Hybrid CNN–LSTM Intrusion Detection Framework for Industrial IoT Security

Abstract

Introduction: The rapid adoption of the Industrial Internet of Things (IIoT) has increased the exposure of safety-critical industrial systems to sophisticated cyberattacks, requiring intrusion detection mechanisms that are accurate, computationally efficient, and operationally reliable. Traditional intrusion detection systems often struggle with correlated traffic descriptors, temporal attack evolution, false alarm control, and deployment-level reliability in resource-constrained industrial environments. Methodology: This study proposes a lightweight hybrid CNN–LSTM intrusion detection framework for binary IIoT attack detection. Convolutional layers learn compact representations from high-dimensional statistical traffic descriptors, while an LSTM layer captures short-term temporal dependencies associated with multi-stage and slow-rate attacks. The model was evaluated on the BoTNeTIoT-L01 Industrial IoT benchmark using a leakage-controlled split, imbalance-aware metrics, threshold-specific false alarm analysis, probability calibration, temporal robustness assessment, and CPU-only inference benchmarking. Results: The proposed CNN–LSTM achieved accuracy = 0.99875, precision = 0.99930, recall/sensitivity = 0.99820, F1-score = 0.99875, and FAR = 0.00070 on the held-out test set. At the selected deployment threshold, the model produced a ROC operating point with TPR = 0.99820 and FPR = 0.00070. Same-split baseline and ablation comparisons further demonstrated that the proposed model provided a strong balance between detection performance, false-alarm control, calibration reliability, and CPU inference efficiency. Conclusion: The results indicate that the proposed CNN–LSTM framework is suitable for near-real-time IIoT intrusion detection where low false alarms, calibrated confidence, temporal stability, and lightweight deployment are critical.