A Hybrid CNN-Attention-BiLSTM Framework for Real-Time Network Intrusion Detection
Keywords:
Network Intrusion Detection, Deep Learning, CNN, Self-AttentionAbstract
Due to the rising number and complexity of attacks on modern networks, there is an urgent need for an efficient IDS (intrusion detection system) capable of addressing cyber threats automatically. Conventional machine learning struggles to effectively analyze complex and high-dimensional network flows. In addition, separate deep-learning techniques cannot model both spatial and temporal features at once. We propose a new CAB-IDS, i.e., Convolutional-Attention-BiLSTM Intrusion Detection System, that incorporates 1D-CNN (one-dimensional convolutional neural network) for extracting spatial features, Bidirectional Long Short-Term Memory (BiLSTM) for modeling sequential dependencies, and self-attention mechanism to weight the most significant channels before classification. Our model was tested on the commonly used benchmarks such as NSL-KDD, CICIDS2017, and UNSW-NB15. In particular, the performance of CAB-IDS was compared to eight baselines, such as CNN-LSTM, BiLSTM, and Transformer-IDS. On the NSL-KDD benchmark, our CAB-IDS reached 99.91% accuracy, 99.88% F1-score, and only 0.09% false positive rate. Meanwhile, CNN-LSTM, BiLSTM, and Transformer-IDS were able to achieve 99.68%, 99.72%, and 99.82%, respectively. On CICIDS2017 and UNSW-NB15 datasets, we obtained 99.71% and 97.23% accuracy, correspondingly. Moreover, ablation experiments confirmed the importance of each component independently. The results of statistical validation on the five different trials led to the standard deviation of 0.12% for CICIDS2017. According to Wilcoxon signed-rank test, all our improvements were statistically significant (p < 0.01).
Downloads
References
[1] Ahmad, I., Ul Haq, Q. E., Imran, M., Alassafi, M. O., & AlGhamdi, R. A. (2022). An efficient network intrusion detection and classification system. Mathematics, 10(3), 530. doi:10.3390/math10030530
[2] Sagi, O., & Rokach, L. (2018). Ensemble learning: A survey. Wiley Interdisciplinary Reviews. Data Mining and Knowledge Discovery, 8(4), e1249. doi:10.1002/widm.1249
[3] LeCun, Y., Bengio, Y., & Hinton, G. (2015). Deep learning. Nature, 521(7553), 436–444. doi:10.1038/nature14539
[4] Almiani, M., AbuGhazleh, A., Al-Rahayfeh, A., Atiewi, S., & Razaque, A. (2020). Deep recurrent neural network for IoT intrusion detection system. Simulation Modelling Practice and Theory, 101(102031), 102031. doi:10.1016/j.simpat.2019.102031
[5] Almiani, M., AbuGhazleh, A., Al-Rahayfeh, A., Atiewi, S., & Razaque, A. (2020). Deep recurrent neural network for IoT intrusion detection system. Simulation Modelling Practice and Theory, 101(102031), 102031. doi:10.1016/j.simpat.2019.102031
[6] Bray, F., Laversanne, M., Sung, H., Ferlay, J., Siegel, R. L., Soerjomataram, I., & Jemal, A. (2024). Global cancer statistics 2022: GLOBOCAN estimates of incidence and mortality worldwide for 36 cancers in 185 countries. CA: A Cancer Journal for Clinicians, 74(3), 229–263. doi:10.3322/caac.21834
[7] Bray, F., Laversanne, M., Sung, H., Ferlay, J., Siegel, R. L., Soerjomataram, I., & Jemal, A. (2024). Global cancer statistics 2022: GLOBOCAN estimates of incidence and mortality worldwide for 36 cancers in 185 countries. CA: A Cancer Journal for Clinicians, 74(3), 229–263. doi:10.3322/caac.21834
[8] Yang, Xiuzhang, Peng, Guojun, Zhang, Dongni, Lv, Yangqi, An Enhanced Intrusion Detection System for IoT Networks Based on Deep Learning and Knowledge Graph, Security and Communication Networks, 2022, 4748528, 21 pages, 2022. https://doi.org/10.1155/2022/4748528
[9] Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., & Fei-Fei, L. (2009, June). ImageNet: A large-scale hierarchical image database. 2009 IEEE Conference on Computer Vision and Pattern Recognition. Presented at the 2009 IEEE Computer Society Conference on Computer Vision and Pattern Recognition Workshops (CVPR Workshops), Miami, FL. doi:10.1109/cvpr.2009.5206848
[10] Ferrag, M. A., Maglaras, L., Moschoyiannis, S., & Janicke, H. (2020). Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study. Journal of Information Security and Applications, 50(102419), 102419. doi:10.1016/j.jisa.2019.102419
[11] Hochreiter, S., & Schmidhuber, J. (1997). Long short-term memory. Neural Computation, 9(8), 1735–1780. doi:10.1162/neco.1997.9.8.1735
[12] Bamber, S. S., Katkuri, A. V. R., Sharma, S., & Angurala, M. (2025). A hybrid CNN-LSTM approach for intelligent cyber intrusion detection system. Computers & Security, 148(104146), 104146. doi:10.1016/j.cose.2024.104146
[13] Moustafa, N., & Slay, J. (2016). The evaluation of Network Anomaly Detection Systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set. Information Security Journal A Global Perspective, 25(1–3), 18–31. doi:10.1080/19393555.2015.1125974
[14] Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A. (2018). Toward generating a new intrusion detection dataset and intrusion traffic characterization. Proceedings of the 4th International Conference on Information Systems Security and Privacy. Presented at the 4th International Conference on Information Systems Security and Privacy, Funchal, Madeira, Portugal. doi:10.5220/0006639801080116
[15] Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009, July). A detailed analysis of the KDD CUP 99 data set. 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications. Presented at the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA), Ottawa, ON, Canada. doi:10.1109/cisda.2009.5356528
[16] Thakkar, A., & Lohiya, R. (2023). Fusion of statistical importance for feature selection in Deep Neural Network-based Intrusion Detection System. An International Journal on Information Fusion, 90, 353–363. doi:10.1016/j.inffus.2022.09.026
[17] Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., … Polosukhin, I. (2017). Attention is all you need. doi:10.48550/arXiv.1706.03762
[18] Wang, W., Sheng, Y., Wang, J., Zeng, X., Ye, X., Huang, Y., & Zhu, M. (2018). HAST-IDS: Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection. IEEE Access: Practical Innovations, Open Solutions, 6, 1792–1806. doi:10.1109/access.2017.2780250
[19] González-Ravé, J. M., Moya-Fernández, F., Hermosilla-Perona, F., & Castillo-García, F. J. (2022). Vision-based system for automated estimation of the frontal area of swimmers: Towards the determination of the instant active drag: A pilot study. Sensors (Basel, Switzerland), 22(3), 955. doi:10.3390/s22030955
[20] Zheng, L., Xue, Y., Zhang, L., & Zhang, R. (2017, July). Mutual authentication protocol for RFID based on ECC. 22017 IEEE International Conference on Computational Science and Engineering (CSE) and IEEE International Conference on Embedded and Ubiquitous Computing (EUC). Presented at the 2017 IEEE International Conference on Computational Science and Engineering (CSE) and IEEE International Conference on Embedded and Ubiquitous Computing (EUC), Guangzhou, China. doi:10.1109/cse-euc.2017.245
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Hamzah Alkhazaleh, Shadi Atalla1, Farah Al Nashash, Hessa Almutawa, Mahra Alhammadi, Mariam Stanikzai (Author)
This work is licensed under a Creative Commons Attribution 4.0 International License.
