## 3 Methodology
### Detection Algorithm
The improvement over the traditional SVM model (97.23% accuracy) was 2.53%, and compared to LOF (87.21% accuracy), it was a significant 12.55% difference. CSA optimization contributed to better performance in both CSA-ANN and CSA-DT by selecting the most relevant features, which enhanced generalization and accuracy. However, despite these gains, they did not outperform the proposed model. The SVM model achieved a precision of 0.9621 but had a low recall of 0.7713 and an F1-score of 0.8444, indicating issues with imbalanced data and a higher rate of false negatives. SVM also becomes computationally intensive as the dataset size increases. The LOF model had the lowest performance, with an accurate score of 87.21% and lower scores in all metrics. Its assumption of uniformly distributed data makes it ineffective for data points that are uniformly distributed; thus, it struggles with highly skewed distributions, failing to identify outliers effectively. The proposed model was evaluated using an Intrusion Detection Dataset consisting of regular and anomalous traffic. The training dataset comprises 25,192 instances and 42 features, while the testing dataset consists of 22,544 instances and 41 features, without a class label. The proposed model was evaluated using two sets of datasets: one for general intrusion detection and another for Internet of Things (IoT) intrusion detection, to evaluate its performance in real-world IoT environments. The best parameters generated by the cuckoo search are max_depth = 50, min_samples_split = 2, and min_samples_leaf = 1, with an average accuracy of 0.996. Table 4 shows the simulation results using the Intrusion Detection Dataset. Figure 7: Model Comparison. Figure 8 depicts the results of the proposed model, highlighting its superior performance compared to the SVM, LOF, CSA-ANN, and CSA-DT models. The dataset used has fewer instances compared to the IoTID dataset and is likely skewed, which significantly impacts the performance of the LOF model. LOF, designed to detect local outliers, struggles with skewed distributions and is also affected by noise, leading to lower performance metrics, achieving only 75.84% accuracy. The proposed model achieved the highest performance with an accuracy of 99.59%, reflecting an improvement of 3.68% compared to-CSA-ANN, 1.83% compared to CSA-DT, 3.67% compared to SVM, and 23.75% compared to the LOF across all models. The CSA-ANN and CSA-DT models benefited from optimization through CSA, improving feature selection and generalization. Among them, CSA-DT showed solid performance but lagged behind the proposed model. While the SVM maintained a balanced precision and recall, its lower overall accuracy and F1-score highlight that it is less effective with skewed or imbalanced datasets. While SVM is known for its interpretability and reliability, it falls short compared to the proposed model's robustness and accuracy. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Model** & **Precision** & **Recall** & **F1-Score** & **Accuracy** \\ \hline Proposed Model & 0.99631 & 0.98835 & 0.99801 & 0.99591 \\ \hline CSA-ANN & 0.9725 & 0.9655 & 0.9690 & 0.9890 \\ \hline CSA-DT & 0.9631 & 0.9585 & 0.9671 & 0.9776 \\ \hline SVM & 0.96864 & 0.95905 & 0.95884 & 0.95889 \\ \hline LOF & 0.76652 & 0.72774 & 0.74518 & 0.75844 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparison of the proposed model with existing methods using the IDD. Figure 8: Intrusion Detection Dataset. Datasets Comparison

Figure 9 shows the performance analysis of the proposed model against SVM, LOF, CSA-ANN, and CSA-DT methods across two benchmark datasets. The proposed model consistently performs well, demonstrating good accuracy, precision, recall, and robustness. This demonstrates not only its strong predictive capability but also its robustness in varied data environments. The CSA-ANN, though it benefits from CSA for feature selection, exhibits slightly lower performance.