A Hybrid CNN-BiLSTM Attention-Based Framework for Intelligent Intrusion Detection

Abstract

The rapid growth of networked and cloud-connected infrastructure has widened the attack surface available to adversaries, exposing enterprise and IoT environments to increasingly stealthy and evolving intrusions. Signature-based and shallow machine-learning intrusion detection systems (IDS) generalize poorly to zero-day and low-frequency attack classes and typically treat traffic features independently, ignoring both the spatial correlation among flow attributes and the temporal evolution of a connection. This paper proposes a novel Hybrid CNN-BiLSTM Attention-based Ensemble Framework (CBAF) that unifies three complementary representations of network traffic. A one-dimensional feature vector is first reshaped into a two-dimensional matrix and passed through convolutional layers that learn local spatial correlations among protocol, packet, and byte-level attributes. The resulting feature maps are fed into a Bidirectional Long Short-Term Memory (BiLSTM) network that models the forward and backward temporal dependencies characteristic of multi-stage attacks. A self-attention layer then assigns adaptive importance weights to the most discriminative time steps and features, improving both detection accuracy and interpretability. The attention-weighted representation is finally passed to a stacked Random Forest meta-classifier that consolidates the deep and shallow decision boundaries to reduce false positives. The framework further incorporates SMOTE-based oversampling to counter the severe class imbalance found in benchmark intrusion datasets. Experiments on NSL-KDD, CICIDS2017, and UNSW-NB15 show that the proposed CBAF achieves 97.6% accuracy and a 0.96 F1-score, outperforming Logistic Regression, Support Vector Machine, Random Forest, and a plain CNN-LSTM baseline, while maintaining real-time inference latency suitable for deployment in security operations centers (SOCs).