## 1 Introduction  
Smart edge computing systems are distributed computing architectures that bring computing and data processing power closer to the network edge from traditional centralized cloud computing environments [1]. The design goal of smart edge computing systems is to place computing resources as close as possible to the data generation source or data usage endpoint to provide a lower latency, reduce network bandwidth pressure, and enhance user experience. Smart edge computing systems face important challenges. Security and privacy have become more complex and critical in distributed environments [2, 3]. Protecting systems from the threat of cyber attacks, data breaches, and malicious behavior is critical. At the same time, ensuring the security and privacy of data during transmission and storage, as well as effective authentication, access control, and vulnerability patching mechanisms, are key measures to ensure the security and privacy of smart edge computing systems. One security measure in smart edge computing systems is NIDS (network intrusion detection system), which is used to monitor and detect potential intrusions in network traffic. NIDS detects intrusion attacks before they cause harm to the system and uses the alarm and protection system to expel them [4]. After the attack, information about the intrusion attack can be collected and added to the knowledge base as a prevention system, thus enhancing prevention capability [5]. NIDS should provide a better picture of the system and facilitate establishing a system security system. A large proportion of NIDS is based on machine learning for algorithm design. Machine learning methods have been used to try to improve IDSs to detect malicious communications [6]. In addition, benchmark datasets on malware and cyber attacks have been published to provide IDS research [7; 8; 9]. Deep neural networks [10; 11] can learn complex causal relationships by training large amounts of data; after training is complete, detection can be performed quickly, regardless of the amount of training data [12]. NIDS consists of several stages: data collection, pre-processing, FS (feature selection), and classification. Recently, attention has been focused on FS and optimization techniques to select basic features. Feature selection has proven to be an effective method to prepare large amounts of dimensional data for machine learning and data mining [13]. The FS phase is critical because NIDS must process large amounts of data, and the direct use of raw feature sets leads to a significant decrease in efficiency [14]. At the same time, edge computing systems in IoT environments may not be able to provide the full functionality and features of certain devices due to the diversity of devices, network connectivity, and resource constraints. By performing feature selection, features that are irrelevant or unimportant for the data analysis task in a particular scenario can be eliminated. This reduces the feature dimensionality and reduces the computational complexity of model training and inference, while also reducing sensitivity to feature incompleteness. However, the detection rate of NIDS also decreases due to the loss of some features caused by FS. This is unacceptable for IoT environments with high traffic [15]. Also, current NIDSs mainly support binary classification; they only determine whether a packet is anomalous or not. For multi-ecological network systems, the large number of data values leads to systems that often have multiple security measures. Binary classification is challenging in informing and guiding other security deployments, which is very detrimental to systems in the IoT. In this paper, we propose a new network intrusion detection framework named CM-NIDS, which is divided into two main parts: pre-processing and multi-classification. In the pre-processing part, we filter the dataset and select features based on genetic algorithms (GA) to obtain the feature set.