AN ADAPTIVE HYBRID DEEP LEARNING FRAMEWORK FOR REAL-TIME CYBER THREAT AND ANOMALY DETECTION IN HIGH-THROUGHPUT NETWORK TRAFFIC

Abstract

Modern enterprise digital infrastructures face unprecedented cyber threats characterized by high volume, zero-day vulnerabilities, and multi-stage attack vectors. Traditional rule-based Intrusion Detection Systems (IDS) and shallow machine learning models struggle to maintain high detection accuracy while minimizing false alarm rates in gigabit-per-second network flows. This study proposes an adaptive hybrid deep learning architecture combining 1D Residual Convolutional Neural Networks (ResNet1D), Bidirectional Gated Recurrent Units (BiGRU), and Multi-Head Self-Attention mechanisms for real-time network anomaly detection. By integrating temporal feature extraction with spatial feature representation, the proposed ResNet1D-BiGRU-Attention model effectively captures long-range contextual dependencies and subtle anomaly patterns in complex packet streams. Comprehensive evaluations conducted on benchmark datasets—CICIDS2017 and UNSW-NB15—demonstrate that our hybrid framework achieves a state-of-the-art detection accuracy of 99.64%, a Precision of 99.58%, a Recall of 99.61%, and an F1-score of 99.59%, with an average inference latency of 11.4 milliseconds per 10,000 packets. Furthermore, Explainable AI (XAI) techniques utilizing SHAP (SHapley Additive exPlanations) are incorporated to provide transparent feature attribution for Security Operations Center (SOC) analysts. The results confirm that the framework significantly outperforms baseline models in detecting sophisticated intrusion types, providing a scalable and low-latency solution for modern cybersecurity defenses.