A Hybrid CNN-LSTM Deep Learning Model for Intrusion Detection in Network Security

Abstract

As cyber threats keep growing in scale and sophistication, mostly because cloud computing got adopted fast, plus the Internet of Things, SDN, and 5G all being used more, it made the old signature and rule based Intrusion Detection Systems (IDS) show their limits. In other words, these systems can’t really spot zero-day attacks well, they throw a lot of false alarms, and they don’t adapt nicely to the constantly changing behavior of network traffic. This work puts forward a hybrid deep learning model, somehow mixing Convolutional Neural Networks (CNN) with Long Short-Term Memory (LSTM) networks, so it can learn both the spatial side and the temporal side at the same time, from network data. The CNN part does the heavy lifting for local spatial patterns, and also captures feature correlations from preprocessed traffic, whereas the LSTM part focuses on sequential, time dependent relationships, to uncover attack behaviors that evolve over time. For regularization, it uses L2 weight penalties along with multi stage dropout, so over fitting is reduced and generalization improves, bit better.  The model is trained and tested using the benchmark NSL-KDD and KDDCup99 datasets, covering Normal traffic plus Denial-of-Service (DoS), Probe, Remote-to-Local (R2L), and User-to-Root (U2R) categories too. Experimental findings indicate that the proposed hybrid CNN-LSTM framework consistently beats classical machine learning classifiers like Logistic Regression, Naive Bayes, K-Nearest Neighbors, and Decision Tree, Ad a Boost, Random Forest, and SVM. It also beats deep neural network variants, and several earlier hybrid architectures (TFTC, MDPCA-DBNs, Siam-IDS, I-ELM, HFR-MLR).  What really stands out is that it reaches a True Positive Rate of 89.45% on the historically difficult U2R class, while keeping the false positive rate around only 0.20% . This suggests the architecture improves minority class detection, in a pretty direct way, and without sacrificing too much reliability.