Jul 2026· 2026 6th International Conference on Inventive Computation and Information Technologies (ICICIT)· pp. 991-996· 0 citations· 18 references
Abstract
IDS is a crucial element in defending against dynamic, emerging cyberattacks on modern network infrastructure. The current deep learning intrusion detection systems, however, suffer from three primary drawbacks: a lack of modeling temporal traffic dependencies, an inability to effectively handle class imbalance, and low interpretability for security analysts. To address these problems, this paper presents an explainable BiLSTM-Attention intrusion detection framework that leverages SMOTE-ENN-based adaptive imbalance handling for IDS2018 traffic. The proposed framework combines Chi-Square-based feature selection, Lasso-based feature selection, SMOTE-ENN-based class balancing, and BiLSTM-based bidirectional temporal learning with the attention mechanism highlighting informative traffic patterns. There is also a feature-level interpretation stage to increase the transparency of intrusion decisions. The model was tested on a processed dataset of IDS2018 samples, comprising 7,517 samples and 78 features for traffic classification in a binary intrusion detection scenario. The accuracy, precision, recall, F1-score, MCC, and false alarm rate of the proposed BiLSTM-Attention + SMOTE-ENN framework are 94.41%, 80.26%, 99.20%, 88.73%, 0.8592, and 6.95%, respectively, according to experimental results. Additionally, the model's inference latency was 0.0339 ms per sample, suggesting it is suitable for near-real-time intrusion detection. The results validate the effectiveness of attention-based recurrent IDS models on sampled IDS2018 traffic through adaptive imbalance handling.
Experimental results demonstrate that the proposed model achieves high detection accuracy, strong discriminative capability, and low false alarm rates across both datasets, confirming its effectiveness and scalability for next-generation cybersecurity applications.
Network intrusion detection remains a fundamental cybersecurity challenge due to the increasing diversity and sophistication of malicious network traffic. Conventional signature-based approaches exhibit limited capability in detecting previously unseen attacks, while many machine learning methods suffer from class imbalance, high false-positive rates, and limited adaptability across heterogeneous network environments. To address these challenges, this paper proposes HADS-Net (Hybrid Attention-based Deep Security Network), which integrates a feature-wise multi-head self-attention module with a stacked ensemble consisting of Random Forest and Gradient Boosting base learners combined through out-of-fold stacking and a logistic regression meta-learner. The attention mechanism adaptively emphasizes informative network features to improve discriminative learning, while the stacking strategy enhances generalization and reduces overfitting. Experiments were conducted on a class-stratified 15,000-record subsample derived from the NSL-KDD KDDTrain+ corpus, in which the minority R2L and U2R categories were deliberately enriched to obtain usable test support; the subsample was divided into 70% training and 30% testing partitions, giving a held-out test partition of 4,500 records. Because this constructed distribution departs from the native NSL-KDD proportions, the results reported here are not directly comparable with published KDDTest+ figures, and no such comparison is claimed. The proposed model achieved 96.20% accuracy, 97.57% precision, 94.32% recall, 95.92% F1-score, and 98.83% AUC-ROC on the binary Normal-versus-Attack task. A multi-layer perceptron baseline attained higher accuracy (98.11%) and F1-score (97.99%) than the proposed model on the same partition, and the ablation deltas attributable to the attention and stacking components lie below 0.5%; these deltas are reported as single-run point estimates. The principal contribution of this work is consequently architectural and diagnostic rather than a performance improvement: it documents that combining feature-wise attention with out-of-fold stacked generalization does not, in this setting, outperform a plain multi-layer perceptron, while incurring the highest memory footprint of the six models evaluated.
Mahima Khanna, V. Murthy, Siva Ramavarapu et al.· International Journal for Gl...· 0 citations
A novel Hybrid CNN-BiLSTM Attention-based Ensemble Framework (CBAF) that unifies three complementary representations of network traffic and incorporates SMOTE-based oversampling to counter the severe class imbalance found in benchmark intrusion datasets.
Vishwaradhya K., Annappa S. S., L. C.· International Journal of Inn...· 0 citations
The increasing sophistication of cyber threats and severe class imbalance in network traffic continue to challenge traditional intrusion detection systems. This study proposes a hybrid framework that integrates SMOTE and CTGAN for minority-class augmentation, a Bidirectional Long Short-Term Memory (Bi-LSTM) network for supervised traffic classification, and a benign-trained Variational Autoencoder (VAE) for validating low-confidence predictions. The framework was evaluated on the CSE-CIC-IDS2018 dataset. On a final holdout test partition of 2,759,227 network flows, it achieved a binary accuracy of 98.51%, an F1-score of 92.59%, and a ROC-AUC of 0.9935. In the 15-class evaluation, it achieved 98.50% accuracy and a weighted F1-score of 98.42%, while stratified 10-fold cross-validation yielded a mean accuracy of 98.79%. The VAE was activated for 519,389 low-confidence flows, representing 18.82% of the complete holdout test partition, and primarily reduced false-positive predictions, although this improvement was accompanied by a measurable reduction in attack recall. SHAP analysis was applied to the supervised Bi-LSTM component to provide feature-level interpretability. The framework also achieved a mean inference latency of 0.5195 ms per network flow. These findings demonstrate strong aggregate detection performance, stable generalisation, effective false-alarm reduction, and low inference latency, while highlighting continuing challenges in rare-class and open-set detection.
Unknown authors· Big Data and Cognitive Compu...· 0 citations
The rapid growth of cyber threats has increased the demand for intelligent and reliable Intrusion Detection Systems (IDS) capable of identifying malicious network activities. Although deep learning techniques achieve high detection accuracy, their complex decisionmaking process often lacks transparency, making it difficult for cybersecurity professionals to interpret the results. To address this issue, this study presents an explainable deep intrusion analytics framework using a Multi-Layer Perceptron (MLP) combined with feature attribution techniques. The framework utilizes the CIC-IDS dataset to classify network traffic into normal and attack categories after performing data preprocessing and feature selection. The MLP model is evaluated using performance metrics such as accuracy, precision, recall, F1-score, confusion matrix, and ROC curve to assess its effectiveness in intrusion detection. To improve model interpretability, LIME and SHAP are employed to explain prediction outcomes and identify the most influential features contributing to each decision. A user-friendly application is developed to support dataset upload, preprocessing, model training, performance evaluation, and explanation generation. Experimental results demonstrate that the proposed framework achieves accurate intrusion detection while providing meaningful explanations, making it a trustworthy and practical solution for modern cybersecurity applications.
David Boon Merugumalla, D. N. Sreekanth· American Journal of AI Cyber...· 0 citations
Abstract: The increasing complexity of cyber threats and the limitations of signature-based intrusion detection systems have made the detection of zero-day attacks a critical challenge in network security. Although machine learning and deep learning methods have achieved high accuracy for known attacks, their ability to generalize to previously unseen attack families remain limited. This paper proposes a hybrid intrusion detection model that integrates a Feature Tokenization-based Transformer with a CNN–BiLSTM model to capture global feature interactions and local sequential dependencies in tabular network traffic data. The learned fusion embedding is further exploited using a Mahalanobis distance–based anomaly detector to identify zero-day intrusions in an open-set setting. Experiments were conducted on the UNSW-NB15 dataset using a strict held-out attack family protocol, where Analysis, Backdoor, and Worms were excluded from training and reserved for zero-day testing. The proposed model achieved 94.64% accuracy, 0.9610 F1-score, and 0.9902 AUC on the known test set, that indicate the strong zero-day detection capability with high family-wise true positive rates for Backdoor and Worms. Five-fold cross-validation, ablation study, and statistical significance analysis further confirmed the robustness and effectiveness of the proposed framework. The results indicate that the integration of transformer-based feature learning, sequential modeling, and covariance-aware embedding analysis provides a reliable and extensible solution for both known attack classification and zero-day intrusion detection.
