Abstract
Intrusion detection in Internet of Things (IoT) environments is challenged by high-dimensional traffic, heterogeneous attack behaviors, and severe class imbalance. To address these issues, this paper proposes EHFOA-ID, an intrusion detection framework driven by an Enhanced HawkFish Optimization Algorithm integrated with a hybrid deep ensemble. The proposed optimizer jointly performs feature selection and hyperparameter tuning using adaptive exploration-exploitation balancing, Lévy flight-based global searching, and diversity-preserving reinitialization, enabling efficient navigation of complex IoT feature spaces. The optimized features are processed through a multi-view ensemble that captures spatial correlations, temporal dependencies, and global contextual relationships, whose outputs are fused via a meta-learner to improve decision reliability. This unified optimization-learning pipeline reduces feature redundancy, enhances generalization, and improves robustness against diverse intrusion patterns. Experimental evaluation on benchmark IoT datasets shows that EHFOA-ID achieves detection accuracies exceeding 99% on UNSW-NB15 and 98% on SECOM, with macro-F1 scores above 0.97 and false-alarm rates reduced to below 2%, consistently outperforming state-of-the-art intrusion detection approaches.