Jul 2026· International Journal of Innovative Science and Research Technology· 0 citations· 16 references
TL;DR
A novel Hybrid CNN-BiLSTM Attention-based Ensemble Framework (CBAF) that unifies three complementary representations of network traffic and incorporates SMOTE-based oversampling to counter the severe class imbalance found in benchmark intrusion datasets.
Abstract
The rapid growth of networked and cloud-connected infrastructure has widened the attack surface available to
adversaries, exposing enterprise and IoT environments to increasingly stealthy and evolving intrusions. Signature-based
and shallow machine-learning intrusion detection systems (IDS) generalize poorly to zero-day and low-frequency attack
classes and typically treat traffic features independently, ignoring both the spatial correlation among flow attributes and the
temporal evolution of a connection. This paper proposes a novel Hybrid CNN-BiLSTM Attention-based Ensemble
Framework (CBAF) that unifies three complementary representations of network traffic. A one-dimensional feature vector
is first reshaped into a two-dimensional matrix and passed through convolutional layers that learn local spatial correlations
among protocol, packet, and byte-level attributes. The resulting feature maps are fed into a Bidirectional Long Short-Term
Memory (BiLSTM) network that models the forward and backward temporal dependencies characteristic of multi-stage
attacks. A self-attention layer then assigns adaptive importance weights to the most discriminative time steps and features,
improving both detection accuracy and interpretability. The attention-weighted representation is finally passed to a stacked
Random Forest meta-classifier that consolidates the deep and shallow decision boundaries to reduce false positives. The
framework further incorporates SMOTE-based oversampling to counter the severe class imbalance found in benchmark
intrusion datasets. Experiments on NSL-KDD, CICIDS2017, and UNSW-NB15 show that the proposed CBAF achieves
97.6% accuracy and a 0.96 F1-score, outperforming Logistic Regression, Support Vector Machine, Random Forest, and a
plain CNN-LSTM baseline, while maintaining real-time inference latency suitable for deployment in security operations
centers (SOCs).
The findings indicate that hybrid deep learning techniques can improve network security by enhancing intrusion detection capability while reducing false alarms.
A. O. Jimoh-Mahmud, Abubakar Dayyabu, Abubakar Sadiq Idris et al.· FUDMA Journal of Sciences· 0 citations
Network intrusion detection remains a fundamental cybersecurity challenge due to the increasing diversity and sophistication of malicious network traffic. Conventional signature-based approaches exhibit limited capability in detecting previously unseen attacks, while many machine learning methods suffer from class imbalance, high false-positive rates, and limited adaptability across heterogeneous network environments. To address these challenges, this paper proposes HADS-Net (Hybrid Attention-based Deep Security Network), which integrates a feature-wise multi-head self-attention module with a stacked ensemble consisting of Random Forest and Gradient Boosting base learners combined through out-of-fold stacking and a logistic regression meta-learner. The attention mechanism adaptively emphasizes informative network features to improve discriminative learning, while the stacking strategy enhances generalization and reduces overfitting. Experiments were conducted on a class-stratified 15,000-record subsample derived from the NSL-KDD KDDTrain+ corpus, in which the minority R2L and U2R categories were deliberately enriched to obtain usable test support; the subsample was divided into 70% training and 30% testing partitions, giving a held-out test partition of 4,500 records. Because this constructed distribution departs from the native NSL-KDD proportions, the results reported here are not directly comparable with published KDDTest+ figures, and no such comparison is claimed. The proposed model achieved 96.20% accuracy, 97.57% precision, 94.32% recall, 95.92% F1-score, and 98.83% AUC-ROC on the binary Normal-versus-Attack task. A multi-layer perceptron baseline attained higher accuracy (98.11%) and F1-score (97.99%) than the proposed model on the same partition, and the ablation deltas attributable to the attention and stacking components lie below 0.5%; these deltas are reported as single-run point estimates. The principal contribution of this work is consequently architectural and diagnostic rather than a performance improvement: it documents that combining feature-wise attention with out-of-fold stacked generalization does not, in this setting, outperform a plain multi-layer perceptron, while incurring the highest memory footprint of the six models evaluated.
Mahima Khanna, V. Murthy, Siva Ramavarapu et al.· International Journal for Gl...· 0 citations
Smart city IoT deployments interconnect safety-critical infrastructure across millions of heterogeneous devices, creating an attack surface that signature-based intrusion detection systems (IDS) cannot defend against zero-day exploits, polymorphic malware, or concept drift. Prior deep-learning IDS proposals address the detection accuracy gap but typically evaluate on a single benchmark with a single random seed, omit structured ablation evidence, lack on-line adaptation, and provide no model-explanation interface for security analysts. This paper presents MI-IDS, a hybrid Convolutional Neural Network–Bidirectional Long Short-Term Memory (CNN-BiLSTM) ensemble deployed on a two-tier edge-cloud framework that integrates reservoir-sampling-based incremental learning and SHAP explainability under a single experimentally validated pipeline. The experimental results reveals that across five random seeds, MI-IDS achieves 96.7 ± 0.2% accuracy and 95.8 ± 0.2% F1-score on a 73,100-instance composite benchmark spanning seven traffic classes, one of which is a held-out group of synthetically mutated attack variants used as a partial-novelty proxy rather than a genuine zero-day family. A held-out UNSW-NB15 partition (
n
= 82,332) yields 97.4 ± 0.2% accuracy; because UNSW-NB15 also contributes to the composite, this figure reflects within-benchmark held-out performance rather than independent cross-dataset generalisation. A six-variant ablation study isolates the contribution of each architectural component. Under a 48-hour concept-drift simulation, reservoir sampling bounds accuracy loss to 1.2% points versus a 20.4-point degradation for the non-adaptive baseline. The hybrid edge-cloud deployment achieves 14.1 ms mean detection latency and 61.2% lower bandwidth than cloud-only deployment, and SHAP attributions lowered analyst mean time-to-decision by 57.1% in a small preliminary study with five experts, a result we treat as indicative rather than confirmatory. All improvements over six baselines are statistically significant at Bonferroni-corrected α = 0.0083. A central contribution is the integration and disciplined evaluation of multi-seed validation, structured ablation, on-line incremental learning, and model-agnostic explainability within a single smart city IoT pipeline, a combination that remains uncommon in the prior IDS literature rather than one we can demonstrate to be unprecedented.
Manjot Kaur, Kedar Nath Singh, Alpana Suman et al.· Discover Internet of Things· 0 citations
Abstract: The increasing complexity of cyber threats and the limitations of signature-based intrusion detection systems have made the detection of zero-day attacks a critical challenge in network security. Although machine learning and deep learning methods have achieved high accuracy for known attacks, their ability to generalize to previously unseen attack families remain limited. This paper proposes a hybrid intrusion detection model that integrates a Feature Tokenization-based Transformer with a CNN–BiLSTM model to capture global feature interactions and local sequential dependencies in tabular network traffic data. The learned fusion embedding is further exploited using a Mahalanobis distance–based anomaly detector to identify zero-day intrusions in an open-set setting. Experiments were conducted on the UNSW-NB15 dataset using a strict held-out attack family protocol, where Analysis, Backdoor, and Worms were excluded from training and reserved for zero-day testing. The proposed model achieved 94.64% accuracy, 0.9610 F1-score, and 0.9902 AUC on the known test set, that indicate the strong zero-day detection capability with high family-wise true positive rates for Backdoor and Worms. Five-fold cross-validation, ablation study, and statistical significance analysis further confirmed the robustness and effectiveness of the proposed framework. The results indicate that the integration of transformer-based feature learning, sequential modeling, and covariance-aware embedding analysis provides a reliable and extensible solution for both known attack classification and zero-day intrusion detection.
Attacks against networks keep changing form, and Intrusion Detection Systems (IDS) still stand among the first defenses expected to catch them. Deep learning brought real gains in detection accuracy, but a habit persists across most published models: traffic enters as flat tabular records, and whatever context ties one attribute to another is thrown away before training begins. This work follows a different route. Every network record is rewritten as a short piece of text - the protocol, the connection state, the ports, and a few traffic statistics, joined into what we call a semantic flow - after which the sequence is tokenized, embedded, and handed to a small Convolutional Neural Network (CNN). No transformer appears anywhere in the pipeline, and no recurrent stack either; the representation itself does the heavy lifting. Four benchmark datasets served for the evaluation (CIC-IDS-2017, KDDCup99, NSL-KDD, and Hogzilla), in binary as well as multiclass settings. Accuracy fell between 99.04% and 99.95%, F1-scores held above 0.99, and AUC values remained high - figures we read with prudence, since they come from benchmark data alone. Even so, one lesson emerges from the experiments: putting the effort into how traffic is written down, instead of making the classifier heavier, offers an economical and workable path to intrusion detection across heterogeneous network environments.
Asmaa Benchama, Khalid Zebbara· EPJ Web of Conferences· 0 citations
A Hybrid Deep Learning and Machine Learning (DL-ML) framework for intelligent cyber threat detection that fuses a Convolutional Neural Network combined with a Bidirectional Long Short-Term Memory branch with a gradient-boosted ensemble branch that produces a unified threat classification and severity score is proposed.
Rajesh Yadav, Dinesh Kumar, Sanjeev Kumar et al.· International journal of com...· 1 citation
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
