Bird-inspired optimization approach using taper-shape transfer function for intrusion detection in IoT networks

Smarter Security for Everyday Connected Gadgets

From smart doorbells and baby monitors to factory sensors and hospital equipment, the Internet of Things (IoT) is weaving itself into daily life. But every connected gadget is also a possible entry point for cyberattacks. This paper explores a new way to spot intruders in IoT networks more quickly and efficiently, using an algorithm inspired by the hunting behavior of a long-legged African bird called the secretary bird. The goal is to keep defenses strong while cutting down the amount of data computers must sift through.

Too Much Data, Too Little Time

Modern IoT networks generate huge streams of information: how busy a device’s processor is, how much memory it uses, what kind of network traffic it sends, and much more. Security tools try to read all these details to decide whether activity is normal or an attack. However, many of these measurements are redundant or unhelpful. Feeding everything into a machine-learning model can slow detection, waste computing power, and sometimes even reduce accuracy. Choosing a smaller set of truly informative measurements—known as feature selection—has become essential for real-time protection of crowded IoT networks.

Letting a Hunting Bird Guide the Search

The study borrows ideas from how secretary birds search for and capture snakes on the savanna. In the algorithm, each “bird” represents one possible combination of features taken from a network dataset. These birds roam a virtual landscape, exploring different feature sets and comparing how well they help a simple classifier tell attacks from normal traffic. Over many rounds, the birds adjust their positions in ways that mimic scanning for prey, circling, attacking, and escaping predators. This dance helps the algorithm balance two needs: exploring new combinations widely and fine-tuning promising ones.

Turning Continuous Motion into Yes-or-No Choices

Because a feature must be either chosen or not chosen, the authors need a way to convert the birds’ smooth movements into crisp yes-or-no decisions. They introduce a “taper-shaped” transfer function, a mathematical tool that takes a continuous value and maps it to a probability of picking a feature. Unlike older conversion schemes that use fixed curves, the taper-shaped approach changes the selection behavior over time. Early on, it encourages broad exploration of many feature combinations. Later, it focuses more tightly on the best candidates, helping the search settle on a compact, high-performing subset.

Testing on Realistic Attack Scenarios

To see how well this bird-inspired method works, the researchers test it on two public IoT intrusion datasets, RT-IoT2022 and IoTID20, which include both normal network behavior and a variety of attacks such as denial-of-service floods and scanning attempts. They compare their Binary Secretary Bird Optimization Algorithm (BSBOA) with other bird-based and swarm-based search methods, and evaluate performance using three common classifiers: k-nearest neighbors, support vector machines, and random forests. Despite exploring far fewer features than its rivals, the secretary bird approach consistently achieves very high detection accuracy—up to about 99.9 percent in some settings—while sharply reducing the number of measurements needed.

Doing More with Less Data

A key outcome of the study is how aggressively the new method trims the data without sacrificing results. On one dataset, BSBOA selects only 6 out of 81 possible features, cutting more than 90 percent of the input while still reaching nearly 99.7 percent accuracy with a random forest classifier. On another, it uses just 7 of 81 features and still detects attacks with roughly 98.5 percent accuracy. These compact feature sets mean faster training, lower memory use, and simpler models, which are critical advantages for small devices and gateways that protect IoT networks.

What This Means for Everyday Security

For non-specialists, the central message is that we do not always need more data to be safer online; often, we need the right data. By cleverly copying how a hunting bird searches and adapts, this work offers a practical way to focus on the most telling clues of malicious activity in IoT traffic. The result is an intrusion detection approach that is both lightweight and highly accurate—well suited to guarding the growing universe of connected devices that power smart homes, cities, and industries.

Citation: Can, C. Bird-inspired optimization approach using taper-shape transfer function for intrusion detection in IoT networks. Sci Rep 16, 12838 (2026). https://doi.org/10.1038/s41598-026-43194-4

Keywords: IoT intrusion detection, feature selection, metaheuristic optimization, network security, secretary bird algorithm