Early approaches to network intrusion detection relied on classical ML algorithms. Support Vector Machines (SVM) were applied to binary classification of normal vs. attack traffic, achieving moderate accuracy but struggling with multi-class scenarios [1]. Random Forest (RF) classifiers demonstrated improved robustness through ensemble learning, achieving accuracies around 96–97% on standard datasets [6]. K-Nearest Neighbors (KNN) provided simple baseline performance but suffered from high computational costs during inference on large-scale network data [7].

Deep learning methods have shown significant promise. Convolutional Neural Networks (CNNs) capture spatial patterns in traffic feature vectors, while Long Short-Term Memory (LSTM) networks model temporal dependencies across sequential packet flows [8]. Autoencoder-based anomaly detection approaches learn normal traffic representations and flag deviations [9]. However, standalone deep learning models applied to raw high-dimensional features often face convergence issues and excessive training times.

Metaheuristic algorithms for feature selection include Genetic Algorithms (GA), Particle Swarm Optimization (PSO), and GWO. GA uses evolutionary operators but can be slow to converge [10]. PSO offers faster convergence but may prematurely converge to local optima [11]. GWO, proposed by Mirjalili et al. [5], provides a balanced exploration-exploitation trade-off through its hierarchical social structure.

While individual components (ML classifiers, deep learning, metaheuristic feature selection) have been studied separately, few works have combined wrapper-based metaheuristic feature selection with hybrid CNN-LSTM architectures specifically for DDoS detection in cloud environments. This paper addresses this gap.

The proposed framework consists of three main stages: 1) data preprocessing, 2) GWO-based feature selection, 3) CNN-LSTM classification. Raw network traffic data is first cleaned and normalized. The GWO algorithm then selects an optimal feature subset, and 4) the CNN-LSTM model classifies traffic as benign or attack (with attack sub-type identification).

GWO mimics the social hierarchy and hunting mechanism of grey wolves. The pack hierarchy consists of four levels: alpha (α) the leader and best solution; beta (β) the second-best advisor; delta (δ) the third-ranked wolf; and omega (ω) the remaining wolves that follow.

The mathematical model of encircling prey is defined as:

D = |C · Xp(t) − X(t)|,

X(t + 1) = Xp(t) − A · D,

where t is the current iteration, Xp is the position vector of the prey, X is the position vector of a wolf, and A and C are coefficient vectors calculated as:

A = 2a · r1 − a,

C = 2 · r2,

where a decreases linearly from 2 to 0 over the course of iterations, and r1, r2 are random vectors in [0, 1]. In the hunting phase, the positions of alpha, beta, and delta guide the search:

Dα = |C1 · Xα − X|, X1 = Xα − A1 · Dα, Dβ = |C2 · Xβ − X|, X2 = Xβ − A2 · Dβ,

Dδ = |C3 · Xδ − X|, X3 = Xδ − A3 · Dδ,

X(t + 1) = (X1 + X2 + X3) / 3.

For feature selection, each wolf's position is a binary vector where 1 indicates feature selection and 0 indicates exclusion. The fitness function combines classification accuracy and feature count to balance performance and parsimony.

The hybrid CNN-LSTM architecture processes the selected features in two stages:

The complete pipeline is summarized as follows:

Raw CIC-DDoS2019 Data → Cleaning (remove NaN, infinity) → Min-Max Normalization → GWO Feature Selection (50 iterations, 30 wolves) → Train/Test Split (80/20) → CNN-LSTM Training (Adam optimizer, lr = 0.001, batch size 64, 100 epochs, early stopping patience = 10) → Evaluation

The CIC-DDoS2019 dataset was used, developed by the Canadian Institute for Cybersecurity. It contains benign and multiple DDoS attack types including DNS, LDAP, MSSQL, NetBIOS, NTP, SNMP, SSDP, UDP, and SYN floods. The dataset contains over 80 network traffic features extracted using CICFlowMeter. After preprocessing, the dataset comprised approximately 685,000 samples with a balanced distribution achieved through stratified sampling.

The following standard metrics were employed for performance evaluation:

I. Accuracy: (TP + TN) / (TP + TN + FP + FN).

II. Precision: TP / (TP + FP).

III. Recall (sensitivity): TP / (TP + FN).

IV. F1-Score: 2 × (precision × recall) / (precision + recall).

V. False Positive Rate (FPR): FP / (FP + TN).

VI. Detection latency: average time from packet arrival to classification output.

Three baseline models were implemented for comparison:

I. RF: 100 estimators, all features.

II. Standalone CNN: same architecture without LSTM and without GWO feature selection.

III. Standalone LSTM: 2-layer LSTM without CNN and without feature selection.

Experiments were conducted on a machine with Intel Core i7-10700K, 32GB RAM, NVIDIA RTX 3080 GPU. Software: Python 3.8, TensorFlow 2.6, scikit-learn 1.0.

GWO reduced the feature set from 80+ original features to approximately 25 most relevant features. The selected features predominantly included flow duration, total forward/backward packets, flow bytes per second, packet length statistics, flag counts, and inter-arrival time statistics. This 69% reduction in dimensionality significantly reduced computational overhead without sacrificing discriminative power.

The proposed GWO + CNN-LSTM model outperforms all baselines across every metric. Key observations include: 1) GWO feature selection not only reduces latency but also improves accuracy by removing noisy features, 2) the hybrid CNN-LSTM captures complementary spatial and temporal patterns that neither component alone can model, 3) the 0.08% FPR is critical for practical deployment where false alarms cause operational disruption, and 4) the 12ms average latency enables near-real-time detection suitable for cloud environments.

The ablation study in Table 3 confirms that each component of the proposed framework contributes positively to overall performance. Removing GWO feature selection increases latency by 16.7% and reduces accuracy by 0.84 percentage points. Removing either the CNN or LSTM component degrades accuracy further, confirming the complementary nature of spatial and temporal feature extraction. The GWO + RF configuration, while benefiting from feature selection, cannot match the representational power of the deep learning architecture.