A Unified Machine Learning-Based IDS/IPS Framework with Bio-Inspired Feature Selection for Real-Time Detection of Malware-Laden URLs

Abstract

Cybersecurity threats have become increasingly sophisticated and dynamic due to the rapid evolution of malicious software and attack techniques. However, the reliance of traditional IDS/IPS implementations on signature-based detection limits their ability to identify novel, rapidly evolving, and adaptive malware, despite their effectiveness against known cyber threats. This paper presents a unified machine-learning framework for defence against malware-laden URLs, which simultaneously targets intrusion detection (accuracy first, out of band) and intrusion prevention (latency first, inline) through module-aware, bio-inspired feature selection. The detection module employs random forest (RF) with the bat algorithm (BA), achieving 99.52% accuracy under stratified fivefold validation. This approach yields thousands of additional correct decisions per million URLs and reduces false negatives and false positives without adverse throughput effects. The prevention module utilizes a decision tree (DT) with the HHO ∩ BA consensus subset, achieving an inference time of 1 ms per URL with competitive accuracy (98.96%), enabling more than 1,000 URLs per second per core and meeting strict inline decision budgets. Standard metrics, such as accuracy, precision, recall, and F1-score, along with timing analyses, confirm that aligning feature selection with module objectives strikes a practical balance between detection quality and latency. The resulting guidance is direct: employ RF with BA for intrusion detection when optimal discriminative performance is essential, and adopt DT with the HHO ∩ BA subset for intrusion prevention when millisecond-scale latency dictates deployment.