2026· Journal of Network and Information Security· 0 citations
TL;DR
A taxonomy of IDS architectures and a survey of recently proposed networks, such as Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), LSTMs, GRUs, Autoencoders, GANs, Transformer-based, as well as hybrids are developed.
Abstract
The interconnected systems, cloud infrastructures, Internet of Things (IoT) devices, and large networks of today have increased the complexity and frequency of cyberattacks. There is now a growing requirement for intelligent and adaptive Intrusion Detection Systems (IDS). Classic signature-based and machine learning-based IDS methodologies usually fail to recognise advanced, evolving, or zero-day attacks due to their single-feature extraction capabilities and reliance on handcrafted rules. Accordingly, Deep Learning (DL) methods have surfaced with the ability of learning features automatically for better detection performance in other networks. This survey presents recent developments that have taken place in deep learning-based intrusion detection systems with supporting statistics from thirty-six representative works published across IoT, cloud, enterprise and SDN. This paper systematically develops a taxonomy of IDS architectures and a survey of recently proposed networks, such as Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), LSTMs, GRUs, Autoencoders, GANs, Transformer-based, as well as hybrids. The performance of models has been evaluated using popular benchmark datasets such as NSL-KDD, UNSW-NB15, CICIDS2017, CICIDS2018, N-BaIoT and CICIoT2023. Many studies reported a detection accuracy more than 98%. Innovative methods such as feature selection, data augmentation, hyperparameter optimisation and spatial temporal learning have been discussed in detail. Although strides have been made yet numerous challenges still loom large, from class imbalance to high computational costs and limited interpretability of models. In the conclusion section, we highlight some of the important research challenges and future directions. Further, we discuss explainable artificial intelligence, adversarial robustness, federated learning, lightweight edge-deployable models, and Transformer-based IDS frameworks. According to this survey, this review will help researchers and practitioners in understanding the current developments and in designing the next generations intelligent intrusion detection systems.
The rapid growth of digital communication technologies, cloud computing, and Internet of Things (IoT) devices has
increased both the frequency and sophistication of cyber-attacks, making effective intrusion detection an essential component of
modern cybersecurity systems. Traditional signature-based intrusion detection systems (IDS) are effective against known attacks
but fail to detect previously unseen or evolving threats. This study investigates the application of deep learning models for binary
network intrusion detection using the NSL-KDD benchmark dataset. Three standalone architectures, Convolutional Neural
Networks (CNN), Long Short-Term Memory (LSTM) networks, and Deep Neural Networks (DNN), are implemented and
evaluated, alongside a CNN-LSTM Hybrid model that integrates spatial and sequential learning, and a DNN-LSTM Ensemble
model that combines independently trained DNN and LSTM predictions through weighted averaging. Following data cleaning,
categorical encoding, normalization, and Random Forest-based feature selection (41 features reduced to 20), all models were
trained and evaluated under identical conditions using Accuracy, Precision, Recall, F1-Score, ROC-AUC, training time, and
inference time. The standalone DNN model achieved the best overall performance, with 80.98% accuracy, 97.08% precision,
68.66% recall, 80.43% F1-score, and 96.11% ROC-AUC, while also requiring the shortest training time (39.69 s). The CNNLSTM Hybrid model attained the highest precision (97.23%) but did not outperform the standalone architectures overall, and
the DNN-LSTM Ensemble produced balanced but not superior results. These findings indicate that carefully designed
standalone architectures can match or exceed the performance of more complex hybrid and ensemble models for binary
intrusion detection, while incurring substantially lower computational cost. The study contributes a controlled, commonframework comparison of five deep learning architectures and provides practical guidance for selecting computationally
efficient models for anomaly-based intrusion detection.
Ketki Naik, Sanjeev Ghosh· International Journal for Re...· 0 citations
The findings indicate that hybrid deep learning techniques can improve network security by enhancing intrusion detection capability while reducing false alarms.
A. O. Jimoh-Mahmud, Abubakar Dayyabu, Abubakar Sadiq Idris et al.· FUDMA Journal of Sciences· 0 citations
The rapid proliferation of Internet of Things (IoT) devices across critical domains including healthcare, smart cities, industrial control systems, and intelligent transportation has fundamentally transformed the cybersecurity threat landscape. The inherent characteristics of IoT environments, namely resource-constrained devices, heterogeneous architectures, and large-scale deployment, render traditional Intrusion Detection Systems (IDS) inadequate for the sophisticated and evolving attack vectors targeting these networks. Deep learning (DL) has emerged as a compelling paradigm for next-generation IoT IDS, offering automated feature extraction, temporal pattern recognition, and adaptive threat detection capabilities that address the limitations of conventional approaches.
This paper provides a thorough and systematic review of the existing DL methods for IoT intrusion detection. The paper explore the IoT architectural paradigms, outline a four layered taxonomy for types of IoT attacks across its three primary layers Perception, Network and Application as well as Adversarial Machine Learning attacks, and systematically review seven classes of DL architectures Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM) networks, Gated Recurrent Units (GRU), Autoencoders, Generative Adversarial Networks (GAN), models based on Transformer architecture and Federated Learning frameworks. In a comparative review of forty peer-reviewed studies, we demonstrate that hybrid DL models provide excellent detection performance (99-100% classification accuracy on benchmark datasets) as well as practical viability for deployment with privacy-preserving Federated Learning for large-scale data. The study additionally highlights five enduring challenges class imbalance, adversarial vulnerability, zero-day detection limitations, computational constraints and the absence of standardized benchmarking protocols that together account for the gap between performance benchmarks and real-world deployment efficacy. It outlines future research avenues targeting on five key axes with a particular focus in the integration of Explainable AI (XAI), lightweight edge-deployable architectures, and adversarial robustness mechanisms. This survey identifies a structured reference to advance the state of IoT intrusion detection from research to operationally viable and deployable systems.
Mohammed Gharkan, Mustafa I. Hussien Al-Janabi, Obaid Salim· Al-Noor Journal of Engineeri...· 0 citations
LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies, which shows its capacity in learning long-lasting dependencies.
Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al.· Italian National Conference...· 0 citations
Network Intrusion Detection Systems (NIDS) are critical defense layers in modern IoT and IIoT environments, which are disproportionately targeted by evolving cyber threats. Classical machine learning approaches and individual deep learning models face documented limitations, including reliance on outdated datasets, susceptibility to class imbalance, and failure to leverage the complementary detection strengths of diverse architectures. This paper presents the formulation and evaluations of a Stacked Deep Learning Ensemble (SDLE) framework for binary network intrusion detection. The ensemble was based on Recurrent Neural Networks (RNN), Gated Recurrent Units (GRU), and Autoencoders as base learners with a Long Short-Term Memory (LSTM) network as the meta-learner. The framework is trained and evaluated on the ToN_IoT dataset, a contemporary IoT/IIoT benchmark comprising 461,043 records and nine attack categories, following a systematic three-stage preprocessing pipeline that incorporates label encoding, one-hot encoding, feature selection, SMOTE-based class balancing, and standard scaling. Experimental results demonstrate that the SDLE achieves 98.67% accuracy, 98.91% precision, 98.45% recall, and 98.68% F1-score, surpassing each base model and a simple voting ensemble by 0.78–1.94 percentage points. Preprocessing contributes a cumulative gain of 7.43 percentage points over raw data performance, with feature selection identified as the single most impactful step (+2.29%). The results also established that the platform provides an effective IDS model and empirical guidance for preprocessing and meta-learner design in deep learning ensemble systems.
D. Haruna, B. Alese, G. Iwasokun et al.· Advances in Networks· 0 citations
The Hybrid Autoencoder–TabTransformer framework provides an effective intrusion detection solution that demonstrates strong performance under the evaluated experimental conditions and comparative analysis with existing deep learning‐based intrusion detection approaches confirms the superior and balanced performance of the proposed method.
Rui Guo, Guangjun Wen· Transactions on Emerging Tel...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
