feature selection tasks, where using fewer features reduces computational cost and improves generalization and interpretability.

The fitness function is defined as follows:

$$\mathrm{Fitness}=\underset{\mathrm{Classification} \mathrm{error}}{\underbrace{\alpha ·(1-\mathrm{Accuracy})}}+\underset{\mathrm{Feature} \mathrm{reduction} \mathrm{penalty}}{\underbrace{\beta ·\mathrm{Reduction}}}$$

(3)

where:

• Accuracy is the average classification accuracy obtained using the selected subset of features.
• $\mathrm{Reduction}={\displaystyle \frac{\left|\mathrm{Selected}\mathrm{Attributes}\right|}{\left|\mathrm{Total}\mathrm{Attributes}\right|}}$ quantifies the proportion of features selected, serving as a measure of dimensionality.
• $\alpha$ and $\beta$ are weights such that $\alpha +\beta =1$, used to balance the trade-off between accuracy and reduction. In our case, we use $\alpha =0.9$ and $\beta =0.1$, giving higher importance to accuracy.

By integrating the accuracy and feature reduction as a single metric, the fitness function aimed to introduce a solution that is both accurate and compact while avoiding including unnecessary features. Furthermore, parameters $\alpha$$\beta$ offer fine-tuning of the objective function based on the specific goals of the task. For instance, setting $\alpha =0.9$ prioritizes classification performance while penalizing high feature counts. Moreover, each component of the fitness function is normalized to be between 0 and 1, making the objective scale-independent and suitable for use in a wide range of metaheuristic optimization tasks. Algorithm 1 introduced the suggested hybrid FRI-ARO algorithm. Figure 4 presents the dynamic energy factor adjustment flow process.

Algorithm 1 FRI-ARO Algorithm

1: Initialize population P with n rabbits (binary vectors) 2: for each rabbit i do 3:       Evaluate fitness $f\left(P_i\right)$ 4: end for 5: Determine the best solution $BestX$ 6: Load FRI inference system (FIS) to control energy variable A 7: for iteration = 1 to MaxIt do 8:       $\theta \leftarrow 2(1-{\displaystyle \frac{iteration}{MaxIt}})$ 9:       Compute $Optimizationstage={\displaystyle \frac{iteration}{MaxIt}}$ 10:     Compute $SolutionVariability=\mathrm{std}\left(P\right)$ normalized to [0, 1] 11:     Compute energy variable $A=\mathrm{FIS}(Optimizationstage,SolutionVariability)$ 12:     for each rabbit i do 13:           Compute random step size L 14:           Generate direction mask R 15:           if $A>1$ then                                                                            ▹ Exploration 16:                Select random rabbit $j\ne i$ 17:                $P_{\mathrm{new}}\leftarrow P_j+R·(P_i-P_j)$ 18:           else                                                                                         ▹ Exploitation 19:                Compute hiding direction using Gaussian noise 20:                $b\leftarrow P_i+H·\mathrm{mask}·P_i$ 21:                $P_{\mathrm{new}}\leftarrow P_i+R·(\mathrm{rand}·b-P_i)$ 22:           end if 23:           Binarize $P_{\mathrm{new}}$ using sigmoid and threshold 24:           Evaluate new fitness 25:           if improved then 26:                Update solution $P_i$ 27:           end if 28:     end for 29:     Record best fitness for this iteration 30: end for

Figure 4. FRI-ARO Algorithm Cycle.

It is worth noting that feature selection is considered a binary optimization task. Therefore, each candidate solution generated by the proposed FRI-ARO algorithm is represented as a binary feature mask. During the optimization process, the continuous position values produced by ARO are converted into binary values before evaluating the fitness of a solution. In this encoding scheme, a value of 1 indicates that the corresponding feature is selected, whereas a value of 0 denotes that the feature is not selected.

In addition, the computational complexity analysis of the suggested FRI-ARO is determined by the population size, the number of iterations, and the cost of fitness evaluation. Let assume N indicate the population size, T the maximum number of iterations, and D the number of features. In each iteration, the algorithm updates the positions of all individuals and evaluates their fitness, resulting in a complexity of $O(N\times D)$ for position updates.

4. Experiments and Results

This section presents the experimental results obtained using the proposed FRI-ARO algorithm. To comprehensively assess its feature reduction capability, we evaluated the suggested FRI-ARO algorithm using a wide range of real-world cybersecurity datasets.

We began by evaluating the feature selection performance of FRI-ARO using a diverse set of cybersecurity datasets. These datasets cover a wide range of intrusions, including Denial of Service (DoS), phishing attacks, and various IoT attack scenarios. The utilized datasets include CIC IoT 2023 [19], UNSW-NB15 [20], MSCAD [21], CIC IDS 2017 [22], NSL-KDD [23], Phishing URL [24], Phishing Detection [25] and ToN IoT [26]. These datasets vary significantly in terms of feature dimensionality and number of records, which helps to validate the proposed FRI-ARO algorithm across wide intrusion datasets as well as different data distributions. A summary of these datasets is provided in Table 4.

Table 4. Summary of Benchmark Datasets Used for Evaluation.

Dataset	# Features	# Instances	Category
CIC IoT 2023	46	238,687	IoT-based Attacks
ToN IoT	124	21,105	IoT-based Attacks
UNSW-NB15	76	447,916	Hybrid/Synthetic Attacks
MSCAD	66	131,258	Hybrid/Synthetic Attacks
CIC IDS 2017	78	225,746	Traditional IDS Benchmarks
NSL-KDD	38	25,139	Traditional IDS Benchmarks
Phishing URL	79	15,368	Specialized Cyber Attacks
Phishing Detection	48	10,000	Specialized Cyber Attacks

All experiments were carried out on a system powered by an AMD Ryzen 7 5800U processor with 16 threads and 8 GB of RAM. To evaluate the effectiveness of the proposed FRI-ARO algorithm in reducing the dimensionality of the data and identifying the most informative features, we used the decision tree algorithm as a benchmark algorithm. Table 5 summarizes the main parameters that are used for evaluating the suggested FRI-ARO approach.

Table 5. Parameter Values Used in FRI-ARO Algorithm.

Parameter	Value
Population size	30
Maximum number of iterations	100
Problem dimensionality	Dataset-dependent
Search space bounds	Dataset-dependent
Number of fuzzy input variables	2
Number of membership functions	3 (Low, Mid, High)

At the initial stage and before training the suggested FRI-ARO algorithm, standard preprocessing steps were applied, and that include handling missing values and feature normalization. Moreover, a 5-fold cross-validation strategy was adopted. Feature selection using the proposed FRI-ARO algorithm is performed exclusively on the training data within each fold. The selected feature subset is then applied to the corresponding test fold for classification.

4.1. Evaluation on Binary Classification Intrusion Datasets

The initial phase of evaluating the suggested FRI-ARO approach was conducted using the MSCAD and ToN IoT datasets. Figure 5 presents the achieved results for the MSCAD and ToN IoT datasets using the FRI-ARO algorithm.

Figure 5. Performance of the suggested FRI-ARO algorithm on two benchmark datasets. Left column: MSCAD dataset results. Right column: ToN IoT dataset results.

The results of Figure 5 for the MSCAD dataset demonstrated the effectiveness and efficiency of the suggested FRI-ARO algorithm. From the original 66 features, the FRI-ARO chose only 7 features. The chosen 7 features achieved a high accuracy of 99.73%. This result highlights the ability of the suggested FRI-ARO to reduce the dimension space and select the informative features. Moreover, with a fitness value of 0.0128 and a runtime of approximately 2168 s, the suggested FRI-ARO algorithm shows a balanced trade-off between computational cost and optimal feature reduction. The selected features (e.g., 8, 19, 20, etc.) reflect the approach’s focus on the most relevant dimensions of the data. In addition, using the ToN IoT dataset, the suggested FRI-ARO approach achieved a perfect detection rate performance, where the accuracy was 100%. From the original 123 features, the FRI-ARO selected 14 highly informative ones. The lower fitness value of 0.0114 compared to the MSCAD case suggests even better optimization.

Figure 6 presents the accomplished results for the FRI-ARO algorithm using the CIC-IDS 2017 and phishing URL datasets. Regarding the CIC-IDS 2017 dataset, the FRI-ARO algorithm shows high ability for feature reduction, where only 3 features out of 78 are selected, while maintaining a good classification rate of 99.04%. The precision of 98.47%, recall of 99.79%, and an F1-score of 99.12% demonstrate the capability of the suggested FRI-ARO for reducing the dimension space as well as maintaining a higher accuracy rate. Moreover, the fitness value scored 0.0128, indicating a well-optimized balance between feature count and classification performance. Similarly, for the phishing URL dataset, FRI-ARO selected 13 informative features out of 79, achieving an accuracy of 96.98%. The suggested FRI-ARO also kept performance across other evaluation metrics: precision (96.88%), recall (97.01%), and F1-score (96.95%). While slightly lower than the CICIDS2017 results, this performance is still highly effective, particularly given the nature of phishing detection tasks. The higher fitness value of 0.0424 suggests more room for optimization.

Figure 6. Performance of the Suggested FRI-ARO Algorithm on Two Benchmark Datasets. Left Column: CIC-IDS 2017 Dataset Results. Right Column: Phishing URL dataset results.

Figure 7 presents the performance of the suggested FRI-ARO based on phishing detection and NSL-KDD datasets. The results of NSL-KDD demonstrate the effectiveness of the FRI-ARO, where 3 features were selected out of 38 features. This is further supported by high values in precision (98.16%), recall (98.30%), and F1-score (98.23%), indicating that the algorithm is both highly reliable and well-balanced. The fitness score of 0.0220 reflects the algorithm’s ability to optimize performance while minimizing feature count. On the other hand, the phishing detection dataset required a larger subset of features—21 out of 48—to reach an accuracy of 96.00%, with a fitness value of 0.0756. While this is slightly lower than the KDD results in terms of accuracy.

Figure 7. Performance of the Suggested FRI-ARO Algorithm on Two Benchmark Datasets. Left Column: Phishing Detection Dataset Results. Right Column: NSL-KDD Dataset Results.

4.2. Evaluation on Multiclass Intrusion Datasets

It could be concluded that the efficiency of the suggested FRI-ARO algorithm is demonstrated for the previous intrusion datasets. It effectively reduced the dimension space while maintaining the performance of the detection rate. The previous intrusion datasets had comparatively large feature spaces, with some exceeding 70 or even 100 features. Hence, this confirms the effectiveness of FRI-ARO in handling binary classification problems with extensive feature sets, offering both dimensionality reduction and interpretability without compromising predictive performance.

However, to further validate the robustness and generalizability of the suggested FRI-ARO, it is important to evaluate it on more challenging scenarios. Specifically, to evaluate FRI-ARO on a multiclass classification problem without applying any imbalance-handling techniques. This approach will allow us to assess the algorithm’s standalone capabilities in a complex, unbalanced setting. By eliminating external balancing methods, we aim to observe how well FRI-ARO can adapt and maintain accuracy when dealing with more diverse class distributions. Figure 8 presents the results of the suggested FRI-ARO using multiclass intrusion datasets (UNSW-NB15 and CIC IoT 2023).

Figure 8. Performance of the Suggested FRI-ARO Algorithm on Two Benchmark Datasets. Left Column: CIC-IoT 2023 Dataset Results. Right Column: UNSW-NB15 Dataset Results.

The results in Figure 8 highlighted the effectiveness of the suggested FRI-ARO in the case of multi-class classification tasks. Regarding the CIC IoT 2023 dataset, the suggested FRI-ARO can achieve an accuracy of 98.99% using only 4 features out of 46, representing a significant dimensionality reduction of over 91%. Moreover, the suggested FRI-ARO maintained performance with a precision of 99.74%, recall of 100%, and an F1-score of 99.87%, indicating that the selected features effectively preserved the discriminatory power needed for accurate predictions. The fitness value of 0.0180 suggests a well-optimized balance between accuracy and feature minimization. In terms of the UNSW-NB15 dataset, which presents a more complex and diverse set of attack categories, the FRI-ARO algorithm still showed promising results. It selected 7 features out of 76, achieving an accuracy of 91.86% and a fitness value of 0.0813. While slightly lower than the CIC IoT 2023 dataset, this performance is still commendable, especially given the challenging nature of the UNSW-NB15 dataset and the absence of any balancing techniques.

4.3. Performance Metrics: Accuracy, Time, and Dimensionality Reduction

Consequently, the accomplished results demonstrated the robustness and effectiveness of the suggested FRI-ARO algorithm, where the FRI inference engine successfully controls the energy factor A, which offers more balancing in exploitation and exploration mechanisms. This achievement was validated through an extensive evaluation procedure on high-dimensional intrusion detection datasets, covering both binary and multi-class classification tasks. Table 6 summarizes the obtained results for the utilized intrusion datasets in terms of time, accuracy, and best fitness values. In addition, Figure 9 illustrates the dimensionality reduction score for each dataset using the suggested FRI-ARO algorithm. Table 7 presents the accomplished results in terms of precision, recall and F1 score.

Table 6. FRI-ARO Feature Selection Results across Multiple Datasets.

Dataset	Accuracy (%)	Fitness	Time (s)
MSCAD	99.73	0.0128	2168.43
Phishing Detection	96.00	0.0756	258,040.31
PhishingURL	96.98	0.0424	654,944.71
NSL-KDD	98.35	0.0220	655,835.64
CICIDS2017	99.04	0.0128	665,009.41
ToN IoT	100.00	0.0114	355,835.21
CIC IoT 2023	98.99	0.0180	12,545.77
UNSW-NB15	91.96	0.0813	9794.09

Figure 9. The Dimensionality Reduction Score for Each Dataset.

Table 7. Performance Comparison of The Proposed FRI-ARO.

Dataset	Precision	Recall	F1-Score
MSCAD	0.9941	0.9955	0.9948
ToN IoT	1.0000	1.0000	1.0000
CIC-IDS-2017	0.9797	0.9972	0.9883
Phishing URL	0.9696	0.9708	0.9702
Phishing Detection	0.9473	0.9720	0.9595
NSL-KDD	0.9808	0.9852	0.9830

From another perspective, Table 8 presents the number of selected features for each dataset along with the indices of the selected features. It is worth noting that the suggested FRI-ARO algorithm is stochastic in nature that mean it may select slightly different feature subsets across different runs or different iterations. However, the selected features consistently reflect meaningful characteristics of intrusion detection.

Table 8. Selected Features Index.

Dataset	Selected/Total	Selected Feature Index
CIC IoT 2023	4/46	[18, 20, 30, 40]
CICIDS2017	3/78	[5, 45, 76]
NSL-KDD	3/38	[2, 23, 34]
MSCAD	7/66	[8, 19, 20, 29, 33, 46, 53]
Phishing-URL	13/79	[2, 13, 20, 26, 29, 41, 44, 49, 60, 61, 63, 67, 70]
TON_IoT	14/123	[6, 7, 25, 27, 31, 33, 38, 42, 45, 52, 58, 86, 117, 121]
UNSW-NB15	7/76	[38, 40, 47, 51, 70, 71, 76]

4.4. Comparison with State-of-the-Art Methods

One of the main differences between FRI-ARO and the original ARO is the integration of the FRI inference engine, which provides an adaptive way to control the energy factor in order to effectively balance the exploration and exploitation mechanisms. To validate the advantages of the proposed FRI-ARO, it is important to benchmark it against the original ARO. Table 9 compares the suggested FRI-ARO and the original ARO algorithm in various aspects such as code complexity, system type, etc.

Table 9. Comparison of Original ARO and FRI-ARO.

Aspect	Original ARO	FRI-ARO
Energy Factor (A) Calculation	Fixed formula	Dynamically calculated using a Mamdani FIS based on Iteration Ratio and Diversity
Adaptability	Static behavior regardless of population state	Adaptive to optimization stage and diversity level
Inputs Considered	Only iteration count (via theta)	Iteration progress and solution diversity
System Type	Purely mathematical	Soft computing (Fuzzy system-enhanced)
Exploration Exploitation Control	Controlled by A indirectly tied to iterations	Controlled by fuzzy rule base for more intelligent switching engine setup and evaluation
Expected Benefit	Fast but rigid convergence	More balanced and context-sensitive search behavior

The dynamic energy factor extracted using the FRI inference system offered more balance in the search behavior, and the fuzzy rules controlled the intelligent switching between the exploration and exploitation phases. We compared our results with other related works that use the same benchmark intrusion datasets for more in-depth analysis. Table 10 compares the accomplished results by the suggested FRI-ARO and other state-of-the-art works.

Table 10. Comparing The FRI-ARO with Other Methods.

Approach	Dataset	Features Selection	Accuracy	Task Type
MCA-LSTM [27]	UNSW-NB15	Info. Gain	77.74%	Multiclass
RNN [28]	UNSW-NB15	-	81.29%	Multiclass
FFDNN [29]	UNSW-NB15	ExtraTrees	77.16%	Multiclass
ANN-MLP [30]	UNSW-NB15	Gain Ratio	76.96%	Multiclass
LSTM [31]	UNSW-NB15	XGBoost	88.60%	Multiclass
DNN [32]	UNSW-NB15	filter-based	84–91.00%	Multiclass
Simple-RNN [33]	UNSW-NB15	XGBoost	87.07%	Multiclass
CNN+LSTM [34]	MSCAD	-	87.10%	Multiclass
CNN+RNN [34]	MSCAD	-	85.80%	Multiclass
This Work	UNSW-NB15 MSCAD	FRI-ARO	91.96% 99.73%	Multiclass
CNN [31]	CIC-IDS2017	XGBoost	95.60%	Binary
CNN-LSTM [31]	CIC-IDS2017	XGBoost	96.21%	Binary
LSTM-RNN [35]	NSL KDD	-	88.40%	Binary
OCNN-LSTM [36]	ToN-IoT	-	94.40%	Binary
LSTM [33]	NSL-KDD	XGBoost	88.13%	Binary
DT [2]	Phishing Detection	PSO	93.43%	Binary
DT [2]	Phishing Detection	FFA	93.02%	Binary
DT [2]	Phishing Detection	MVO	94.82%	Binary
DT [37]	NSL-KDD	MFO	89.70%	Binary
This Work	CIC-IDS2017 NSL-KDD ToN-IoT Phishing Detection	FRI-ARO	99.90% 98.10% 100.00% 96.00%	Binary

The experimental results presented in Table 10 show that the proposed FRI-ARO outperforms other state-of-the-art methods that use the same intrusion datasets. Regarding the UNSW-NB15 and MSCAD datasets, the suggested FRI-ARO achieved accuracies of 91.96% and 99.73%, respectively. These results indicate that the suggested FRI-ARO outperforms other typical feature ranking techniques such as XGBoost, Gain Ratio, and ExtraTrees. The benefits of the FRI inference engine within the ARO were demonstrated in this experiment.

In binary classification tasks, the suggested FRI-ARO also demonstrated its effectiveness and achieved superior results compared with other state-of-the-art methods. For instance, using the CIC-IDS2017 dataset, the FRI-ARO algorithm reached 99.90% accuracy. Similarly, the FRI-ARO algorithm achieved perfect classification (100%) on the ToN-IoT dataset. Moreover, the FRI-ARO approach outperformed other optimizers such as PSO, MVO, FFA, and MFO.

5. Conclusions

This paper introduces a novel hybrid approach (FRI-ARO) by incorporating an FRI inference engine into the ARO algorithm. This integration dynamically adjusts the energy factor A, which controls the balance between exploration and exploitation phases. Contrary to traditional ARO variants that rely on linearly decaying strategies, this fuzzy adaptation enables the algorithm to respond more intelligently to population diversity and iteration progress. The FRI-ARO algorithm had two inputs, optimization stage and solution variability, and a single output, the adaptive energy value A. The inputs and the output variable are associated with three triangular membership functions representing linguistic terms: low, mid, and high. These fuzzy sets enable the FRI-ARO to map continuous values into linguistic categories. The triangular membership functions were used for the sake of simplicity. The design of membership functions ensures that both early- and late-stage optimization behaviors, as well as the diversity among candidate solutions, are considered when generating the energy factor. Furthermore, the fuzzy rules were designed to keep only the most critical cases, keeping the fuzzy rules minimal and focused. This design works well with the FRI inference engine, which can effectively interpolate and generate meaningful outputs even when only a few fuzzy rules are available. In addition, we design a multi-objective fitness function that balances two targets: maximizing classification accuracy and minimizing the number of selected features. By evaluating the feature selection performance of FRI-ARO using a diverse set of cybersecurity datasets to evaluate its impact on real-world classification tasks. The results showed the effectiveness of the suggested FRI-ARO approach for enhancing the detection rate as well as effectively reducing the dimension space. Compared with other state-of-the-art works, the accomplished results show that the proposed FRI-ARO outperforms other methods that use the same intrusion datasets.

For future work, it could be useful to explore the suggested FRI-ARO approach in other domains. Moreover, enhancing the fuzzy system by tuning the membership values or incorporating additional learning mechanisms to enhance adaptability in evolving environments.