An intrusion detection framework integrating improved parrot optimization, latent denoising diffusion implicit models (DDIM) and a hybrid CNN-Transformer, which outperforms other mainstream intelligent algorithms in global optimal solution seeking with swifter convergence.
Abstract
Accurate detection of rare attacks is a vital task in network intrusion detection. Although deep learning has superior feature representation capability and has become a mainstream technology in this field, existing methods still perform poorly in identifying rare attacks under long-tailed imbalanced multi-class traffic distribution, which remains a critical bottleneck in real-world deployment. This paper proposes an intrusion detection framework integrating improved parrot optimization (IPO), latent denoising diffusion implicit models (DDIM) and a hybrid CNN-Transformer. IPO balances global exploration and local exploitation via an annealing-greedy mechanism to select highly discriminative low-dimensional features, providing low-noise input for VAE-based Latent-DDIM to generate semantically consistent minority samples and alleviate class imbalance. The hybrid CNN-Transformer model captures local statistical patterns and global dependencies through multi-scale feature fusion, forming an end-to-end closed loop of “feature optimization-data augmentation-model modeling”. Experiments on NSL-KDD show that our method improves accuracy by 6.66%, F1-score by 8.01%, and recall rates of U2R and R2L attacks by 15% and 84.2% respectively compared with the best baseline. Moreover, IPO outperforms other mainstream intelligent algorithms in global optimal solution seeking with swifter convergence. On the dataset enhanced by the IPO-DDIM joint augmentation strategy, the hybrid CNN-Transformer obtains 3.93% higher accuracy and 6.24% higher F1-score, which sufficiently demonstrates the comprehensive superiority of the constructed framework.
Distributed Denial of Service (DDoS) attacks remain one of the most serious threats to modern network infrastructures, as they overwhelm systems with massive traffic and disrupt legitimate services. Traditional intrusion detection systems often struggle to detect complex and evolving attack patterns due to their reliance on manual feature engineering and limited learning capability. To address this issue, this study proposes a hybrid deep learning model that integrates Convolutional Neural Networks (CNN) and Bidirectional Gated Recurrent Units (BiGRU) for efficient DDoS attack detection. The CNN component is used to automatically extract important spatial features from network traffic data, while the BiGRU layer captures temporal dependencies and sequential patterns in the traffic flows. The proposed model is evaluated using the CICDDoS2019 dataset, which contains realistic benign and attack traffic across multiple DDoS categories. Experimental results demonstrate that the model achieves high performance in both binary and multiclass classification tasks, obtaining an accuracy of 99.82% for binary detection and 99.21% for multiclass classification. The results indicate that the hybrid CNN–BiGRU architecture effectively improves detection accuracy and provides a reliable approach for intelligent network intrusion detection systems.
Unknown authors· International journal of com...· 0 citations
The findings indicate that hybrid deep learning techniques can improve network security by enhancing intrusion detection capability while reducing false alarms.
A. O. Jimoh-Mahmud, Abubakar Dayyabu, Abubakar Sadiq Idris et al.· FUDMA Journal of Sciences· 0 citations
Network intrusion detection remains a fundamental cybersecurity challenge due to the increasing diversity and sophistication of malicious network traffic. Conventional signature-based approaches exhibit limited capability in detecting previously unseen attacks, while many machine learning methods suffer from class imbalance, high false-positive rates, and limited adaptability across heterogeneous network environments. To address these challenges, this paper proposes HADS-Net (Hybrid Attention-based Deep Security Network), which integrates a feature-wise multi-head self-attention module with a stacked ensemble consisting of Random Forest and Gradient Boosting base learners combined through out-of-fold stacking and a logistic regression meta-learner. The attention mechanism adaptively emphasizes informative network features to improve discriminative learning, while the stacking strategy enhances generalization and reduces overfitting. Experiments were conducted on a class-stratified 15,000-record subsample derived from the NSL-KDD KDDTrain+ corpus, in which the minority R2L and U2R categories were deliberately enriched to obtain usable test support; the subsample was divided into 70% training and 30% testing partitions, giving a held-out test partition of 4,500 records. Because this constructed distribution departs from the native NSL-KDD proportions, the results reported here are not directly comparable with published KDDTest+ figures, and no such comparison is claimed. The proposed model achieved 96.20% accuracy, 97.57% precision, 94.32% recall, 95.92% F1-score, and 98.83% AUC-ROC on the binary Normal-versus-Attack task. A multi-layer perceptron baseline attained higher accuracy (98.11%) and F1-score (97.99%) than the proposed model on the same partition, and the ablation deltas attributable to the attention and stacking components lie below 0.5%; these deltas are reported as single-run point estimates. The principal contribution of this work is consequently architectural and diagnostic rather than a performance improvement: it documents that combining feature-wise attention with out-of-fold stacked generalization does not, in this setting, outperform a plain multi-layer perceptron, while incurring the highest memory footprint of the six models evaluated.
Mahima Khanna, V. Murthy, Siva Ramavarapu et al.· International Journal for Gl...· 0 citations
A novel Hybrid CNN-BiLSTM Attention-based Ensemble Framework (CBAF) that unifies three complementary representations of network traffic and incorporates SMOTE-based oversampling to counter the severe class imbalance found in benchmark intrusion datasets.
Vishwaradhya K., Annappa S. S., L. C.· International Journal of Inn...· 0 citations
Cyber threats are becoming more sophisticated, and advanced intrusion detection systems (IDS) are needed to detect complex attack patterns on the network. Traditional IDS approaches tend to rely on signature-based methods or manually engineered statistical features, which struggle to detect evolving cyber threats and large-scale network traffic. The paper presents an intrusion detection framework that leverages a deep learning architecture, the Split Convolutional Neural Network (Split-CNN), which enhances feature diversity and training efficiency. Another module, Split Convolution (SplitConv), is proposed in the given model and isolates input feature channels into a few semantic groups, then performs separate convolution processes. This mechanism is interrelated with the decrease in inter-channel redundancy and the increase in discrimination feature learning. To facilitate cross-dataset learning, a feature alignment framework is proposed that can be unified to integrate three standard intrusion detection datasets: NSL-KDD, UNSW-NB15, and CIC-DDoS2019. The preprocessing pipeline includes categorical encoding, feature standardization, and dataset harmonization to construct a single dataset containing 168 features that constitute the four semantic channels. It has been demonstrated that the Split-CNN model is superior compared to the baseline CNN models in both classification and detection accuracy. These findings imply that the proposed approach can provide an effective, scalable deep learning system for contemporary network intrusion detection systems.
Harish G. N., A. S.· Future Technology· 0 citations
