Attention-augmented CNN-BiLSTM with temporal-spatial attention for imbalanced multi-class network intrusion detection

Abstract

Intrusion detection in heterogeneous network environments remains challenging because of severe class imbalance, evolving attack patterns, and the limited ability of existing deep learning models to jointly exploit temporal dependencies and feature-level correlations. To address these challenges, this paper proposes an Attention-Augmented CNN-BiLSTM (AA-CNN-BiLSTM) architecture incorporating a lightweight Temporal-Spatial Attention Module (TSAM) that independently models temporal and feature-wise attention through factorised attention streams and adaptively fuses them using a learnable gating mechanism. Unlike conventional self-attention, TSAM achieves a computational complexity of O(TC(T + C)), making it suitable for resource-constrained edge internet-of-things (IoT) environments. Furthermore, severe class imbalance is mitigated through the combined use of SMOTE oversampling and Focal Loss, providing complementary data-level and objective-level imbalance handling. The proposed framework is evaluated on two publicly available benchmarks representing different network settings: CIC-IoV-2024, which provides a vehicular-IoT intrusion detection environment, and CIC-IDS2017, which serves as a general network intrusion detection benchmark. On the highly imbalanced CIC-IoV-2024 dataset, the proposed model achieves a Macro-F1 score of 0.7421, Macro-AUC of 0.9961, and Cohen’s Kappa of 0.9374, representing improvements of 2.81 percentage points in Macro-F1 and 0.0167 in Kappa over the CNN-BiLSTM baseline while maintaining an overall accuracy of 98.71%. On CIC-IDS2017, the proposed framework attains a Macro-F1 score of 0.7951, Macro-AUC of 0.9903, and Cohen’s Kappa of 0.8841, outperforming the baseline by 2.01 percentage points in Macro-F1 and 0.0249 in Kappa. Additional ablation studies confirm the complementary contributions of SMOTE and Focal Loss, while inference latency analysis indicates that TSAM introduces only a modest computational overhead and preserves millisecond-level inference suitable for real-time deployment. Statistical significance of the observed improvements is confirmed using paired Wilcoxon signed-rank tests across six independent experimental runs. Overall, the proposed AA-CNN-BiLSTM achieves an effective balance between computational efficiency, robustness to severe class imbalance, and accurate multi-class intrusion detection for next-generation IoT security systems.