GWO-LightGBM: A Hybrid Grey Wolf Optimized Light Gradient Boosting Model for Cyber-Physical System Security

Cyber-physical systems (CPS) represent a sophisticated integration of computational and physical components that power critical applications such as smart manufacturing, healthcare, and autonomous infrastructure. However, their extensive reliance on internet connectivity makes them increasingly susceptible to cyber threats, potentially leading to operational failures and data breaches. Furthermore, CPS faces significant threats related to unauthorized access, improper management, and tampering of the content it generates. In this paper, we propose an intrusion detection system (IDS) optimized for CPS environments using a hybrid approach by combining a nature-inspired feature selection scheme, such as Grey Wolf Optimization (GWO), in connection with the emerging Light Gradient Boosting Machine (LightGBM) classifier, named as GWO-LightGBM. While gradient boosting methods have been explored in prior IDS research, our novelty lies in proposing a hybrid approach targeting CPS-specific operational constraints, such as low-latency response and accurate detection of rare and critical attack types. We evaluate GWO-LightGBM against GWO-XGBoost, GWO-CatBoost, and an artificial neural network (ANN) baseline using the NSL-KDD and CIC-IDS-2017 benchmark datasets. The proposed models are assessed across multiple metrics, including accuracy, precision, recall, and F1-score, with an emphasis on class-wise performance and training efficiency. The proposed GWO-LightGBM model achieves the highest overall accuracy (99.73%) for NSL-KDD and (99.61%) for CIC-IDS-2017, demonstrating superior performance in detecting minority classes such as Remote-to-Local (R2L) and Other attacks—commonly overlooked by other classifiers. Moreover, the proposed model consumes lower training time, highlighting its practical feasibility and scalability for real-time CPS deployment.