## 3 Methodology
### Detection Algorithm
Our proposed scheme was implemented on Kaggle using Python, employing the CSA to optimize the Decision Tree's hyperparameters. Given the CSA's complexity and dynamic nature, we opted for 20 nests and 10 iterations. This

Figure 4: Internet of Things dataset class distribution. configuration aimed to balance exploration of the hyperparameter space with computational efficiency; a larger number of iterations could increase processing time and costs, while too few may prevent convergence to a satisfactory solution. The permissible ranges for these hyperparameters were defined by the lower (2) and upper (50) bounds of the CS. To ensure the stability and reliability of the optimized hyperparameters, we integrated SPC to monitor the best parameter values identified by the CSA in the 10 iterations. As recorded by the SPC, the optimal parameters converged to a max_depth of 20, min_samples_split of 5, and min_samples_leaf of 3, achieving an average accuracy of 0.9881. Figure 5 illustrates the parameter values explored by the CS algorithm over the \begin{table}
\begin{tabular}{c c} \hline \hline
**Feature** & **Importance** \\ \hline Source IP & High \\ \hline Destination IP & High \\ \hline Source Port & Medium \\ \hline Destination Port & Medium \\ \hline Protocol & High \\ \hline Flow Duration & High \\ \hline Total Fwd Packets & Medium \\ \hline Total Backward Packets & Medium \\ \hline Fwd Packet Length Mean & High \\ \hline Bwd Packet Length Mean & High \\ \hline Flow Bytes/s & Medium \\ \hline Flow Packets/s & Medium \\ \hline Bwd IAT Mean & High \\ \hline Fwd PSH Flags & Medium \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Feature Importance. Figure 5: Confusion Matrix. iterations, along with the overall mean (29.59) and the expected normal range centered around this mean. This approach provides a degree of control over the selected parameters, although a more formal sensitivity analysis to justify the initial CSA parameters (20 nests, 20 iterations) would further strengthen the robustness of our results. This helps to evaluate whether the proposed model is underperforming and identify sudden spikes indicating abnormal behavior, which can be recorded in the control chart. Figure 6 further shows that lower values are above the lower bound, while upper values are above the mean but below the upper limit. The proposed model was compared to the Support Vector Machine (SVM), the Local Outlier Factor (LOF), the CSA-DT, and CSA-ANN, with CSA-DT and CSA-ANN both optimized using the same CS approach as our proposed model. We included SVM for its ability to perform well with imbalanced datasets and LOF for its specific design in anomaly and outlier detection. The Decision Tree component of our proposed model, such as CSA-DT and CSA-ANN, was also optimized using the CSA to handle the inherent class imbalance in the data effectively. All models were evaluated using the Internet of Things Intrusion Detection (IoTID20) dataset. Table 3 details the performance metrics for all the compared algorithms across Precision, Recall, F1-score, and Accuracy, providing a comprehensive evaluation of their performance on the IoTID20 dataset. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Model** & **Precision** & **Recall** & **F1-Score** & **Accuracy** \\ \hline Proposed Model & 0.9987 & 0.9886 & 0.9936 & 0.9976 \\ \hline CSA-ANN & 0.9780 & 0.9700 & 0.9740 & 0.9876 \\ \hline CSA-DT & 0.9845 & 0.9789 & 0.9817 & 0.9912 \\ \hline SVM & 0.9621 & 0.7713 & 0.8444 & 0.9723 \\ \hline LOF & 0.9042 & 0.8754 & 0.8501 & 0.8721 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Performance comparison of the proposed model with existing methods. Figure 6: Statistical Process Environment. Figure 7 shows the simulation results from Table 3, indicating that the proposed model outperformed the SVM, LOF, CSA-ANN, and CSA-DT models. The proposed model achieved the highest accuracy of 99.76%. Compared to CSA-ANN, which had an accuracy of 98.76%, the proposed model improved by 1.01% compared to CSA-DT (99.12%), which achieved a 0.64% improvement.