Deployment-Aware Multi-Objective Adaptive Ant Colony Optimization for Efficient and Explainable IoT Intrusion Detection

Intrusion detection in Internet of Things (IoT) and Industrial IoT (IIoT) environments faces significant challenges due to high dimensional traffic features, heterogeneous protocols, class imbalance, and strict deployment constraints at the network edge. While machine learning–based intrusion detection systems achieve strong predictive performance, they often rely on large feature sets, exhibit limited cross-dataset generalization, and overlook inference latency constraints. We propose a deployment-aware Adaptive Multi-Objective Ant Colony Optimization (Adaptive ACO) framework that formulates feature selection as a constrained optimization problem balancing detection performance, feature compactness, and inference latency through adaptive pheromone-guided search. Threshold calibration, leakage-aware evaluation, and SHAP based analysis are incorporated as validation components to assess robustness, reliability, and interpretability of the optimized feature subsets. The framework is evaluated on diverse enterprise and IoT benchmark datasets, including CICIoT2023, ML-EdgeIIoT, ToN-IoT, UNSW-NB15, NSL-KDD, and CIC-IDS2017. Results demonstrate up to 70–90% feature reduction while maintaining competitive F1-scores across datasets. Pareto analysis confirms that the proposed method achieves a favorable balance between detection effectiveness and computational efficiency. SHAP based explainability analysis further validates semantic consistency of selected features across IoT environments. The proposed framework provides an efficient and interpretable feature selection approach whose reduced feature dimensionality, inference latency, and memory footprint indicate suitability for resource-constrained IoT intrusion detection.