Flow-based network intrusion detection systems (NIDSs) often rely on feature sets with redundant or weakly informative attributes. Wrapper-based metaheuristics can shrink this input space, but their progress may stall once the population concentrates in a small region of the search space. This paper presents Stagnation-Triggered Contribution-Guided Binary Grey Wolf Optimization (ST-CG-BGWO), which augments Binary Grey Wolf Optimization (BGWO) with a local refinement step activated only on stagnation. The objective balances macro-averaged F1score against the fraction of selected features. When the best fitness fails to improve by more than a small tolerance for three consecutive iterations, every single-feature addition and removal around the elite mask is evaluated and the best improving neighbour is kept. The method is evaluated on a 40-feature representation of NF-CSE-CIC-IDS2018-v2 against Information Gain, mRMR, RFE, SFS, BPSO, and standard BGWO, plus a random-refinement ablation, using a common held-out split and Random Forest classifier. ST-CG-BGWO selected 11 of 40 features (72.5% reduction) and obtained the lowest search fitness (0.0688). Its held-out macro-F1 (0.7706) was marginally above standard BGWO (0.7678) but below RFE (0.7831), mRMR (0.7828), and BGWO with random refinement (0.7793). Over five seeds it achieved a lower mean search fitness than BGWO, with higher variance. Guided refinement is therefore promising for compact subsets, and search fitness, held-out performance, and run-to-run variability should be reported separately.

Network intrusion detection,Feature selection,binary grey wolf optimization,metaheuristic optimization,macroF1,NetFlow